Save Your (Cyber) Bacon: Keeping CISOs and C-Suiters off the Witness Stand
No ratings
Presented at GlobalPrivacySummit 2019 by
In the wake of the most recent wave of data breaches, the Department of Justice, the Securities Exchange Commission, and a host of other state and federal regulators have initiated criminal and civil investigations into potential misconduct by the “victim” companies and their executives. As a result, C-suite executives, particularly chief information security officers, as well as other members of the company’s information security team, are increasingly coming under intense scrutiny, facing legal proceedings and becoming the targets of regulators, plaintiffs, the press and even their own company. On one end, executives and security professionals are losing their jobs, reputation and even their careers, as they are easy and obvious scapegoats. On the other end, federal criminal prosecutors are taking a hard look at whether CISOs or members of their team violated criminal laws with well-publicized criminal investigations at Yahoo!, Uber and Equifax, that last of which has already resulted in criminal insider trading charges filed against the deputy chief information officer. In short, the stakes have never been higher. As a result, information security professionals need to become more aware of the personal risks that they face, the legal landscape for incident response and security generally, and how to best protect themselves, their jobs and their careers. What you’ll take away:Personal liability risks to information security professionals, both civil and criminalInvolvement in independent investigations, criminal investigations, litigation, and regulatory proceedingsGetting your own personal legal counsel, and how to get the company to pay for itRisky conduct, common pitfalls and best practicesNegotiating protections and indemnification during the hiring processDeveloping and implementing a defensible information security strategyThe role cyber insurance coverage can play in transferring risk