Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2019
10:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

How Network Logging Mitigates Legal Risk

Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.

One of the first questions I ask in my role as an attorney responding to a cybersecurity incident is typically: Do you have any logs?

All too often, the answer is no.

The sad truth is that even a simple ransomware event becomes legally complicated without logging mechanisms. Why? Because a cybersecurity attorney's job is to navigate the statutory framework applicable to a cyber event. That includes determining whether the client needs to give notice under any applicable law to a client's customers, employees, patients, or other affected individuals.

The legal implications of notice can be intense. A standard breach notice contains a brief summary of the incident along with specific language from the relevant breach notification statute. But beyond the piece of paper, the breach notice can give rise to affected individuals bringing lawsuits or making demands related to the cyber event. Notice to customers or other affected persons can also then require notice to regulators. Notice is often the last thing a company will want to do unless it is absolutely forced to do so under the law.

For most businesses, there is no uniform breach notification protocol that must be followed. Instead, it is left to me, the lawyer, to piece together the myriad applicable statutes potentially at play and to determine whether notice is required under those statutes.

Here are three important examples to consider in a breach context:

HIPAA (Health Insurance Portability and Accountability Act), governing protected health information, requires that a healthcare provider (or business associate) presume that an impermissible use or disclosure has occurred unless the entity can demonstrate that there is a low probability that the protected health information has been compromised based on a factor-by-factor analysis.

Virginia's breach notification statute defines a breach as "the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth."

New York's data breach notification statute was recently amended to apply beyond the notification of the unauthorized acquisition of computerized data to both unauthorized access to or acquisition of such data.

What do these arcane legal regulations mean in the context of network logs? It means that if an organization is victimized by a ransomware attack, for example, a lawyer can use the logs to show that personal or protected information did not leave the client's systems.

On the other hand, the lack of network logs would lead me to recommend that the company undertake complicated forensic steps — at significant cost — including the procurement of forensic images and assessments of those images as circumstantial evidence that information did not leave the safety of a client's network. Not only that, but network logs insulate a client from a regulator's watchful eye after an event. Having the logs to show a regulator that personal identifying information did not leave the client's systems is proof that may assist in shutting a regulatory inquiry down.

While notice to consumers or affected individuals can be necessary and unavoidable in certain cyber scenarios, it is never a decision that I as an attorney make lightly. As mentioned above, notice alerts a consumer to a potential negligence claim against a company for failure to provide adequate security protections. Notice can lead to lawsuits and lawsuits can lead to liability. Notice is, in short, the legal nuclear option.

Ensuring that logging is turned on, captured, and preserved immediately after a cyber event is critical to mitigating legal risk. Having proof that information did not get into the hands of a cybercriminal after a simple cyber event will avoid significant expense and exposure. So, turn the logs on. Your lawyer will thank you.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Beginner's Guide to Microsegmentation."

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity & data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Rookiewilliams99@gmail.com
50%
50%
[email protected],
User Rank: Apprentice
10/8/2019 | 4:50:35 PM
Network logging
I am sure that logging does mitigate the legal risk, but is there any information on which logs are adequate for that task? 

I collect and keep a lot of logs from servers, Internet access, logins/logouts, etc. but trying to prove that a bad actor didn't copy and encrypted file outbound using HTTPS would be a tall task indeed.

 
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17593
PUBLISHED: 2019-10-14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
CVE-2019-17594
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-17595
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-14823
PUBLISHED: 2019-10-14
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to...
CVE-2019-17592
PUBLISHED: 2019-10-14
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.