Articles Posted in Risk Evaluation and Management

This article was originally published by Hotel Business Review and is reprinted with permission from www.hotelexecutive.com.

Almost as soon as there were data breaches, hotels became a prime target of hackers, and the hospitality industry has consistently been one of the most commonly targeted businesses. Since 2010, hotel properties ranging from major multinational corporations to single location hotels have been impacted.

The recent report that Hyatt Hotels was a victim for the second time in as many years has raised more concerns about the industry’s ability to address cybersecurity. While consumers are so used to receiving breach notices that “breach fatigue” has set in, the second successful attack on Hyatt is sure to raise the eyebrows of regulators, plaintiffs’ lawyers, and guests. The data breach will affect the loyalty, trust and consumer perception of all Hyatt Hotels guests. So how can hotels prove to guests that they are safe and trustworthy?

“While the company claims that it has implemented additional security measures to strengthen the security of its systems, no explanation was given as to why these additional measures were not implemented after the first attack,” said Robert Cattanach of Dorsey & Whitney. “Estimates of actual harm have yet to be provided, which is typically the weak spot of any attempted class action, but the liability exposure seems problematic regardless.”

Hyatt is in no way alone. On November 2, 2017, the BBC reported that Hilton was fined $700,000 for “mishandling” two data breaches in 2014 and 2015. The attorneys general of New York and Vermont said Hilton took too long to inform their guests about the breaches and the hotels “lacked adequate security measures.” Hilton discovered the first of the two breaches in February 2015 and the second in July 2015, according to the article, but the company only went public with the breaches in November 2015. The company has said there is no evidence any of the data accessed was stolen, but the attorneys general said the tools used in the data breaches made it impossible to determine what was done. Continue reading

 

padlock-cybersecurity-300x203

First in a series of blogs about blockchain technology and
its impact on business practices, corporate governance and cybersecurity

It’s hard to avoid articles, white papers, blog pieces and presentations that promote the almost magical use of blockchain – it seems that blockchain, a form of distributed ledger technology, can be applied to virtually any situation, and best of all, it is entirely secure.  As Don and Alex Tapscott wrote in Blockchain Revolution, “The blockchain is an incorruptible digital ledger of economic transactions that can be programmed to record not just financial transactions but virtually everything of value.”

One aspect of blockchain technology has become highly debated – whether it is as secure as its proponents claim.  Since it seems inevitable that blockchain technology will be used to drive a variety of transactions, and not simply cryptocurrency, the JMBM Cybersecurity and Privacy Group has examined the technology and its impact on data security and corporate governance.

But before we can discuss the benefits and pitfalls of the technology, we have to answer a threshold question: what is a blockchain? Continue reading

padlock-cybersecurity-300x203

It’s ironic: when global threats are in the news every day, their ubiquity makes them easy to ignore. Whether they be political threats, climate threats, or data security threats, we can become numb to ever-present risk. Add in the chorus of advice from the growing number of providers, and even those who want to act become paralyzed by choice and complexity.  Cybersecurity is no exception – the daily deluge of breach notices and press reports of massive attacks has made us less, not more, sensitive to the threat.

Crisis fatigue can be compounded with defeatist thinking, believing that no matter what you do, you will still be hacked and have your data compromised.  So it is no surprise that while companies know data security should be a top priority, in reality, it’s easy to focus on more urgent – but less essential – items.

Cybersecurity faces additional hurdles that make it even challenging to address.  By identifying those hurdles, however, firms may be able to overcome these barriers and move forward on the path to minimizing one of the greatest risks your company faces.

Data Security Is Expensive – But Not as Expensive as the Alternative

Implementing a cybersecure environment requires a commitment in technology, training, and adapting to the constant rate of change and upgrading processes. The extra steps needed for the simplest of tasks, such as logging in, add to the daily cost of doing business.

Gartner estimates that worldwide spending on data security this year will hit $90 billion. It’s understandable that a CEO would see that as money lost from corporate value. But these expenditures should be seen  as an investment to preserve corporate value. Breaches are much more expensive and disruptive than the budgeted, planned improvements to systems, which can be controlled and implemented over time.

Intelligent and consistent technology upgrades, combined with regular training for all employees, are, in the end, better for a company’s bottom line than crisis management and costly technology remediation after the fact. Creative corporate leaders reframe the expense question and find budget for what’s vital.

Data Security Seems Really Complicated

For most of us, data security is complicated. We aren’t IT professionals, and venturing into the cybersecurity world is a challenge. Those who suffer any amount of technophobia may assume that they don’t know it and, more dangerously, that they can’t learn it. The technology community can reinforce this fear by speaking a foreign language and using unfamiliar terminology, all of which creates another barrier for non-technical executives and managers who need to understand the issues sufficiently enough to make intelligent decisions. Non-technical company management often feel that they are at the mercy of the IT experts. Even those who master important concepts in data and cybersecurity may doubt that knowledge, as there can be a tendency on the tech side to stress just how complicated things really are, reinforcing the need for their expertise. Continue reading

cursor-clicks-red-VIRUS-button-300x225

Ever since California adopted the nation’s first breach notification law in 2002, companies that have suffered a data breach have focused on whether and how to notify their customers, employees and others of the nature and extent of the breach.  California’s law has been amended multiple times, and has been followed by breach notification laws in almost every state, as well as the notification requirements under the Health Insurance Portability and Accountability Act (“HIPPA”).  As these laws developed, a tandem requirement has emerged:  the obligation to take reasonable steps to protect data, and companies are, increasingly focused on taking steps to ensure the security of their data.

