Proving a Negative: Case Studies Illustrating Methods to Safeguard the Organization from Something That Didn’t Happen

No ratings

Presented at TechnoSecurity&DigitalForensics 2019 by

D. Lefebvre

Organizations face growing scrutiny and uncertainty over breach and cyber incident response. Regulators and public perception demand that corporations disclose before even understand the issue. Three recent responses are provided as case studies to illustrate both technical and strategic innovations required to protect the good name of good organizations: Breach of third party vendor discloses an organization’s information without leaving any traces at the organization; Extortionist threatens to release a vulnerability that does not exist in a heavily regulated environment; and Financial institution is threatened by release of information by third party. This session will discuss how incident response work has grown beyond technical response and why security companies are ever increasing their focus on deploying custom tools with sharply converging capabilities. Without advisory, strategic, and legal components; the technical solutions cannot address the risk to the organization. The case studies shared during this session include distinct, fact-based solutions to the no-win situation of proving a negative.