Data security gurus to corporate lawyers: Get to know the FBI

The convention was aimed at law firms and in-house lawyers at companies of all kinds, not specifically at companies that handle large amounts of data subject to the Health Insurance Portability and Accountability Act (HIPAA) privacy and data security standards. 

But Liebermann and the other speakers — Ovie Carroll, director of the cybercrime lab at the U.S. Department of Justice, and Ed Goings, a consultant at KPMG LLP — had data security planning and management tips that could apply brokers, health insurers and other handlers of HIPAA data as well as to handlers of other sensitive information.

The speakers said companies should:

• Have data security planning sessions focused on information technology and sessions dominated by people from outside IT.

• Decide how and when to tell the chief executive officer, board members and law enforcement agencies about cyber problems.

• Recognize that, once a breach occurs, the IT part of the response is just one part of the response.

• Recognize that letting law enforcement agencies learn about a data breach from a news media report is a very bad idea.

• Consider hiring a separate public relations firm, possibly through outside counsel, for cyber crisis communications. Structuring crisis public relations that way could increase the odds that the arrangement will get attorney-client privilege protection, Liebermann said.

• Have internal teams, outside vendors, and, if possible, different outside vendors test system defenses. Getting fresh eyes on the defenses is important, because even the best teams may miss problems, Liebermann said.

• Recognize that hackers are always improving their methods. “Think like the hacker,” Liebermann said. “Continuously transform.”

In other discussions at the session:

• Liebermann noted that cloud services vendors often make doing thorough system security assessments difficult.

• Liebermann, who spent nine years working in the U.S. Attorney’s Office, said he hopes the new Cyber Information Security Act of 2015 (CISA), which was in the H.R. 2029 package, will help make information sharing between cyberattack victims and government agencies more of a two-way street. In the past, he said, some agencies’ attitude about “information sharing” has been, “I get to play with my toys, and I get to share your toys.”

• Carroll said device efforts to sync data may create new, unrecognized forms of security risk, by creating big, obscure databases showing what users looked at, and when, and, often, where the users were when they looked at the information.

See also:

American Airlines, Sabre said to be hit in hacks backed by China

China-tied hackers that hit U.S. said to breach United Airlines

Are you following us on Facebook?