1. TOP 5 CYBERSECURITY ISSUES CFOS NEED TO KNOW IN A CONNECTED, MOBILE WORLD BRAD FRAZER bfrazer@hawleytroxell.com | 208.388.4875 @bfrazjd PRESENTED ON 06/08/16 TO: Treasure Valley CFO Forum

2. BRAD’S TOP FIVE… 1.Data Breach, Privacy and Your Reporting Obligations (Your Cybersecurity Response Plan) 2.Inoculating the Enterprise Against Social Engineering Hacks (phishing, new gTLDs) 3.Legal Issues with Moving to the Cloud and Engaging with a Cloud Vendor 4.Cyberliability Insurance 5.Cybersecurity Implications of the Move to Mobile

3. TODAY’S PREMISE? YOU’VE BEEN HACKED. Now what? The typical stages: –Denial –Dawning awareness –Anxiety –Panic –Desperation

4. TODAY’S PREMISE? WHY IS THIS NOT JUST AN IT OR LEGAL PROBLEM? CONSIDER: 1. What is being stolen? –Financial data –Insider information –Trade secrets –Intellectual property 2. Financial harm to the enterprise

5. TODAY’S PREMISE? EXAMPLES: Actual hack (tools and brute force) Website defacement Social engineering hack (or, open port) Ransomware Compromised sites Spear phishing

6. DATA BREACH, PRIVACY AND YOUR REPORTING OBLIGATIONS Your cybersecurity response plan assumes you are going to be hacked. NOW WHAT? It is incorrect to assume that because your data is in the cloud it is the cloud vendor’s problem. It remains your problem unless you’ve contracted it away, and you haven’t.

7. IMMEDIATE LEGAL IMPLICATIONS If you get hacked, you could be sued civilly for breach of contract (NDA, privacy policy, warranty) or statutory cause of action. If you get hacked, you could receive an enforcement action from a state AG. If you get hacked, statutory remedies under e.g., HIPAA, GLB or Massachusetts’ law might be imposed.

8. SUGGESTED RESPONSE PLAN 1.Close the security hole or shut down the site to stop the accrual of new losses. 2.Keep and preserve all server logs before and after the hack. 3.Report the hack to your web hosting company and review your contract with it to see what warranties were made regarding data security.

9. SUGGESTED RESPONSE PLAN (CONT’D) 4.Be aware of regulatory environment i.Privacy (HIPAA, GLB) ii.Security 5.Be IMMEDIATELY cognizant of your data breach reporting obligations. 6.Contact local police and the FBI to report the hack.

10. SUGGESTED RESPONSE PLAN (CONT’D) 7.Be prepared to report the event to your insurance company under your cyberliability coverage. 8.Be prepared to offer remediation to affected customers. 9.Review your data security practices and identify any potential security gaps. 10.Call your lawyer.

11. INOCULATING THE ENTERPRISE AGAINST SOCIAL ENGINEERING HACKS Top-down mandate at enterprise level HR, Legal and IT must be in harmony Training is critical Penalties for non-compliance must be enforced Example: Recent rise in CEO spear phishing attacks: discuss

14. LEGAL ISSUES WITH MOVING TO THE CLOUD AND ENGAGING WITH A CLOUD VENDOR Termination rights Privacy –What happens when there is a hack? –Sharing (physical or virtual) Security –Physical and network security? –What happens when there is a hack?

15. Data Ownership and Storage (“Big Data”) –Who owns the data? What Regulatory Laws Apply and How Will They be Met? (e.g., HIPAA, GLB, COPPA) How Will Migrating Data be Handled? Warranty (SLA) LEGAL ISSUES WITH MOVING TO THE CLOUD AND ENGAGING WITH A CLOUD VENDOR

16. Cannot give what you do not have— policies and warranties Indemnification –What happens if you get sued? Limitation of Liability Venue and Choice of Law Data Breach Reporting—whose job? LEGAL ISSUES WITH MOVING TO THE CLOUD AND ENGAGING WITH A CLOUD VENDOR

17. CYBERLIABILITY INSURANCE Hard to find Typically expensive Should cover: –Data Breach Reporting Obligations –Online advertising injury –Intellectual property infringement allegations –Related privacy lawsuits against you –Theft of IP

18. CYBERSECURITY IMPLICATIONS OF THE MOVE TO MOBILE See next two slides

19. CYBERSECURITY IMPLICATIONS OF THE MOVE TO MOBILE

21. Increased opportunities for mischief Contract modifications IP infringements Defamation Just numerically, more access points into the enterprise E.g., foreign travel example from FBI

22. PROACTIVE SUGGESTIONS AND KEY TAKE-AWAYS 1.Make sure you own your data—ALL your data. 2.You should be actively monitoring for hacks and not relying on cloud vendor. 3.Negotiate the best contract you can. 4.Get good insurance. 5.DBRO—Data Breach Reporting Obligations 6.Implement employee policies and training. 7.Encrypt your data. 8.Response plan in place.

23. THANK YOU! BRAD FRAZER bfrazer@hawleytroxell.com | 208.388.4875 @bfrazjd