Recent breaches, however, have made it clear that these efforts do not address what might be the most pressing problem facing businesses:  how to recover from a malicious attack.  As data security attacks have evolved, firms must recognize an entirely different set of risks.

In the past, most hackers have focused on obtaining financial or personal information for profit.  Thus, the most publicized data breaches – Wyndham and Target, as examples – were directed at obtaining credit card information which could be sold on the dark web.  While these incidents can be expensive, they rarely threaten the existence of a firm; indeed, most consumers are so inured to the likelihood that their credit card information may be stolen that they take a blasé attitude and assume, correctly, that their personal losses will be small, typically limited to the inconvenience of getting a new credit or debit card.  Similarly, as more and more companies recognize the likelihood of a loss and, in response, adopt breach notification policies backed by cybersecurity insurance, the impact has become incorporated into the cost of doing business.

This attitude began to change with the increased incidence of ransomware.  Rather than seek financial or personal data, ransomware exploits technical or, more often, human vulnerabilities to encrypt data and hold it hostage in return for payment of ransom.  There have been highly publicized incidents, including hospitals, hotels, law enforcement agencies and other entities, that paid ransom in return for access to their data.  While paying ransom has been almost universally criticized, many firms felt they had no choice; they did not have adequate backups, and the only possible means of continuing business was to pay a relatively modest payment.

With the recent Petya virus attacks, however, that calculus has changed.  It has become more and more apparent that this virus, while claiming to be ransomware, was actually much more destructive; researchers increasingly believe that the malware was “wiperware” with the objective of permanently destroying data, and the perpetrators of the virus had no intention of freeing the data.  The researchers analyzing Petya (sometimes called PetyaWrap, NotPetya, and ExPetr) have speculated the ransom note left behind in the attack was a hoax intended to capitalize on media interest sparked by the May Wannacry ransomware attack. Continue reading

Web analytics concept - Multicolor version

Middle-market companies have cultures, goals and business needs that are distinct from larger firms, and nowhere is that more true than with cybersecurity.

Fortune 500 companies and brands with household names are much more likely to recover their reputations following a data breach.  While breaches are costly in financial terms to all companies, the damage to the brand of a middle-market company may not be survivable.  Large companies can weather the storm of negative publicity and loss of reputation, but mid-markets often cannot:  60% of middle-market companies that are hacked are out of business within one year.

This presents a near-paralyzing scenario to middle-market managers – the mere spectre of a data breach presents business risks that are difficult for them to fathom.

In our work with middle-market companies, we’ve developed effective strategies to help companies respond to the risk and protect their vital digital assets.  In fact, when the process is managed well, middle-market companies can respond to cybersecurity threats more quickly and effectively than larger businesses. Continue reading

padlock-cybersecurity-300x203

You spent valuable time and resources crafting a cybersecurity breach action plan. You’ve assembled a multidisciplinary response team. You’ve identified who is responsible for what, and what decision-tree will go into effect. The plan has been circulated. You’ve even engaged a separate law firm that will be on call in the event of a breach. You’ve done the same with a PR firm, a private investigator and data breach hit squad.

But if the action plan stays put on a shelf, it isn’t really of much value. Smart companies run a tabletop exercise, where first responders sit at a conference table and run through what will happen in the event of a breach. But really smart companies do something more – they take their efforts out of the conference room and into the real world. Breaches involve stress, panic and urgency. It’s not the time to be opening a binder and flipping through tabs for instructions. All those with responsibility for securing the breach need to be battle tested.

Just as fire drills are mandated safety requirements, breach drills should be mandatory training for your team. These exercises bring to light the weaknesses, if any, inherent in your breach response plan. These drills take a good plan and refine it into a great plan.

The key to testing the plan is making your drill as realistic as possible. Notify responders there will be a drill, but not when it will happen. Then, perhaps on a weekend, unleash a hypothetical and set things in motion. Designate several observers to follow the drill to see how closely actions hew to the plan. Document what went right and what went wrong so adjustments can be made later. Continue reading

Web analytics concept - Multicolor versionWhile there is no nationwide cybersecurity program, the Federal Trade Commission has brought more than 50 actions claiming that the cybersecurity practices of a variety of companies in a variety of industries. While these actions have primarily been administrative and resulted in settlements, and the specifics of each order apply only to the company affected, these actions are instructive as to what the FTC expects of cybersecurity programs.  A byproduct of the FTC’s actions is a guide to companies to create better privacy and security policies and programs.  While these cases don’t necessarily identify how to run “gold-standard” programs, they identify what the FTC expects as minimum standards for efforts to protect data.

