Incident Response Comes of Age Daily Journal Professional Education Cyber Boot Camp, January 12, 2017 Sarah Bruno, Arent Fox LLP Patrick Hynes, PwC John Mullen, Redacted, Inc. Tracy L. Wilkison, Assistant United States Attorney, Chief, Cyber and Intellectual Property Crimes Section, National Security Division Moderator: Tanya Forsheit

Agenda A Brief History of Breach Notification Laws Preventative Medicine Evolving Threat Vectors After an Incident

A Brief History of Breach Notification Laws Breach Notification Laws Enter the Teen Years

Data Breach Notification Laws Beginning in 2002, legislators across the country began passing laws requiring consumer notification when there is a security breach involving private information. Forty-seven states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have passed security breach notification laws affecting private entities. Most follow California’s lead, but with some key differences (e.g., “material” breach requirement; expanded definition of “personal information”; breach involving non-computerized data; notification procedures; requirement to notify consumer reporting and/or law enforcement agencies; exemptions from mandatory notification (e.g., encryption); penalties)

Preventative Medicine

“Reasonable Security” Floor, not a ceiling State Data Security Laws Federal Trade Commission Section 5 authority and enforcement actions/consent decrees California Attorney General 2016 Annual Data Security Breach Report Dual Factor Authentication Center for Internet Security Controls

Service Provider Oversight and Contracts Due Diligence RFPs Contract Negotiation “Reasonable Security” Controls (again) Indemnification and Limitations on Liability Insurance Audits

Practice, Practice, Practice While data breaches are inevitable, the company can take measures to be ready for the next breach. The Team Internal Stakeholders External Vendors Legal Forensics Mailing and Call Center Remediation Crisis Communications The Incident Response Plan Drills/Tabletop Exercises

Evolving Threat Vectors

Evolving Threat Vectors Copyright: <a href='http://www.123rf.com/profile_leolintang'>leolintang / 123RF Stock Photo</a>

After an Incident

First and Foremost

Evaluate Risks State Breach Notification Laws State Attorney General Enforcement and Guidance FTC Enforcement and Guidance Reputational Damage International Issues

Investigate, Contain & Respond Investigate! (Remember Forensics 101 from this morning) Contain! Notify (as applicable and pursuant to statute): Internal Stakeholders and affected Business Partners/Vendors Affected Individuals Regulators Card companies Law enforcement Auditors Others? Remediation Services? Communications Strategy?