The military suffered another data breach, impacting potentially 2.8 million living individuals. This isn’t the first time the government has been hacked, and it certainly isn’t the last.
Data breaches are a hot topic in the news again due to AIs escaping their confines to compromise secure networks.
In light of these and related developments, companies are asking themselves why they need to have perfect cybersecurity. The government can’t secure its networks, new technology is making it harder than ever to defend against cyber-attacks, and money is pinched across corporate budgets. What are companies, especially small businesses, supposed to do?
The first thing to recognize is that perfection is not the standard. Yes, there are consequences to getting breached, but they are not intended to be punitive. Most of them are intended to prevent further harm (which I acknowledge isn’t much solace when you have to report an incident to the state AG). Notifying people who have had their sensitive information stolen is to allow those people to take further steps to defend themselves. Notifying contractual counterparties are so that those counterparties can fulfill their obligations. Notifying law enforcement allows law enforcement to find and stop the criminals. These requirements hurt, but they are not imposed because a company failed in its obligations.
The standard most companies must meet is reasonable security. From a legal risk perspective, we look at it as defensible security. Does your program provide us the tools to defend your program from scrutiny in the wake of a breach? Often times, the steps we recommend to make a program more legally defensible are steps that will improve your security in a real-world sense.
So, what do I look for in a security program, especially post breach? The first thing is a risk assessment. The second are written policies and procedures, and evidence that they’ve been followed. If those are present, then the entire program becomes both significantly better and significantly more defensible. If one or both are missing, then there are problems.
Cybersecurity, especially in this world of AI hacking, is something every company must pursue. The foundational steps are relatively easy and essential. If you don’t know how to take those steps, or if you find yourself in need to defending the steps you have taken, reach out to the author at bgraves@centrelawgroup.com.
