Call us now:
Bring the popcorn. As SolarWinds responds to the SECs latest charges relating to the cyber attack reported in late 2020. Citing some great caselaw in their defense.
One wonders if and how one can defend against attacks that are deemed ‘extraordinarily sophisticated’? But if one recognizes that these types of events exist you have a duty of care to your shareholders to demonstrate that you are taking all reasonable steps to manage the risk, right? Unfortunately today the knowledge gap between nation states and technology companies to launch and mitigate cyber attacks appears to be getting wider.
One is interested when one reads that the SEC is not a cybersecurity regulator (they do have to comply with FISMA, they do understand cybersecurity), and there is no basis for them bringing a cybersecurity related case against a market participant. By the same argument, would it be true for Health and Human Services(HHS) and the Office of Civil Rights(OCR). That they should not evaluate the cybersecurity compliance of United Health under HIPAA? As they are a healthcare regulator. Is there a difference, if so what is it?
When one considers the charges and responses by both the SEC and SolarWinds it is clear that both sides are entrenched, the responses by SolarWinds and the SEC are obviously polarized. One fails to see how these differences can be resolved other than through the legal process.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Rich Waite, M.Ed. George Sawyer Bob Dix Ryan Buckner Adam Perella Gerry Kennedy
Veritas GRC U.S. Securities and Exchange Commission U.S. Department of Health and Human Services (HHS)
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7178300076216229888