This is a very significant and important read for CSOs and CISOs, relating to the court case bought against Ubers former head of security.

← Back to Blog

This is a very significant and important read for CSOs and CISOs, relating to the court case bought against Ubers former head of security. On the 5th October a federal jury convicted Ubers former CSO of obstruction of proceedings of the Federal Trade Commission (FTC”) and failing to report the knowledge of a felony to the appropriate authorities (misprision of felon). That carry a maximum of 5 and 3 years in prison.

This case is unique to Uber in as much as the circumstances of an ongoing FTC investigation, reports made to the FTC on Ubers cybersecurity practices and the responses made following the November 2016 hack. But:
‘The evidence demonstrated that, shortly after learning the extent of the 2016 breach and rather than reporting it to the FTC, any other authorities, or Ubers users, Sullivan executed a scheme to prevent any knowledge of the breach from reaching the FTC’

The case highlights what the court believes was the role of the CSO, how the CSO managed the event and their role in communicating the incident to authorities and Ubers Users. For me this highlights several issues for the CSO and CISO community, to consider.

1. It was incumbent on the CISO to report the incident to the authorities.
2. The Judgement does not highlight the role of Ubers management in the incident.
3. In the event of an incident communications maybe admissible to court, unless privileged.
4. The role of the board in cyber security risk management, reporting of cybersecurity compliance to the board and the ability of the CISO to do their job.
5. The severity by which the role of the security professional is being judged.
6. In this case the charges are criminal and will likely bring further civil actions.

Ted Dziekanowski one suspects with the increase in proposed cyber regulation, cyber attacks and incidents these types of cases will only increase. The role of the CISO is now being viewed under a verry critical legal and regulatory compliance lens.

#cyberlaw #cyberlegal #cyberregulation #cybersecurity #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6983675246830592001