Take Back Control of Your Cybersecurity Now | Advisen Ltd
Total Page:16
File Type:pdf, Size:1020Kb
TAKE BACK CONTROL CONTROL BACK TAKE TAKE BACK CONTROL of Your CYBERSECURITY NOW of Your Game Changing Concepts on AI and CYBERSECURITY NOW Cyber Governance Solutions for Executives BY PAUL A. FERRILLO AND CHRISTOPHE VELTSOS A. FERRILLO AND CHRISTOPHE PAUL BY VELTSOS BY PAUL A. FERRILLO & CHRISTOPHE VELTSOS published by sponsored by sponsored by THANK YOU TO OUR SPONSORS! TAKE BACK CONTROL of Your CYBERSECURITY NOW Game Changing Concepts on AI and Cyber Governance Solutions for Executives BY PAUL A. FERRILLO & CHRISTOPHE VELTSOS published by sponsored by sponsored by © 2017 by Paul A. Ferrillo and Christophe Veltsos. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any other information storage or retrieval system without prior written permission. To use the information contained in this book for a greater purpose or application, contact Paul A. Ferrillo via [email protected] or Chris Veltsos via [email protected] I To my beautiful wife Patricia, my one and only, my Northstar, my guiding light, and my best friend. Thank you for being there for me always. — Paul To my wife, Jennifer, thank you for your love, your support, and for enabling me to reach new heights. To my kids, N1 & N2, thank you for your patience and unconditional love. To my parents, thank you for nurturing my curiosity, and for instilling in me a love of learning. To my students, thank you for your drive to learn; it inspires me. — Chris published by sponsored by sponsored by II Strength and Helping clients better capability prepare for tomorrow Forward-thinking answers and technology WHY AIG Reliable and Creative and tailored responsive claims customer solutions Pioneers and market leaders Insurance and services provided by member companies of American International Group, Inc. Coverage may not be available in all jurisdictions and is subject to actual policy language. For additional information, please visit our website at www.AIG.com www.aig.com/whyaig ABOUT PAUL A. FERRILLO PAUL FERRILLO is counsel in Weil’s Litigation Department, where he focuses on complex securities and business litigation, and internal investigations. He also is part of Weil’s Cybersecurity, Data Privacy & Information Management practice, where he focuses primarily on cybersecurity corporate governance issues, and assists clients with governance, disclosure, and regulatory matters relating to their cybersecurity postures and the regulatory requirements which govern them. Mr. Ferrillo has substantial experience in the representation of public companies and their directors and offi cers in shareholder class and derivative actions, as well as in internal investigations. In particular, Mr. Ferrillo has coordinated numerous internal investigations on behalf of audit committees and special committees, and handled the defense of several signifi cant securities class actions alleging accounting irregularities and/or fi nancial fraud. Mr. Ferrillo has represented companies in a wide range of industries, including retail, apparel, insurance, fi nancial services, energy, oil and gas, and real estate. Mr. Ferrillo also regularly counsels clients in the growing fi eld of cybersecurity corporate governance, which is an increasingly important part of a Board’s enterprise risk management function. Mr. Ferrillo also counsels clients on cyber governance best practices (using as a base the National Institute of Standards and Technology cybersecurity framework, which was announced on February 14, 2014), third-party vendor due diligence issues, cybersecurity regulatory compliance issues for Private Equity fi rms, Hedge Funds, and Financial Institutions that have been promulgated by the SEC, FINRA, the FTC, and the FDIC/OCC, the preparation and practicing of cybersecurity incident response plans, as well as evaluating and procuring cyber liability insurance to protect against losses suffered by Companies as a result the theft of consumer or personally identifi able information, or as a result of the destruction of servers and corporate infrastructure. Outside of his D&O insurance practice, Mr. Ferrillo is a prolifi c writer, speaker, and commentator on a wide range of subjects. He is a frequent contributor of articles concerning securities, cybersecurity, corporate governance, and accounting fraud issues to the New York Law Journal, D&O Diary, Harvard Law School’s Forum on Corporate Governance and Financial Regulation, and other national publications and forums, and is a frequent speaker on securities law, corporate governance, and directors’ and offi cers’ liability insurance issues for the ALI-ABA, the New York State Bar Association, the American Conference Institute, NACD, and the Directors’ Roundtable. Mr. Ferrillo also is a co-editor of and contributor to The 10b-5 Guide, Weil’s annual review of securities fraud litigation in the United States. In 2015, Mr. Ferrillo published the widely acclaimed book “Navigating the Cybersecurity Storm: A Guide for Directors and Offi cers (“NCSS”). This book