Law Firms See Insurance as Bulwark Against Data Breach

David Johnson had just finished meeting with a cyber security consultant about beefing up the company’s protections when he learned the servers had been hacked.

As general counsel of Global Cash Access, a company that manages cash on hand for casinos, Johnson was highly concerned about protecting the company servers: Literally, millions of dollars were at stake. Hiring a consultant to sniff out vulnerabilities had been the first step taken by the company’s new senior vice president of IT, and everyone at the meeting had agreed the consultant should take the next few months to see if he could penetrate their computer system.

But it didn’t even take that long: The consultant walked to his car outside their office, opened his laptop and immediately hacked into their servers.

“It was kind of like, ‘Oh. This isn’t good,” said Johnson, now a Duane Morris partner, who said the IT department made several major changes as a result. “Needless to say, a couple people lost their jobs.”

The incident, which took place in 2013, illustrates how difficult it can be to accurately assess the vulnerability of one’s system and why General Counsel consistently rank cybersecurity as a top concern in surveys. And yet even as lawyers position themselves as experts who can advise companies on cybersecurity threats, many law firms are being targeted and experiencing data breaches.

“Our law firm clients report being extorted or threatened with denial of service and being held hostage,” said Mark Greenwood, managing director with Aon Risk Solutions, which sells cyberinsurance to several dozen law firms.

Greenwood declined to disclose which firms had reported a breach, but said the minimum cost of hiring a consultant to identify the hole in a cybersecurity system and to then fix it is $500,000. He further estimated that the largest law firms are paying for $5 million to $40 million in coverage, mid-size firms are purchasing up to $10 million in coverage, and smaller firms are buying  up to $5 million in coverage. The insurance provides firms with a “coach” who can take the lead if a breach occurs, crisis communication and PR specialists, as well as online training and support from IT professionals, according to Greenwood.

In the last year alone, his group has signed up 30 new law firms for cyber insurance, he said.

But most data breach incidents at law firms have not publicly surfaced, although there have been a few incidents — at least one small law firm in Southern California was forced to send letters to clients after a breach and there have been reported incidents of other larger firms being targeted.

In May, the New York Times obtained and published an article about an internal report at Citigroup that suggested law firms are likely vulnerable targets for hackers, but that it was difficult to tell if data breaches are on the rise or not because there is no regulatory reporting requirement for the legal industry.

Judy Selby, co-leader of BakerHostetler’s Information Governance practice, said that it’s not unusual to hear law firms described as “soft targets.” This is partially because, unlike banks, they face no formal regulation, Selby said, even though they hold repositories of confidential information about impending merger plans, patent applications and litigation strategies that would be attractive to hackers.

“In some ways, it’s almost cultural,” said Selby, explaining that law firms do not think of themselves as vendors which would be targeted.

But she argued law firms are taking steps such as removing access to web-based email which has little protection and implementing new policies to maintain tighter control over mobile devices. “I think the security is markedly different now,” she said.

Although many law firm clients, such as Citigroup, have started implementing audits of law firms to ensure they are taking adequate steps to protect data, some leading lawyers have called for a formal policy. At the inaugural Big Law Business Summit last week, Sullivan & Cromwell’s senior chairperson H. Rodgin Cohen called for a new cabinet, the department of cybersecurity.

“I do not believe I am exaggerating when I say we are jeopardizing the future of this country unless we adopt and implement a comprehensive program to deal with cyber risk,” said Cohen, adding “it is the one truly existential threat.”

View the original content and more from this author here: http://ift.tt/1MOcb9O

from cyber security caucus http://ift.tt/1LJCe3w
via IFTTT

The Next Wave of Cybersecurity Professionals

Seemingly every day we read about another hack on corporate data and personal information. In an increasingly networked world, our data has never been more at risk and, quite frankly, we are ill-prepared for the threat. Experts estimate that there aremore than 300,000 cybersecurity jobs vacant in the U.S., 60,000 of which could be filled by individuals with proper training but not necessarily a four-year college degree.

The skills gap in cybersecurity points to an underlying and systemic issue in our country, namely that our broad access education systems struggle to produce talent at the speed and volume the market demands. That’s where Year Up comes in. Working with community colleges, Year Up invests in highly motivated and talented low-income young adults, Opportunity Youth, who receive six months of market-specific technical training and professional skills development followed by a six-month internship at one of our country’s leading companies.

Our young adults develop in-demand skills that directly reflect the job market, and our corporate partners gain access to a strong and diverse pipeline of talent. In a world with growing cyber threats, there has never been a better time to train Opportunity Youth to become the next generation of cybersecurity professionals.

