Cybersecurity – Three Perspectives by Nicholas A. Klinefeldt, Faegre Baker Daniels Paul H. Luehr, Faegre Baker Daniels Nicholas Gerhart, FBL Financial Group, Inc. Drake University Law School and ACC, Iowa Chapter 5th Annual Corporate Counsel Forum, Des Moines, IA

Threat Landscape: Data Breach Costs U.S. average cost of a data breach ($4 M globally) $6.5 M 29% Increase since 2013, in global cost of a breach U.S. average cost for each exposed record ($158 globally) $221 Source: 2016 Cost of Data Breach Study: Global Analysis, Sponsored by IBM, Conducted by Ponemon Institute LLC (June 2016)

Threat Landscape: Data Breach Costs 66% 34% Indirect Costs: Staff hours Lost Goodwill Customer “Churn” Direct Costs: Outside Counsel Outside Experts ID Theft Insurance Notification Costs Source: 2016 Cost of Data Breach Study: Global Analysis, Sponsored by IBM, Conducted by Ponemon Institute LLC (June 2016)

Global Data Breach Cost – Per Capita, by Industry Threat Landscape: Data Breach Costs Global Data Breach Cost – Per Capita, by Industry Source: Ponemon Institute, “2016 Cost of Data Breach Study: Global Analysis,” Sponsored by IBM (June 2016)

Threat Landscape: Threat Actors and their Motives Charge for Fraudulent Treatment Obtain Free Treatment or Purchase Prescription Drugs Wage or Tax Fraud Monetize Personal Data Steal Intellectual Property Expose Sensitive Data Destroy or Corrupt Data Disrupt Services Extortion FINANCIALLY MOTIVATED HACKERS HACKTIVISTS/TERRORISTS SECURITY RESEARCHERS NATION STATES INSIDERS

Threats - Extortion Ransomware

Ransomware Threats - Extortion Spam (up 4x) with ransomware = 40% to 66%, Demand = $200 to $10,000+ (often in Bitcoin) Largest cost = downtime Sources: IBM, Malwarebytes, Datto

Threats - Extortion WannaCry – one of the largest attacks in history Over 230,000 infections Over 150 countries Vulnerable Unpatched Windows OS Old, pirated OS Victims UK NHS Telefonica FedEx

Threats – Email Fraud

“Business Email Compromise” (BEC) Threats - Email Fraud “Business Email Compromise” (BEC) Losses $3 billion in losses by Feb. 2017 Up 1300% since Jan. 2015 Victims in 50 states and 100 countries Average = $25,000 to $90,000 Ubiquiti Networks: $46.7 million in fraud transfers

Threats: Attacks on the Internet of Things IoT DDoS Dyn DOS Example Traffic spike = 40-50x above normal Victims = Dyn, Amazon, Netflix, Twitter, et al Source = Internet of Things (IoT) DVR Video cameras Sources: Dyn, Krebs on Security

Incident Response Team Prevention: Develop an Effective IR Team Deploy an Effective IR Team Multiple representatives Led by counsel With contact sheet for: Outside counsel Forensic experts Crisis communicators Notification firms Insurance agent/broker Law enforcement In-House Counsel Outside Counsel Client & Media Relations In-House IT Incident Response Team Human Resources CPO, CSO Compliance Outside Forensics Experts Business Unit

Prevention: Insurance as part of your IR Team Insurance - Types Probably not E&O anymore Cyber Coverage Cost of investigation (using pre-approved attorneys & experts?) Cost of repairs Lost business? Timing Notify broker/agent upon suspecting a breach Notify before paying ransom

Prevention: Law Enforcement as part of your IR Team

Prevention: Law Enforcement as part of your IR Team Mandatory Reporting Personally Identifiable Information, Medical Records Financial Institutions (SAR), Investors (SEC), etc. Goals Solve crime, assist victims, seek justice NOT “take over” a victim’s business Typical Requests Raw intrusion data – hard drives, logs NOT your internal memos or reports Typical Benefits Intel back on a particular type of perpetrator PR value of letting public know that you’ve contacted the authorities

Prevention: Re-Design Corporate Governance Board Executive Management Bus Ops IT Network Architecture InfoSec Marketing Legal Finance Insurance/Risk Risk Committee Insurance Litigation Board Executive Management Bus Ops IT Network Architecture InfoSec Marketing Legal Privacy Finance Insurance/Risk Privacy & Security

Corp. Strategy Affected Prevention: Develop an Effective IR Plan Include: Initial triggers Escalation paths Crisis Management Team IR Team Info. Security Help Desk Timing expectations Regulatory drivers & PRACTICE! Threat Level Impact Response Team Threat Type Response Time   Crisis Comms Crisis Corp. - Global Global IR Extortion 2 hours Patient Health Local IR Tech Major Incident Corp. – Regional Stolen IP 24 hours  Corp. Strategy Affected Local Incident Corp. - Local Lost, encrypted 48 hours  Loss of Bus. Data laptop

Prevention: Use your Plan to Move Efficiently Average Time to Contain = 59 to 82 days Source: IBM / Ponemon Institute, “2016 Cost of Data Breach Study: Global Analysis” (June 2016) “Real World” Investigation Timeline Rebuild Drives Preservation (4 – 14 days) Forensic Analysis (21 – 28 days) Malware Analysis (10 – 21 days) Scanning (21 – 28 days) Report (10 – 21 days) 1 10 20 30 40 50 60 (days)

Questions?