Ransomware gang grasses up uncooperative victim to US regulator

By Alex Scroxton for ComputerWeekly
Thursday, November 16, 2023

• 1k
• 1
• More

Designed to foster transparency and accountability over cyber attacks, the rule has divided the security community because while many support the idea in principle, the concept of what constitutes a “material” breach is rather vague. Others believe it may hand an advantage to attackers.

Ilia Kolochenko, chief architect at ImmuniWeb and adjunct professor of cyber security and cyber law at Capitol Technology University in Maryland, commented: “Misuse of the new SEC rules to make additional pressure on publicly traded companies was foreseeable. Moreover, ransomware actors will likely start filing complaints with other US and EU regulatory agencies when the victims fail to disclose a breach within the timeframe provided by law.

In emailed comments, Kolochenko told Computer Weekly: “Having said that, not all security incidents are data breaches, and not all data breaches are reportable data breaches. Therefore, regulatory agencies and authorities should carefully scrutinise such reports and probably even establish a new rule to ignore reports uncorroborated with trustworthy evidence, otherwise, exaggerated or even completely false complaints will flood their systems with noise and paralyse their work.

He added: “Victims of data breaches should urgently consider revising their digital forensics and incident response (DFIR) strategies by inviting corporate jurists and external law firms specialised in cyber security to participate in the creation, testing, management and continuous improvement of their DFIR plan.

“Many large organisations still have only technical people managing the entire process, eventually triggering such undesirable events as criminal prosecution of CISOs and a broad spectrum of legal ramifications for the entire organisation. Transparent, well-thought-out and timely response to a data breach can save millions.” Read Full Article