The FTC has said that most enforcement actions it has brought involve “basic, fundamental security missteps.” Many are human error, but there are also plenty that show deficiencies in cybersecurity risk assessments and programs.  This piece describes baseline guides; companies should consult qualified counsel for specifics. Engaging counsel itself on these issues is a sign to regulators that a company takes cybersecurity seriously. But doing it correctly depends on engaging top legal counsel and experienced advisors early on.

Human Factor.  No cybersecurity program is ironclad as long as human error exists and the skills of hackers evolve at the same rate as technology itself. But many cybersecurity breaches are the result of more simple mistakes. The FTC requires “reasonable” efforts, not complete security.

It’s also important to note that cybersecurity solutions are not one-size-fits-all, even for companies within the same industry. Prevention programs depend on the unique circumstances and business practices of each company. Regardless of company or industry, however, a demonstrated commitment to security is required, both to satisfy the government and to protect valuable corporate and customer assets.  Continue reading

The Big Data deluge - A businessman tries to crunch the numbers at his desk.pngCybersecurity horror stories tend to focus on government agencies, retail outlets, health care institutions, and other companies serving consumers. But business professionals such as lawyers, accountants and business managers are increasingly at risk of attack, and may be less prepared to handle a cyber assault.

Late last year, three Chinese citizens were criminally charged in the United States with trading on confidential corporate information obtained by hacking into networks and servers of two prominent law firms, reported to be Cravath, Swaine & Moore LLP and Weil, Gotshal & Manges LLP, working on sensitive and highly confidential mergers. This was market-moving data, including information on Cravath’s work and information on an acquisition of its client, Pitney Bowes.

Prosecutors said the hackers gained access to the law firm’s computer system using an employee’s credentials. The hackers then installed malware on the firm’s servers to access emails from lawyers, including a partner responsible for the Pitney deal. Similarly, the hackers obtained information about an Intel acquisition from the IT system of its counsel, Weil Gotshal. The hackers made millions of dollars trading on the confidential information about the deals, and exposed the danger law firms and other professional service firms face.

What’s worse, consider this: in all likelihood, there are probably dozens of professional service firms that have experienced cybersecurity breaches and don’t even know it. Continue reading

Last year, SEC Chair Mary Jo White named cybersecurity as the biggest risk facing financial markets. But the risk isn’t limited to the financial industry – even a casual review of breach reports in the mainstream press shows that cybersecurity is a risk common to all companies in any industry.  The challenge facing companies is how to prepare for what seems to be inevitable, and how to do it in an efficient and economical basis.

The key element in preparing for a data breach is less a technical matter than a traditional evaluation of business risk.  Companies regularly analyze the risks of business decisions, and just as regularly, recognize that risk analysis requires legal advice.  Evaluating cybersecurity risk is no different – it requires that a company understands the risks it takes, which risks it is willing to assume as part of its business and which risks need to be eliminated or shifted (through insurance, contractual arrangements or otherwise).  Understanding this, obtaining competent legal advice before a breach is a critical aspect of any cybersecurity plan.

Despite this fact, many companies focus their data protection programs in IT, and only bring in their lawyers late in the game to bless their cybersecurity measures. While legal expenses are always a concern, companies will reap a greater return on their overall cybersecurity investment by soliciting advice early on, and stand better odds a breach will be handled correctly and efficiently.

What can cybersecurity lawyers bring to the table?

Hand-in-Glove Collaboration

Perhaps most importantly, legal counsel commonly work with a variety of corporate players and are in a unique position to work hand-in-glove with IT, HR, and other functions to assess and reduce cybersecurity risk while still permitting a company to function efficiently. An experienced lawyer is often the best person to lead a team that establishes key protocols to avoid a breach, including policies and procedures for privacy, confidentiality, mobile device usage, record retention, and breach protocol.  Lawyers are particularly able to address the key elements of an effective cybersecurity plan. Continue reading

Cyber risk affects businesses of every size and industry. A data breach can lead to negative publicity, loss of customer confidence and potential lawsuits. There can be a variety of unanticipated – and costly – business disruptions.

Just ask the owners of the Romantik Seehotel Jaegerwirt hotel, in the Austrian Alps, which recently had their systems frozen by hackers, resulting in the complete shutdown of hotel computers. The hackers breached the hotel’s key card system, making it impossible for guests to enter their rooms and preventing the hotel from reprogramming the cards.

The hackers did not scrape guests’ credit card data, as has happened with other hotel data breaches, but instead demanded a ransom payable in Bitcoin. The Romantik Seehotel Jaegerwirt – which was fully occupied at the beginning of ski season – paid the ransom, at which time control of the key card system was restored.

While highly disruptive, it’s easy to imagine how it could have been worse. Fortunately, the hotel located and fixed the backdoor left by the hackers (which the hackers tried to exploit almost immediately) and secured their systems.

Vulnerability to hackers seeking to take control of a building’s system is a very real threat to organizations of all kinds: hospitals, hotels, law firms, research facilities, banks, retailers – virtually any kind of business that is housed in a “smart” building. Continue reading