Year Up is addressing the workforce gap in cybersecurity in partnership with theSymantec Cyber Career Connection initiative and LinkedIn. This past year, Year Up students from the Bay Area and Baltimore received industry-specific training and are now filling critical roles at companies like Symantec, eBay Inc., Juniper Networks, Gap Inc., UCSF, NCC Group, and Macys.com. Year Up was able to move so quickly in creating this pipeline of cybersecurity professionals because of Symantec’s leadership and the LinkedIn Economic Graph. Through the Economic Graph, we were able to quickly and precisely identify the required technical skills as well as the markets that had the greatest need for such cybersecurity skillsets. It is this kind of nimbleness that will be required for us, as a country, to close the skills gap and connect talent to jobs at scale.

On July 25th, the Year Up community will celebrate the next wave of technology professionals to enter the market. Apropos of our partnership, Jeff Weiner, CEO of LinkedIn, will deliver the keynote address at Year Up Bay Area’s graduation. Our students came to Year Up with the grit, determination and persistence to succeed; and now they will leave with the in-demand skills required to launch a career and keep cyber attacks at bay.

View the original content and more from this author here: http://ift.tt/1LJCXSg

from cyber security caucus http://ift.tt/1TYGUVU
via IFTTT

Fiat Chrysler to recall vehicles in the US over hacking fears

SAN FRANCISCO, July 25 ― Fiat Chrysler will recall 1.4 million vehicles in the United States to install software to prevent hackers from gaining remote control of the engine, steering and other systems in what federal officials said was the first such action of its kind.

The announcement yesterday by FCA US LLC, formerly Chrysler Group LLC, was made days after reports that cybersecurity researchers used a wireless connection to turn off a Jeep Cherokee’s engine as it drove, increasing concerns about the safety of Internet-enabled vehicles.

The researchers used Fiat Chrysler’s telematics system to break into a volunteer’s Cherokee being driven on the highway and issue commands to the engine, steering and brakes.

The National Highway Traffic Safety Administration (NHTSA) said on Friday it would investigate whether FCA’s solution to upgrade software was enough to protect consumers from hackers, although FCA said in its recall announcement that it was unaware of any injuries.

A spokesman for NHTSA said that it was the first recall of vehicles because of concerns about cybersecurity, and experts said they hoped it would send a shock through the auto industry and beyond it.

Risks of connectivity

The risks of increasing connectivity to physical devices extend far beyond cars and into hospitals and chemical plants and factories, they said.

“It’s a huge problem, and it’s an architectural problem with this Internet-of-Things concept,” said Nicholas Weaver, a security researcher at the nonprofit International Computer Science Institute in Berkeley, California.

He said that at present there is a divide in terms of design, in that cars and other products could be accessible from a variety of sources, such as smartphones, as with the Cherokee, or else can be designed to communicate only with a single authenticated server.

Products designed to be accessible by a range of means including smartphones leave a large “attack surface” that is easier to penetrate. But products that communicate only with a single authenticated server allow the company that owns the server to compile a raft of information about the user, increasing privacy concerns, Weaver said.

Ed Skoudis, an expert in securing connected devices, said the fact that the recall came so soon after publication of the FCA cybersecurity issue “is a shot across the bow of other IoT manufacturers that this could cost them a lot of money.”

Skoudis said he hoped companies would reconsider what they spend on security earlier in the design process in order to avoid similar recalls, lawsuits and the threat of increased regulation.

Computers on wheels

Automakers have until now sought to play down the threat that hackers could gain control of a vehicle using a wireless connection. While hackers had previously demonstrated the ability to tamper with onboard systems using a physical connection to the car’s diagnostic system, the researchers were able to control the Jeep Cherokee remotely.

US-traded shares of Fiat Chrysler closed 2.5 per cent lower at US$15.15 yesterday.

The NHTSA and members of Congress have expressed concern about the security of Internet-connected vehicle control systems.

Two Democratic Senators introduced a bill on Tuesday that would direct the NHTSA to develop standards for isolating critical software and detect hacking as it occurs.

“We have said that cars today are essentially computers on wheels, and the last thing drivers should have to worry about is some hacker along for the ride,” Fred Upton, the Republican chairman of the House Energy and Commerce Committee and the committee’s ranking Democrat, Frank Pallone Jr of New Jersey, said in a statement yesterday.

Some carmarkers, including BMW and Tesla Motors Inc, can update car software over the air, as Apple Inc does with its phones. But others do not, and the Senate bill would not require that.

