1. Cybersecurity – Three Perspectives
by Nicholas A. Klinefeldt, Faegre Baker Daniels
Paul H. Luehr, Faegre Baker Daniels
Nicholas Gerhart, FBL Financial Group, Inc.
Drake University Law School and ACC, Iowa Chapter 5th Annual Corporate Counsel Forum, Des Moines, IA

2. Threat Landscape: Data Breach Costs
U.S. average cost of a data breach
($4 M globally)
$6.5 M
29%
Increase since 2013, in global cost of a breach
U.S. average cost for each exposed record ($158 globally)
$221
Source: 2016 Cost of Data Breach Study: Global Analysis, Sponsored by IBM, Conducted by Ponemon Institute LLC (June 2016)

3. Threat Landscape: Data Breach Costs
66%
34%
Indirect Costs:
Staff hours
Lost Goodwill
Customer “Churn”
Direct Costs:
Outside Counsel
Outside Experts
ID Theft Insurance
Notification Costs
Source: 2016 Cost of Data Breach Study: Global Analysis, Sponsored by IBM, Conducted by Ponemon Institute LLC (June 2016)

4. Global Data Breach Cost – Per Capita, by Industry
Threat Landscape: Data Breach Costs
Global Data Breach Cost – Per Capita, by Industry
Source: Ponemon Institute, “2016 Cost of Data Breach Study: Global Analysis,” Sponsored by IBM (June 2016)

5. Threat Landscape: Threat Actors and their Motives
Charge for Fraudulent Treatment
Obtain Free Treatment or Purchase Prescription Drugs
Wage or Tax Fraud
Monetize Personal Data
Steal Intellectual Property
Expose Sensitive Data
Destroy or Corrupt Data
Disrupt Services
Extortion
FINANCIALLY MOTIVATED HACKERS
HACKTIVISTS/TERRORISTS
SECURITY RESEARCHERS
NATION STATES
INSIDERS

6. Threats - Extortion
Ransomware

7. Ransomware Threats - Extortion
Spam (up 4x) with ransomware = 40% to 66%,
Demand = $200 to $10,000+ (often in Bitcoin)
Largest cost = downtime
Sources: IBM, Malwarebytes, Datto

8. Threats - Extortion WannaCry – one of the largest attacks in history
Over 230,000 infections
Over 150 countries
Vulnerable
Unpatched Windows OS
Old, pirated OS
Victims
UK NHS
Telefonica
FedEx

9. Threats – Fraud

10. “Business Email Compromise” (BEC)
Threats - Fraud
“Business Compromise” (BEC)
Losses
$3 billion in losses by Feb. 2017
Up 1300% since Jan. 2015
Victims in 50 states and 100 countries
Average = $25,000 to $90,000
Ubiquiti Networks: $46.7 million in fraud transfers

11. Threats: Attacks on the Internet of Things
IoT DDoS
Dyn DOS Example
Traffic spike = 40-50x above normal
Victims = Dyn, Amazon, Netflix, Twitter, et al
Source = Internet of Things (IoT)
DVR
Video cameras
Sources: Dyn, Krebs on Security

12. Incident Response Team
Prevention: Develop an Effective IR Team
Deploy an Effective IR Team
Multiple representatives
Led by counsel
With contact sheet for:
Outside counsel
Forensic experts
Crisis communicators
Notification firms
Insurance agent/broker
Law enforcement
In-House Counsel
Outside Counsel
Client & Media Relations
In-House IT
Incident Response Team
Human Resources
CPO, CSO Compliance
Outside Forensics Experts
Business Unit

13. Prevention: Insurance as part of your IR Team
Insurance - Types
Probably not E&O anymore
Cyber
Coverage
Cost of investigation (using pre-approved attorneys & experts?)
Cost of repairs
Lost business?
Timing
Notify broker/agent upon suspecting a breach
Notify before paying ransom

14. Prevention: Law Enforcement as part of your IR Team

15. Prevention: Law Enforcement as part of your IR Team
Mandatory Reporting
Personally Identifiable Information, Medical Records
Financial Institutions (SAR), Investors (SEC), etc.
Goals
Solve crime, assist victims, seek justice
NOT “take over” a victim’s business
Typical Requests
Raw intrusion data – hard drives, logs
NOT your internal memos or reports
Typical Benefits
Intel back on a particular type of perpetrator
PR value of letting public know that you’ve contacted the authorities

16. Prevention: Re-Design Corporate Governance
Board
Executive Management
Bus Ops IT
Network Architecture
InfoSec
Marketing
Legal
Finance
Insurance/Risk
Risk Committee
Insurance
Litigation
Board
Executive Management
Bus Ops IT
Network Architecture
InfoSec
Marketing
Legal
Privacy
Finance
Insurance/Risk
Privacy & Security

17. Corp. Strategy Affected
Prevention: Develop an Effective IR Plan
Include:
Initial triggers
Escalation paths
Crisis Management Team
IR Team
Info. Security
Help Desk
Timing expectations
Regulatory drivers
& PRACTICE!
Threat Level
Impact
Response Team
Threat Type
Response Time
Crisis Comms
Crisis
Corp. - Global
Global IR
Extortion
2 hours
Patient Health
Local IR Tech
Major Incident
Corp. – Regional
Stolen IP
24 hours
 Corp. Strategy Affected
Local Incident
Corp. - Local
Lost, encrypted
48 hours
 Loss of Bus. Data
laptop

18. Prevention: Use your Plan to Move Efficiently
Average Time to Contain = 59 to 82 days
Source: IBM / Ponemon Institute, “2016 Cost of Data Breach Study: Global Analysis” (June 2016)
“Real World” Investigation Timeline
Rebuild Drives
Preservation (4 – 14 days)
Forensic Analysis (21 – 28 days)
Malware Analysis (10 – 21 days)
Scanning (21 – 28 days)
Report (10 – 21 days) 1 10 20 30 40 50
60 (days)

19. Questions?