Law.com Subscribers SAVE 30%
Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.
The State of U.S. Cybersecurity: Not So Good
It feels as though every day brings new national headlines about a cyberattack, an alarming trend that has piqued the interest and deep concern of plenty of U.S. organizations in both the public and private sectors. The latest iteration of an annual report, the “2014 U.S. State of Cybercrime Survey,” shows that these growing concerns have not necessarily translated into developing and deploying the proper defensive capabilities for preventing the next cybercrime disaster.
The report, which was cosponsored by PricewaterhouseCoopers (PwC), CSO Magazine, the U.S. Secret Service and the CERT Division of the Software Engineering Institute at Carnegie Mellon University, covers survey data from more than 500 executives from U.S. businesses, law enforcement and government agencies. The analysis concludes that despite some important efforts to build better cybersecurity regimes, organizations are still lagging behind the bad guys in tactical skills and technological capabilities.
One of the weaknesses identified by the report is a lack of strategic investment in cybersecurity measures. A mere 38% of respondents to the survey said that they have a methodology to prioritize cybersecurity investments based on risk to the business. The report emphasized that smart spending based on industry, geography, key assets and other factors is essential ' there are no one-size-fits-all strategies to protect an enterprise from cybercrime.
The lack of strategic investment is not due to a lack of awareness. Fifty-nine percent of respondents said they were more concerned about cybersecurity this year than in the past. More than three in four respondents detected a security event over the last year, and 34% said they detected more security incidents in the last 12 months than in the previous year.
The report places a special focus on insider threats. According to the survey data, 28% of respondents said they were attacked by insiders, and almost 32% said these insider attacks were more costly or damaging than those perpetrated from the outside.
Charles Beard, a principal at PwC who specializes in cyberissues, told e-Commerce Law & Strategy's ALM sibling CorpCounsel.com that there are two different kinds of insider threats that companies face today: actual contractors, partners or employees; and outsiders who “portray themselves as bona-fide insiders.” The outsiders can compromise the ID-management system at an organization and gain access to sensitive information.
It's interesting to note that although organizations seem aware of the danger posed by insider threats, only 49% of those surveyed said they had a plan to respond to them.
The report also emphasized the importance of collaboration in the fight against online bad guys. It pointed to data from another cybersecurity survey indicating that 82% of companies with high-performing security practices collaborated with others to gain knowledge about security and threat trends. See, “The Global State of Information Security' Survey 2014,” pwc.com. The report suggested that companies participate in Information Technology-Information Sharing and Analysis Centers (IT-ISACs; www.it-isac.org) forums. “Those forums ' demonstrate a reasonable approach for the company to sort of advance their own awareness about what the threat environment looks like,” said Beard.
Another tool in an organization's potential cybersecurity arsenal is the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework. The NIST framework identifies practical steps that organizations can take to upgrade their cybersecurity. “It allows for a common language from the board to the data-center floor, which I think is helpful,” explained Beard. The PwC report outlines the rate of adoption for each of the framework's criteria. Here, organizations did much better in some areas than others. Some 81%, for example, included cyberrisks in their enterprise risk-management programs, while only 8% said they implemented supply-chain risk management.
It feels as though every day brings new national headlines about a cyberattack, an alarming trend that has piqued the interest and deep concern of plenty of U.S. organizations in both the public and private sectors. The latest iteration of an annual report, the “2014 U.S. State of Cybercrime Survey,” shows that these growing concerns have not necessarily translated into developing and deploying the proper defensive capabilities for preventing the next cybercrime disaster.
The report, which was cosponsored by PricewaterhouseCoopers (PwC), CSO Magazine, the U.S. Secret Service and the CERT Division of the Software Engineering Institute at Carnegie Mellon University, covers survey data from more than 500 executives from U.S. businesses, law enforcement and government agencies. The analysis concludes that despite some important efforts to build better cybersecurity regimes, organizations are still lagging behind the bad guys in tactical skills and technological capabilities.
One of the weaknesses identified by the report is a lack of strategic investment in cybersecurity measures. A mere 38% of respondents to the survey said that they have a methodology to prioritize cybersecurity investments based on risk to the business. The report emphasized that smart spending based on industry, geography, key assets and other factors is essential ' there are no one-size-fits-all strategies to protect an enterprise from cybercrime.
The lack of strategic investment is not due to a lack of awareness. Fifty-nine percent of respondents said they were more concerned about cybersecurity this year than in the past. More than three in four respondents detected a security event over the last year, and 34% said they detected more security incidents in the last 12 months than in the previous year.
The report places a special focus on insider threats. According to the survey data, 28% of respondents said they were attacked by insiders, and almost 32% said these insider attacks were more costly or damaging than those perpetrated from the outside.
Charles Beard, a principal at PwC who specializes in cyberissues, told e-Commerce Law & Strategy's ALM sibling CorpCounsel.com that there are two different kinds of insider threats that companies face today: actual contractors, partners or employees; and outsiders who “portray themselves as bona-fide insiders.” The outsiders can compromise the ID-management system at an organization and gain access to sensitive information.
It's interesting to note that although organizations seem aware of the danger posed by insider threats, only 49% of those surveyed said they had a plan to respond to them.
The report also emphasized the importance of collaboration in the fight against online bad guys. It pointed to data from another cybersecurity survey indicating that 82% of companies with high-performing security practices collaborated with others to gain knowledge about security and threat trends. See, “The Global State of Information Security' Survey 2014,” pwc.com. The report suggested that companies participate in Information Technology-Information Sharing and Analysis Centers (IT-ISACs; www.it-isac.org) forums. “Those forums ' demonstrate a reasonable approach for the company to sort of advance their own awareness about what the threat environment looks like,” said Beard.
Another tool in an organization's potential cybersecurity arsenal is the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework. The NIST framework identifies practical steps that organizations can take to upgrade their cybersecurity. “It allows for a common language from the board to the data-center floor, which I think is helpful,” explained Beard. The PwC report outlines the rate of adoption for each of the framework's criteria. Here, organizations did much better in some areas than others. Some 81%, for example, included cyberrisks in their enterprise risk-management programs, while only 8% said they implemented supply-chain risk management.
Strategy vs. Tactics: Two Sides of a Difficult Coin
With each successive large-scale cyber attack, it is slowly becoming clear that ransomware attacks are targeting the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.
'Huguenot LLC v. Megalith Capital Group Fund I, L.P.': A Tutorial On Contract Liability for Real Estate Purchasers
In June 2024, the First Department decided Huguenot LLC v. Megalith Capital Group Fund I, L.P., which resolved a question of liability for a group of condominium apartment buyers and in so doing, touched on a wide range of issues about how contracts can obligate purchasers of real property.
The Article 8 Opt In
The Article 8 opt-in election adds an additional layer of complexity to the already labyrinthine rules governing perfection of security interests under the UCC. A lender that is unaware of the nuances created by the opt in (may find its security interest vulnerable to being primed by another party that has taken steps to perfect in a superior manner under the circumstances.
Major Differences In UK, U.S. Copyright Laws
This article highlights how copyright law in the United Kingdom differs from U.S. copyright law, and points out differences that may be crucial to entertainment and media businesses familiar with U.S law that are interested in operating in the United Kingdom or under UK law. The article also briefly addresses contrasts in UK and U.S. trademark law.