The recalled vehicles include some of the top-selling FCA products including the Jeep Grand Cherokee and Cherokee SUVs from model years 2014 and 2015 and 2015 Dodge Challenger sports coupes, among others.

FCA said it would mail a memory stick to affected customers to upgrade vehicle software and add security. A spokeswoman for FCA said the USB sticks would be mailed to customers “as soon as possible.”

The company also said it had already deployed a fix with its telecommunications provider to block remote access of the kind the researchers used.

FCA declined to comment beyond the statement it issued on the recall. The company did not respond to queries on whether the USB devices to be mailed to customers are on hand or have to be manufactured.

An NHTSA official said the investigation would also look at “how quickly they (FCA) are able to complete the recall.”

In broad terms, “this is another example of a problem with an embedded system, some computer that is something that is not really a computer from a user perspective but is built to make something else work,” said Steven Bellovin, a professor of computer science at Columbia University. “I suspect we’re going to need some kind of regulatory frameworks.” ― Reuters

View the original content and more from this author here: http://ift.tt/1LJCYFJ

from cyber security caucus http://ift.tt/1TYGXkE
via IFTTT

SBA regional director says regional businesses should invest in cybersecurity research

During a stop in Fredericksburg Thursday, Natalia Olson–Urtecho—U.S. Small Business Administration Mid-Atlantic region administrator—said Fredericksburg is poised for significant growth in the cybersecurity industry and in unmanned systems.

She said managing big data is a huge concern for government and institutions like the University of Mary Washington.

“We have so much data and don’t know how to manage it,” Olson–Urtecho said. “There’s a lot of opportunity in how to make government more efficient.”

With people moving farther south and infrastructure for information technology businesses already in place, she said the region is ideally located for future growth in that sector.

And with Fredericksburg centrally located between Northern Virginia and Norfolk—two hot spots for innovation in unmanned systems—that industry is also poised to grow here.

“Fredericksburg is centrally located to connect those two hubs of acticity, there is huge potential there,” said Carl Knoblock, director of the Richmond district SBA office, who visited Fredericksburg with Olson–Urtecho on Thursday.

He said that small businesses need to consider how they are protecting data even if they’re not directly involved in cybersecurity.

“Set guidelines now and start to develop a plan,” he said. “Be proactive instead of worrying about losing contracts later.”

Olson–Urtecho also said the region should be using its university system as a tool for economic development.

She said the university’s Center for Economic Development can help. Small Business Innovation Research grants, as well as Small Business Technology Transfer grants, are a good place for businesses starting out in the cybersecurity or unmanned systems industries to begin looking for funding, she said. The grants, coordinated by the SBA, are intended to help small businesses conduct research and development.

Knoblock said colleges should hype student innovations online to attract investors to the region.

But he said Fredericksburg should also look to cities like Pittsburgh, where colleges have created help at the university level to grow student businesses, as well as the infrastructure to support them after students graduate.

Among those initiatives outside of the university sector is the “Startup in a Day” program, launched by the SBA this year. The program aims to make it easier for entrepreneurs to start a business by reducing the amount of time it takes to register and apply for permits and licenses on the local level.

The SBA provides grants to cities that make business permitting possible in one day.

“It makes business owners more comfortable and they feel like the local government is protecting them and helping them out,” she said. “Businesses stay longer in areas where they feel government is accessible.”

She said another new SBA program called LINC helps small businesses get off the ground. Businesses interested in a loan can complete a 20-question application that goes out to a group of banks. She said not only does it match businesses with the appropriate loan, the amount of interest from banks can help determine whether an idea is viable or not.

“We’re trying to get the word out,” she said. “Many people don’t know about the grants and programs we offer. When I got to this job, people kept telling me SBA is the best kept secret in government.”

View the original content and more from this author here: http://ift.tt/1TYGUoX

from cyber security caucus http://ift.tt/1LJCdwv
via IFTTT

Laprise: The lessons of Ashley Madison

The alarm bells are getting louder. #SonyHack, #HackingTeam, #OPMHack, and now #AshleyMadisonHack. In the space of a few months, four data breaches have punctured a media sphere that has become jaded to the idea of the loss of data. Why?

We were spellbound by the internal emails revealed by the #SonyHack, which has had lingering and far-reaching effects on Hollywood, including the souring of relations between it and Google.

The #HackingTeam event opened a window into the seedy world of international surveillance technology and cyberweaponry, underscoring how far governments around the world and in the United States are willing to go to spy on citizens.

