#SonyHack: Will Executives’ Embarrassing Emails Better Motivate Cybersecurity Change?

Sitting in the Miami airport at 5:00 am I am reading news updates on the #SonyHack and a thought just occurred to me:

Previously, many of us preaching the “you better take your company’s security seriously” message to the C-Suites have been wondering if it would take a court decision finding C-Levels or Board members personally liable before they would fully appreciate the significance of cybersecurity risk to their companies.

In reading the articles about how the Sony Hackers are releasing Sony Executives’ entire email folders and all of the personally and professionally embarrassing email conversations they have exchanged, it makes me wonder if this will not do more damage to their professional reputations and careers than anything. And, if it does, does that mean that this may ultimately exert as much or more pressure on them (and other executives who are watching) to put more emphasis on cybersecurity in their companies when the risk to company message has not been working?

If there is one thing we know about human nature, it is that self-interest always prevails … will it here as well?

#SonyHack shows there are no “safe secrets” in the corporate world – what do you do?

Dishonest Man's WisdomThe #sonyhack will change the way the corporate world operates in many ways that we cannot even yet imagine. Yes, there are obvious data security implications that I usually drone on about, but there is another change that we may see come about.

The now outdated idea that internal corporate secrets will remain corporate secrets. You know, things like email conversations among colleagues containing snide and catty remarks, etc. Not to mention the real corporate secrets — trade secrets and other competitive information.

What does this mean for the way the corporate world does business?

Who knows how far the ramifications will be felt. I doubt it will lead to a rebirth of that outdated thing called the “Golden Rule” when it comes to talking about others, but it just may push folks back into the direction of that other outdated notion of not “putting it in writing” if you do not need to.

Earlier in my legal career I found myself in the unenviable position of having a client’s interests in a lawsuit be aligned with a rather unsavory character. Nah, who am I kidding, the guy was a crook — I mean the stereotypical “snake oil salesman” type.

Once, I asked him if he had any written proof of a conversation that he was telling me about. He laughed, paused, and shared with me some of his dishonest man’s wisdom that I will never forget:

  • Don’t say anything if a nod will do
  • Don’t say something over the telephone if you can say it in person
  • Don’t put something in writing if you can just say it

And, while email wasn’t very prevalent back then, I suspect there would be one more rule if we were having that conversation today:

  • Don’t put it in an email if you can write it on a napkin!

Maybe this dishonest man’s wisdom is not only for the dishonest …

 

The Best Evidence Why Your Company Needs a CISO Before a Data Breach

“The proof is in the pudding,” goes the old saying.

When it comes to organizational changes companies make following a data breach, If the proof is in the pudding, then the verdict is clear: companies should hire a Chief Information Security Officer (CISO) before they have a data breach.

Why?

According to this article in USA Today, companies usually tend hire CISOs after they have had a data breach. After?

Yes. They do this because they do not want to have another data breach and, after feeling the sting from the first, they are finally willing to invest more resources so that they do not have another data breach.

There is another old saying to remember: “Wise men learn from their mistakes, but wiser men learn from the mistakes of others.” (author unknown)

As your company’s leader, which will you be?

Check out my first post on Norse’s DarkMatters > Sony Hack: Where Do We Die First?

Hey everybody, go check out my first post on Norse’s DarkMatters blog — yeah, you know, Norse with the awesome Live Cyber Attack Map!

Now that you’re mesmerized by the map, here’s the post and please share it! Sony Hack: Where Do We Die First?

Platform Magazine Quotes Tuma Discussing CyberGard: The Public Relations Side of a Data Breach

CyberGard - Cyber Risk Protection ProgramThank you to Platform Magazine for quoting me discussing the PR component of my CyberGard – Business Cyber Risk Protection Program in this forward thinking article about the value of getting public relations on board before your company has a data breach.

In a recent post I explained why a data breach response must focus on the business side of the breach: “The most important issue is how the incident will impact the company’s overall business. No matter how great of a job we do on the legal side, if the business side suffers too much, it is an overall failure. These situations are not the time for tunnel vision.”

Click here to learn more about CyberGard

A key component to focusing on the business impact is the businesses’ communications with the public. This where having professionals to help with the “messaging” becomes so important. Read more in The Public Relations Side of a Data Breach | Platform Magazine.

 

The Art of Data Security: How Sun Tzu Masterminded the Home Depot Data Breach

The Art of Data SecuritySun Tzu taught that, when it comes to the art of data security, you must be wary of your business associates and other third parties.

Why?

Have you heard that Home Depot had a data breach? That hackers were able to exfiltrate 56 million payment cards and 53 million customer email addresses from its systems? Did you hear what may be the biggest news of all, the news that was announced earlier today (11/6/14)?

Do you know what that news has in common with the other “big breach event” from roughly a year ago?

Have you heard of the national retailer that what was hit with a perfectly timed cyber attack on Black Friday ’13 that resulted in credit card data from roughly 110 million customers being taken? That company has now spent over $61,000,000 as a result of the data breach and will spend much more. It is facing new lawsuits weekly, its net earnings are down, earnings per share are down, and its sales are down. The company is Target. Target, however, was not attacked directly.

Do you know how both Home Depot’s and Target’s computer system were attacked?

In both cases, cyber criminals obtained access credentials from third-party vendors to the “big boys” which credentials were used to get inside of their network environment, past the firewalls and much of the security perimeter. Once on the inside, they then used custom-built malware to execute the heist of the valuable data they were seeking all along.

Home Depot also said today that the criminals used a third-party vendor’s user name and password to reach the perimeter of its network, then gained additional rights to navigate the company’s systems. (Bloomberg)

What did Sun Tzu teach us about this technique?

In all fighting the direct method may be used for joining battle, but indirect methods will be needed to secure victory.

You can be sure of succeeding in your attacks if you attack places which are not defended.

The spot where we intend to fight must not be made known; for then the enemy will have to prepare against a possible attack at several different points; and his forces being thus distributed in many directions, the numbers we shall have to face at any given point will be proportionately few.

Most businesses focus their energy on securing their own networks but focus very little on examining the networks of their business associates and other third parties that they allow to access their networks.

Around 500 B.C. Sun Tzu taught that if an enemy — a cyber criminal — wants to attack your company’s computer network, they would be wise to do so by attacking indirectly, such as through your company’s business associates and other third-parties who have access to your network. Cyber criminals may be a lot of things, but they are not dumb … the successful ones, anyway.

Target learned.

Home Depot learned.

Will your company?

Stay wary friends.

 

Podcast: #DtR Episode on Lines in the Sand on “Security Research”

You really need to hear this podcast where we draw lines in the sand staking out what is — and what is not — security research

The #DtR Gang [Rafal Los (@Wh1t3Rabbit), James Jardine (@JardineSoftware), and Michael Santarcangelo (@Catalyst)] invited me to tag along for another episode of the Down the Security Rabbit Hole podcast.

Also joining us for this episode were Chris John Riley (@ChrisJohnRiley) and Kevin Johnson (@SecureIdeasllc).

You can click here to see a list of the topics we covered in this episode or just jump straight into the podcast.

Let us know what you think by tagging your comments with #DtR on Twitter!