Proving a Negative: Case Studies Illustrating Methods to Safeguard the Organization from Something That Didn’t Happen

No ratings

Presented at TechnoSecurity&Digital 2020 by

D. Loper

Organizations face growing scrutiny and uncertainty over breach and cyber incident response. Regulators and public perception demand that corporations disclose before even understand the issue. Three recent responses are provided as case studies to illustrate both technical and strategic innovations required to protect the good name of good organizations. • Breach of third party vendor discloses an organization’s information without leaving any traces at the organization. • Extortionist threatens to release a vulnerability that does not exist in a heavily regulated environment. • Financial institution is threatened by release of information by third party. Law suit shifts to another third party breach to maintain standing. Incident response work has grown beyond technical response. Security companies are ever increasing their focus on deploying custom tools with sharply converging capabilities. Without advisory, strategic, and legal components; the technical solutions cannot address the risk to the organization. The case studies presented and the fact-based solutions to the no-win situation of proving a negative show the benefits of a multidisciplinary response strategy.