The #OPMHack was about the vast stores of data retained by the federal government. To paraphrase: “Why hack governments? Because that’s where the data is.”

That brings us to the most recent #AshleyMadisonHack. It lacks the business effects of the #SonyHack, the privacy angle of #HackingTeam, and the scale of the #OPMHack. However it makes up for all of that in terms of sheer prurient interest.

As a website that explicitly facilitates illicit sexual liaisons, the data its hackers are threatening to disclose have crushed a company’s planned IPO and future, as well as putting fear into the hearts of cheating spouses and significant others across the country. The potential personal wreckage is profound.

This brings us back to the growing volume of those alarms. What do they tell us?

First, despite all of the rhetoric from organizations and government, the hacking problem is getting worse and organizations are not effectively mitigating the threat. The reports of the security measures in place in all four hacks reveal security was neglected. We are not talking about falling short of best practices or even good practices; we are talking about implementation of worst practices like plain storage of weak passwords, using default passwords and unencrypted data storage.

Despite the rhetoric of cybersecurity, organizations continue to prove they are not serious stewards of user data, even when it threatens their capacity to function as a going concern. Their seriousness will apparently rise only when penalties for breaches rise. If any of these organizations had acquired insurance to cover such a hack, the insurer would likely be able to avoid its liability because the insureds had failed to take even the most basic steps to protect data.

Second, there is the “#” factor. Hackers are not concealing their actions or — as in the #OPMHack — word gets out. In the private sector, many organizations fear the effect on public confidence and brand of such a disclosure. Public Relations 101 is to get out in front and make full disclosure early and often. Concealing the problem only exacerbates it. Legislation to mandate disclosure of breaches should advance in Congress.

Third, hackers are getting better not just at the tactics of hacking, but also the strategy. They are identifying better targets. Like any predator, they are interested in the weaker and more vulnerable members of the herd. Unfortunately for users, most of the herd is lame.

Going one step further, increasingly we see the effects of hacking not in terms of specific stolen data records, but the destruction of relationships between people and organizations built with trust. This trust is not easily restored and once lost, can be hard to regain.

This is especially important in the #SonyHack, #HackingTeam and #AshleyMadisonHack. Unlike the #OPMHack, these hacks were especially damaging because they revealed private and even secret information shared by actors other than the data holder.

The #SonyHack rekindled Google’s war with the MPAA. The #HackingTeam revealed the deception practiced by states on their citizens; and the #AshleyMadisonHack, of course, threatens to disrupt marriages. In each of these cases, the hacked organization lacked a direct stake in the collateral damage wrought by the disclosure. The stakes were simply not high enough for them to take the threat sufficiently seriously.

They ignored the alarm bells because they didn’t see their house burning. It remains to be seen how long it will take for them to feel the heat.

John Laprise began studying global Internet policy and governance with his work on cyber warfare doctrine in 1993. He wrote this for InsideSources.com.

View the original content and more from this author here: http://ift.tt/1TYGUoQ

from cyber security caucus http://ift.tt/1LJCfo7
via IFTTT

Senators want to shore up automotive cybersecurity

Rushing to roll out the next big thing, automakers have left cars unlocked to hackers and data-trackers, ” adds Mr. Blumenthal. Other vehicles with Internet-connected computers may also be at risk. “This common-sense legislation protects the public against cyber criminals who exploit exciting advances in technology like self-driving and wireless connected cars”. “We must reassure drivers their vehicles are secure from thieves and anyone else”.

Wired.com released a video where a pair of hackers took over controls from a driver in Jeep Grand Cherokee as they did everything from operating the windshield wipers to disabling the brakes.

“NHTSA, in consultation with FTC, should establish a “cyber dashboard” that displays an evaluation of how well each automobile protects both the security and privacy of vehicle owners beyond those minimum standards”.

To date, there have been few examples of cyber attacks on cars, but security researchers have demonstrated that it’s possible to take over the critical control systems of a auto while it is in motion. Sitting in his home in Pittsburgh, Valasek manipulated the controls of Miller’s Jeep as it traveled along a highway near St. Louis. At The News Wheel we’ll keep our eyes peeled and give you more details as they emerge. That report concluded only two manufacturers out of 16 surveyed had the capability to respond to a real-time infiltration.

The FCC is taking over broadband data privacy enforcement from the FTC per its new Title II-based net-neutrality rules, but a spokesperson for Markey’s office said they were confident the FTC would have jurisdiction over the consumer-facing software and hardware the bill targets.

“We need clear rules of the road that protect cars from hackers and American families from data trackers”, stated Sen.

