This post first appeared on Risk Management Magazine. Read the original article.
When we think about cyber incident response, we think about
detection, analysis, containment, eradication, remediation and reporting. These
stages are not just about technical and forensic response, however. Throughout
each, legal risks and considerations must also be addressed. It is imperative
to focus on gaining technical understanding of what the threat actor did, when
they did it, and how to overcome their interference and resulting business
interruptions. At the same time, equal focus must be given to examining
applicable state and/or federal laws, contractual obligations, and any other
potential legal exposures or rights. This can be accomplished while
simultaneously managing other aspects of incident response, including cyber
insurance carrier updates, public relations, internal communications and, of
course, technical response. Working with legal counsel and the organization’s
incident response team to answer material legal questions through the phases of
incident response often dictates how and when the next phase is handled.
Detection
The cyber insurance carrier, incident response team and
legal counsel generally collect information during the detection phase that may
be vital to later determinations about legal obligations such as whether
individuals or regulatory bodies require notice of the incident. At the point
of detection, legal counsel and the incident response team begin to learn about
the incident’s scope, the threat actor’s priority, and the nature of the
vulnerabilities they potentially exploited. Time is a critical factor. Upon
detection, legal may start multiple clocks, each tracking how much time the
company has until reporting deadlines under law or contract.
Questions that relate to legal considerations may include:
Where is the evidence that the threat actor accessed or acquired personal
information? Where was the threat actor’s activity located—in a space populated
with sensitive and confidential information, in an email account, across the
network, or on a web server containing no personally identifiable information?
These and many other context-specific questions help inform the understanding
of legal risks and requirements for responding to a cyber incident. Another
early legal risk stems from the duty to preserve relevant information and
artifacts of an incident, instead of overwriting or deleting them.
Analysis, Containment and Eradication
The next phase is analysis and containment. While the
incident response team works to secure the environment, legal considerations
are refined as more details and forensic analysis becomes available. For
instance, once logs are collected to study the threat actor’s movement and to
review the categories of personal information at risk, legal can identify any
state-specific data breach notification laws that may apply. Legal will then
relay information to the insurance carrier and may involve law enforcement,
depending on the nature of the incident.
New legal risks may arise as more information comes to
light. For instance, the team may confirm that ransomware impacted the
company’s primary systems and back-ups, increasing the pressure to pay threat
actors to receive a decryption key to continue business operations. Paying a
ransom requires consulting with the insurance carrier, appropriate forensic
vendors and, importantly, the Treasury Department’s Office of Foreign Assets
Control (OFAC) and Specially Designated Nationals and Blocked Persons List to
avoid making payment to prohibited entities.
At the same time, the incident response and legal teams
should be reviewing all relevant contracts to identify what responsibilities
may exist to notify clients, or to recognize the impact of any subsequent
business interruptions under the terms of a service-level agreement.
It may also become apparent that the source of the incident
was a vendor or other third party. In such cases, the incident response and
legal teams should review relevant contracts to understand the enterprise’s
contractual rights and remedies, prepare a plan for preserving those rights,
and communicate to the third party about the incident, including instituting a
legal hold of relevant materials and notice of claim.
Remediation and Reporting
With the remediation and reporting phase, the next set of
legal issues to address includes the specific steps to notify the affected
parties and/or regulators, as necessary. Whether by law or contract, there are
usually specific requirements for giving such notice, including the method by
which it is delivered and its content. Depending on the industry and type of
incident, mitigating the risk of regulatory penalty may involve implementing
additional safeguards, building on existing policies, and formalizing specific
protocols. Ignoring these requirements could result in an oversimplified
response that creates unnecessary risk of an enforcement action by regulators.
Similarly, applicable laws may require documenting the process by which you
determined whether to notify individuals, requiring legal to memorialize the
specific factors involved. Reporting also includes honoring contractual
obligations and updating your cyber insurance carrier.
Because different risks can appear throughout the cyber
incident response process and can be highly dependent on context and specifics,
legal considerations are a constant. Cooperation among legal counsel, insurers
and the incident response team is essential to identify and answer key legal
questions, prepare an incident response plan, train incident response team
members, and assist during an actual incident or suspected data breach. A
systematic and well-defined approach to cyberattack mitigation should not only
encompass proactive risk identification, risk assessment and technical
recommendations to reduce risk, but also take legal considerations into
account. Developing and implementing such an approach will best position
organizations to weather any cyber incidents to come.