As press coverage of ever more sophisticated cyber attack increases so does the realisation that this is no longer the stuff of fiction effecting particular “secret” sectors. Nor can it just be regarded as “IT’s problem”. This session will look at the important role that in-house can play in addressing cyber risk, exploring the legal risks associated with it, the practical steps that can be taken internally and what to do if a cyber penetration occurs.

1. Shine Webinar Series
Cyber Security: Whose Problem is it?
Paula Barrett, Eversheds LLP
27 November 2014

2. Cyber Attack
What is
it?
Why do
it?

3. Whose role/responsibility?
Information
Security?
Compliance?
Legal?
finance?
Board?
marketing &
comms?
HR?

4. Where to Start?
Understand the Risks
Prevention
Dealing with Incident

5. Section break title Verdana 32pt
Sub-heading Times New Roman italic 34pt
Understanding the Risks

6. Types of Asset to be protected
• Financial information
• Sensitive Personal Data
• Personal Data e.g. customer and staff
information
• Intellectual Property
• Other corporate information
•

7. Understanding Legal Risks
Legal
Obligations/Risks Data Protection
Sector specific
(e.g. financial
services – Prin
3)
Corporate
Duties?
Directors Duties Contractual Confidentiality
(to others) Negligence
Health & Safety Others?

8. Risk
Financial loss
Regulatory Sanctions
Reputational Damage
Loss of valuable data/competitive advantage
International Risk variants? e.g. US class action
Theft of information,
money, banking
information
Disruption to trading
Costs of sorting out the
incident and stopping
further penetration
Damages claims from
individuals or third
parties
Share value/merger
opportunities
Contractual sanctions
e.g. PCI-DSS Shareholder claims

9. Section break title Verdana 32pt
Sub-heading Times New Roman italic 34pt
Incident Prevention

10. Technical/Operational Prevention
• Security Controls – technical, operational
• People (including board members) – access
controls, home/mobile working, removable
media, information sharing exchanges
• Testing
• Back ups
• External expertise required?
•

11. Prevention/Protection – People
Training
Psychology of
Security
Align with other
programmes
Making it real for
staff
Regular
reminders/prompts

12. Protection –Reducing Legal Risk
• Record Retention
• Contracts
– Review wording in customer, supplier and other third party contracts
– What commitments obtained or given
– Data Protection Wording
– Confidentiality Wording
– Breach reporting
– Audit
– Force majeure
– Liability
– Public Announcements
– Information/Assistance
• Procurement processes – asking due diligence questions of suppliers
• Review Policies
– Employee, Supplier and Customer facing
– Employees - IT Use, Home/Mobile Working, Social Media, Data Protection
•
•

13. Keeping Alert
• Monitor strategy
• Information gathering/alerts
• Keeping abreast of best practice guidance issued
• Use of consultants/external advisors
• Participation in sector and other groups
• Regular board topic?
• Insurance
– Check scope and exemptions from existing policies
– Worth it?
•

14. Section break title Verdana 32pt
Sub-heading Times New Roman italic 34pt
Responding to a Cyber Event

15. Have a Plan A…
Know what
Cyber Incident Response
to do
Cyber Incident Response
Team Team identified?
identified?
Internal notification
Internal notification
processes (NB
processes (NB
communications may be
communications may be
down)
down)
RReehheeaarrssaall?? DDiissaasstteerr RReeccoovveerryy PPllaann BBuussiinneessss CCoonnttiinnuuiittyy PPllaann
IInnvveessttiiggaattee Fact Fact finding/finding/investigation investigation –
–
what what type type of of data, data, volume,
volume,
timing
timing
IIddeennttiiffyy tthhee vvuullnneerraabbiilliittyy RReemmoovvee oonnggooiinngg tthhrreeaatt UUssee ooff lleeggaall pprriivviilleeggee
NNoottiicceess Notifying individuals or
Notifying individuals or
third parties whose data is
third parties whose data is
affected
affected
Notifying regulators, police
or other bodies of attack
Notifying regulators, police
or other bodies of attack
Listed businesses – market
announcement required?
Listed businesses – market
announcement required?
Notifying shareholders
under Listing principles?
Notifying shareholders
under Listing principles?
Price Sensitive
Price Sensitive
information/ insider
information/ insider
notification?
notification?
OOnnggooiinngg ccoommmmuunniiccaattiioonnss
Dealing
with
incident
IP protection strategy –
IP protection strategy –
cease and desist,
injunctions etc
cease and desist,
injunctions etc
RReeccoovveerryy ooff mmoonniieess ssttoolleenn CCyybbeerr eexxttoorrttiioonn LLeessssoonnss lleeaarrnntt

16. Further reading….
Gov.UK
• Cyber risk management: a board level
responsibility
• 10 Steps to cyber security: executive companion
• 10 steps to cyber security: advice sheets
https://www.gov.uk/government/publications/cyber-CPNI: http://www.cpni.gov.uk/advice/cyber/
•
•
•

17. Cyber-security: whose problem is it?
Contact
•
Paula Barrett
DD: 0845 497 4634
Intl: +44 113 200 4890
paulabarrett@eversheds.com
• For further information on our upcoming SHINE events and
webinars, please visit our website:
• http://www.eversheds.com/global/en/what/services/in-house-counsel/events.