Campbell from IT called the presenter on a Saturday to report that key servers at their organization, including the email and file servers, were inaccessible. A cryptic note was left demanding payment to regain access, indicating a potential ransomware attack. The presenter is advised to have Campbell contain the incident by disconnecting from the internet, not make any payments, and call in expert help from lawyers and incident response specialists to properly investigate and mitigate the risks. The presentation then outlines the typical incident response process and provides tips on internal communication, notifying affected individuals, and having an incident response plan in place ahead of time.

1. Presented By
When it happens,
will you be ready?
How to excel in
handling your next
cyber incident
Dan Michaluk
March 2, 2020

2. Not just any Saturday
2
You just had sat down with a real page turner when you got the call. Campbell
from IT went into the office after receiving a couple calls from staff who were not
able to access e-mail or files from the file share.
Campbell says that the e-mail server, file server and a number of other key
servers are inaccessible. All he can see is a text file that contains a cryptic note
about e-mailing a protonmail address to get access to the data.
Campbell asks you what to do.

3. Not just any Saturday
3
What do you do:
A. Tell Campbell to send an e-mail to the address and ask what needs to be
done to restore access.
B. Tell Campbell to do what he can to contain the incident, call the privacy
commissioner to report a cyber attack and take their advice.
C. Tell Campbell to do what he can to contain the incident and call the Board
chair to give them a heads up that there’s been an attack.
D. Tell Campbell to do what he can to contain the incident and call your insurer
for a referral to expert help.

4. Agenda
o Events, incidents “and breaches”
o The incident response process
o Incident response tips
o The incident response plan
How to excel in handling your next cyber incident
4

5. Events, incidents and
“breaches”

6. o A security event is a possible problem that
should be assessed
o An security incident is a confirmed problem
that needs to be managed through the
incident response process
• Cyber attack
• A misconfiguration
• An errant communication
o A “breach” is a legal concept that relates to
unauthorized access to information or loss,
theft…
Learn and use this helpful nomenclature
Events, incidents and “breaches”
6

7. The incident response
process

8. o Quickly re-establish baseline data security
• Confidentiality (stop leakage and exposure)
• Integrity (get bad actors out)
• Availability (restore services)
o To appropriately manage the legal risks of
the incident, especially those arising out of
data exposure
o To foster leaning and security program
improvement
The objects
The incident response process
8

9. o Stop the incident from getting worse
o May involve
• Disconnecting from the internet
• Fixing a misconfiguration
• Changing a password to a compromised
account
o Steps are taken immediately with available
resources
o Should not entail overwriting data to restore
services, which can cause loss of evidence
Step 1a – Contain (first few hours)
The incident response process
9

10. o Don’t
• Call the police
• Call the privacy commissioner
• Call the board chair
o Do
• Consult a lawyer
• Who will retain one or more experts to help
Step 1b – Get help (first few hours)
The incident response process
10

11. o In a malware event this can become difficult
quickly without expert guidance, with
evidence being destroyed and more
information being stolen
o Can involve
• Negotiating a ransom payment and the
retrieval of decryption keys
• Restoration coaching by expert
• Installation of endpoint mentoring software
tools to watch for signs of persistence
Step 2 – Restore and secure (days two to four)
The incident response process
11

12. o Starts with the gathering of digital evidence
o Evidence is analyzed to answer two key
questions:
• How did this happen?
• What data was exposed and how?
o Not search for things you want to find, but
there will often be a duty to conduct a duly
diligent investigation
o If the expert determines there has been no
exposure, you will rest heavily on that
conclusion in taking no father action
Step 3a – Investigate (days four to…)
The incident response process
12

13. o Mitigate all the harms and potential harms arising
out of the incident, including reputational harms and
harms to people
o We do this primarily by communication
• Media releases
• Notification to affected individuals
• Credit monitoring offerings
• Reporting to law enforcement or sharing threat
information
o Keys to success
• Timing – How fast is your “clock speed”?
• Accuracy – Don’t misrepresent or take risks on making
affirmative statements when you don’t know.
Step 3b – Mitigate (days four to…)
The incident response process
13

14. o Investigation is complete
o Mitigation steps taken
o Final remedial plan developed with an
implementation plan
• Take the “how” from the investigation report…
• …and apply the “5 whys”
• Develop a meaningful list of changes to
address the root and next level causes
o Assess your incident response process too!
Step 4 – Learn and move on
The incident response process
14

15. Incident response tips

16. o Use a small cross-functional team with the
necessary experts who keeps the matter
confidential
o All communications outside the zone of
confidence are approved
o If a lawyer leads, communications to/from the
lawyer will be privileged
• Lawyer instructs experts for well-defined
purpose that links to privilege
• Substantive issues all brought to the lawyer for
consideration
• Communications between team members who
are not lawyers are limited to what is factual and
administrative
Internal communication and privilege
Incident response tips
16

17. o Don’t say “we value your privacy.” Show it.
o Consider apologizing, but not profusely
o Convey the facts that will be meaningful to
those affected
• What was exposed
• For how long
• To whom
o Include a list of meaningful remedial measures
o Beware of legal requirements for what must go
in a notification letter
Notifying and communicating
Incident response tips
17

18. o Notification is generally based on exposure of
personal information, not a security incident alone
• Though an incident alone may lead you to engage in
the sharing of threat information
o There may be a statutory duty to notify (and report)
o Or there may be another reason to notify
• There’s a real potential for significant harm
• The incident is known
• The incident is likely to become known
o Many organizations notify reactively, too quickly and
without good reason
When to notify
Incident response tips
18

19. The incident response
plan

20. o An “IRP” applies to all forms of security
incidents
o It is premised on the idea that incidents will
occur and can be anticipated
o It structures the response to save time and
support optimal decision-making
• Identifies the key processes and decisions
• Puts information at hand
• Provides decision-making authority
Your response process should be embedded in a PLAN
The incident response plan
20

21. o Frame out the process
o Identify responsibilities
o Append
• Contact information for 24/7 contact
• Pre-retained experts
• Playbooks for certain expected scenarios
o Create playbooks by running scenario
based exercises
What to put in the plan
The incident response plan
21

22. Questions?
Questions?

23. For more information, contact:
The information contained herein is of a general nature and is not intended to constitute legal advice, a complete statement of the law, or an opinion on
any subject. No one should act upon it or refrain from acting without a thorough examination of the law after the facts of a specific situation are considered.
You are urged to consult your legal adviser in cases of specific questions or concerns. BLG does not warrant or guarantee the accuracy, currency or
completeness of this presentation. No part of this presentation may be reproduced without prior written permission of Borden Ladner Gervais LLP.
© 2020 Borden Ladner Gervais LLP. Borden Ladner Gervais is an Ontario Limited Liability Partnership.
Thank You
Dan Michaluk
Partner
416.367.6097
dmichaluk@blg.com