The Senators’ hope is of course that the bill becomes a law and guides the National Highway Traffic Safety Administration and the Federal Trade Commission to issue IT security and privacy standards for vehicle electronics, including infotainment systems and other Internet-connected dashboard networks that could leave vehicles vulnerable to a hackers’ attack.

The legislation would require the NHTSA to set standards to ensure all wireless access points of a vehicle are protected, that critical systems are isolated, that the vehicle has technology to detect and stop a hack in real time, and that all information collected is secured.

View the original content and more from this author here: http://ift.tt/1RWL96P

from cyber security caucus http://ift.tt/1JC9m8J
via IFTTT

John Delaney: Time to reboot our approach to cybersecurity

Earlier this month, the Office of Personnel Management (OPM) announced one of the largest known breaches of government databases in U.S. history — a breach that compromised the personal data of 21.5 million people. That’s a staggering number, and the recent breach was one more in a growing class of sophisticated cyberattacks in the public and private sectors. Last Thursday, I held an Identity Theft and Fraud Prevention Forum to discuss how we can strengthen identity theft prevention and recovery services for victims. If we’re going to meet the challenge of cybersecurity in the 21st century, we have to act now.

At the forum, I got the chance to meet some of the families and workers who had their Social Security numbers and other personal information stolen through the data breach at OPM. Many victims of the recent hack were either federal workers or contractors who applied for a security clearance through OPM. From the federal employees working to serve and assist our veterans to the men and women guarding our airports and borders, our federal government has an obligation to protect the federal workforce, and the recent OPM data breach was a breach of trust.

The theft of a Social Security number can’t be undone, and the threat of identity fraud is going to follow victims of the OPM data breach for life. In my mind, so should fraud-protection services. Last week, I joined Congresswoman Eleanor Holmes Norton as an original co-sponsor of the RECOVER Act, a bill to provide victims of the OPM hack with free lifetime identity theft protection coverage. The coverage currently offered by OPM guarantees only three years of protection, after which victims of identity theft could still be subject to identity fraud. Our federal employees deserve better than that, and I was proud to support legislation to help secure the future of data breach victims so they can focus on serving our country.

Washington County is home to more than 2,500 federal employees and nearly 2,000 retired federal workers. When their personal information is exposed, these men and women and their families are put at risk of attack. The federal workers I’ve met in Washington County deserve better than that, and I’ve made their security a top priority.

At my Identity Theft and Fraud Prevention Forum last week, more than 275 attendees got a chance to talk one-on-one with representatives from OPM, the Federal Trade Commission (FTC), the Maryland State Police and other experts about steps they can take in case of identity fraud. Attorney General Brian Frosh, who has championed enforcement of data security laws, also joined the event in Germantown, Md., and shared his ideas on consumer protection.

In the wake of the OPM data breach, I believe it’s important that our government provide victims with a clear way forward and the information they need about personal and financial risks. In the coming months, I plan to host another Identity Theft Protection Workshop, this time in Washington County, to help keep all my constituents up to date with the latest on identity theft and fraud. Our government should be in the position of strengthening the security of Americans online, not exposing their personal information to attack.

If you were a victim of the recent data breaches at OPM, I encourage you to call a special help line set up by OPM at 1-844-777-2743 or visit http://ift.tt/1JC9lSn for more information on what you can do to recover.

In addition to protecting those who’ve been affected by the data breach at OPM, it’s important that our government takes action to invest in cybersecurity and to hold hackers accountable in order to deter future attacks. Whether they’re state-sponsored actors or a rogue organization, these criminals should know that the United States will find those responsible and bring them to justice. We have a responsibility to our federal workers, to our taxpayers and to those affected by the recent OPM data breaches to ensure this doesn’t happen again.

In order to strengthen our cybersecurity, we’re also going to need to make sure that federal agencies are hiring the right people for the job. The data stored at OPM presents a major security risk for the United States, and protecting that data is a responsibility too important to put in the hands of politically appointed managers without a relevant background. As a former CEO, I know that there’s a level of technical sophistication that’s needed in management in the modern world. As we continue to build a strategy for strengthening our country’s cybersecurity, bringing cutting-edge experience into government will be a central challenge.

As the investigation into the OPM data breach moves forward, I will continue to make the personal and financial security of victims a top priority. While there’s still a lot we don’t know, we can be sure of at least one thing: If we want to strengthen our national security and the security of our families, the time to act on cybersecurity is now.

View the original content and more from this author here: http://ift.tt/1RWL96O

from cyber security caucus http://ift.tt/1JC9m8F
via IFTTT