is provided “as is,” with all faults, without warranties of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fi tness for a particular purpose. [email protected] | (212) 310-8372 Direct published by sponsored by sponsored by IV Securing the Right Outcome: Our priority is to achieve what our client needs to achieve. K2 Intelligence is redefining 21st-century corporate intelligence by combining deep subject-matter expertise with cutting-edge technology in an unprecedented way. We bring to bear the best multidisciplinary and multinational team in the business to solve our clients’ most difficult problems. · Investigations and Disputes · Regulatory Compliance · Cyber Defense · Construction and Real Estate · Strategic Risk and Security · Private Client Services K2intelligence.com New York · London · Madrid · Tel Aviv · Geneva · Los Angeles ABOUT DR. CHRISTOPHE VELTSOS CHRIS – AKA DR.INFOSEC – is passionate about helping organizations take stock of their cyber risks and manage those risks across the intricate landscape of technology, business, and people. Both faculty and practitioner, Chris understands the value of clear communication, the need to manage human assets and relationships, and the need to manage risks in the digital age. He has advised CEOs, has worked with CIOs, has shadowed and mentored CISOs, and interacted with a wide range of other business executives. Chris enjoys working with business and security leaders to improve their organization’s cyber risk posture. That means you might fi nd him performing cybersecurity risk assessments, working alongside CIOs & CISOs to set and communicate strategic cybersecurity priorities, working with CEOs and CFOs to ensure risks are properly managed, or advising board directors on effective governance of cyber risks. On campus, Chris works to educate and inspire the next generation of cybersecurity professionals attending Minnesota State University, Mankato. Off campus, he is a frequent speaker and author on all things cybersecurity and privacy related. He has presented at the regional and national level, including at major security conferences like RSA. He has written articles, book chapters, blog posts, and even a white paper. More recently, he’s authored over 35 articles for IBM’s SecurityIntelligence blog on topics ranging from traits of successful CISOs, questions board directors are asking, to the nature of conversations top leaders should have about cyber risks. Email: [email protected] Blog: www.drinfosec.com Twitter: @drinfosec LinkedIn: Search for Chris Veltsos or drinfosec Phone: +1 (507) 389-6560 published by sponsored by sponsored by VI PREFACE: Many of you noted after reading our first edition, “Navigating the Cybersecurity Storm (NCSS)” that the allusion to the Avengers (my favorite Marvel comic book series) and to Captain America (my favorite comic book hero) was pretty apropos for both myself and the subject matter of the book, which dealt inherently with matters of cyber crime, cyber terrorism, and, ultimately, the national security and prosperity of the United States. Well, thank you for picking up on that. That was the point then, and it remains the point of our second edition of the book. Our freedom, our individual liberties, our economic independence, and our national security are inextricably intertwined with the strength and security of our computer and cloud networks. We cannot have liberty and national security without network and cloud security. Our right to privacy is a strong part of this puzzle too, but without strong network and data security, privacy is almost irrelevant, and unobtainable at best. The events of the past 12 months have been truly historic. We have seen broad-based ransomware, spear phishing, point of sale (“POS”), and high-powered distributed denial of service (“DDoS”) attacks, including the recent attack on Dyn, a DNS provider, that almost completely shut down Internet traffic on the U.S. East Coast for about 12 hours. We should also mention the continued economic and political espionage, especially as it relates to key elections taking place here at home and all around the world. Add to that the physical terrorist attacks in Paris, Brussels, Baghdad, Nice, San Bernardino, Chelsea and countless other places, one breach away from disaster is really not far from the truth. What’s different about Version 2 and why should you read it? Well, our cyber ecosystem has dramatically changed since November 2015, and you need to know how and why it’s different. And you should read it because: (1) it’s a lot better and very updated, (2) we stay true to our message and purpose throughout (short, concise, mission critical, and actionable information for directors, officers, general counsel, and C-Suite executives), and (3) Chris Veltsos. Let me take those in reverse order. I asked Chris to join me on this year’s mission. He and I met through the good folks at IBM. When not teaching cybersecurity concepts to the next generation of security professionals, he advises business leaders on how to best handle the risks associated with cyber.