Call us now:
A great article focusing on the challenges that the Uber CISO currently faces in court following its 2016 hack, and the companies approach to resolving the problem. It’s not the first time a CISO has found themselves in court, but what makes this case different is the charges bought against the company and CISO. Highlighting the efforts the company made to fix the problem.
While Uber has entered into a non-prosecution agreement, prosecutors contend that the head of security should have informed the Federal trade Commission (FTC) who were already investigating the company. Pursuing the head of security in court.
The Uber case, the intense focus on cyber security by regulators and general lack of attention organisations have placed on cyber is building up a suite of challenges that are creating issues much broader than just D&O insurance. D&O insurance is not a ‘back stop’ of risk mitigation or protection for CISOs. If you break the law you’re likely not covered, or will have to fight for coverage and cyber regulation is being developed.
The past 12 months has seen the DoJ and DoT make clear their intentions towards cyber, including clear advice on paying ransomware. U.S and EU regulators are doubling down on regulator programs and enforcement regimes up to the board room.
Ted Dziekanowski we have said that the role of the CISO is going to get significantly harder before it gets better. With a backdrop of increased cyber attacks, a lack of resources, poor corporate governance and leadership. With the SolarWinds case on the horizon I fear more court cases will follow.
CISOs need a close working relationship with General Counsel and the board, to develop their risk management, governance, cybersecurity, oversight and reporting programs to demonstrate the reasonable actions they have taken to manage cyber risk.
#cybersecurity #cyberriskmanagement #ciso #theaugustagroup #cyberlegal #regulation #governance #risk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6980051165430358016