Cybersecurity took center stage in 2017, following a slew of cyber breaches on major companies, including those in highly regulated industries.

As the likelihood of cyberattacks increases, risk management professionals are likely to see more, not less, of this problem in the next year.

“It is clear that not only are cyberattacks of the utmost importance to the success and reputation of companies, but also that boards and management are now reliant on the legal industry to help their organizations manage and respond to cyber threats,” wrote ALM Intelligence senior analyst Daniella Isaacson earlier this month.

As such, here are four lessons that companies can, and perhaps should, take away from this year:

1. Do the breach due diligence you need to. Former Yahoo general counsel Ron Bell this year learned a hard lesson after an independent investigation of Yahoo's disclosed 2014 data breach revealed that the company “did not sufficiently pursue” information about the breach. A U.S. Securities and Exchange Commission filing found that the “2014 security incident was not properly investigated and analyzed at the time and the company was not adequately advised with respect to the legal and business risks associated with the 2014 security incident,” which may have resulted in the massive price reduction in the company's sale to Verizon.

Bell resigned just before the SEC filing, raising questions about whether general counsel are likely to be held responsible for data breach handling. As Edward McAndrew, a partner at Ballard Spahr and co-leader of the firm's privacy and data security group, previously told us, “In-house counsel are often best positioned to play leading roles in cyber-incident response, but they are often on the sidelines. And that's not a viable model anymore for anyone who wants to keep their job.”

2. Being too self-protective doesn't always play well with the public. After Equifax Inc. disclosed its massive data breach this year, details of the company's legal strategy and financial handling of the breach spilled out and drove a whole added layer of public rage. News that Equifax executives sold their stock before publicly disclosing the breach not only provoked investigations from the SEC and Atlanta's U.S. Attorney's Office, but also stoked public distrust of the company.

The company was also highly criticized for a mandatory arbitration clause nestled into the fine print of the website it set up to help users identify if they'd been affected by the breach. Although the company quickly sought to clarify and change the terms of the clause, the clause provoked an outpouring of social media criticism. The company sought to take advantage of the time before a Consumer Financial Protection Bureau rule that would bar class action waivers from arbitration agreements in the banking and finance industries takes effect in May, but as Scott Nelson of Public Citizen wrote for the group's Consumer Law & Policy blog, “the fact that the compliance date hasn't arrived is no reason for Equifax to foist another injustice on people already facing injury as a result of its security failures.” The move didn't play well with customers, and likely invited further class action litigation.

3. Don't try to cover your tracks. Trying to deal with cyber breaches quietly without notifying anyone might seem like an attractive idea, but Uber Technologies Inc. may have learned that lesson the hard way in its attempt to cover up a 2016 breach into the personal information of both customers and drivers for the ride-hailing service. Not only is it fairly unlikely that cover-up strategies will succeed (digital transactions and communications tend to leave a paper trail), but cover-ups are likely to prompt regulatory and federal scrutiny.

Bradley Arant Boult Cummings partner and cybersecurity and privacy team leader Paige Boshell previously told us that government investigations are more likely if cover-up actions are disclosed. “The likelihood of a congressional hearing is much higher due to the subsequent actions than it is for the breach,” Boshell said. She also noted that penalties in each of these states and local inquiries are likely to be higher because of Uber's handling of the breach.

4. Invest in your cybersecurity infrastructure and programming. Although companies are increasingly of the mind that cyber breaches are going to happen no matter what technology and processes are in place, being responsible about cybersecurity is probably the best way to avoid scrutiny altogether. Making sure that you have anti-virus protections, firewalls, secure connections, passwords with two-factor authentication and that employees have a good sense of how to avoid phishing attacks are all great precautions to have in place. Regular penetration testing can be helpful in getting a sense of your data security program's strengths and weaknesses, and what data may be left vulnerable to attack.

Gabrielle Orum Hernández is a reporter with Legaltech News and the Daily Report covering legal technology startups and vendors. She can be reached by email at ghernandez@alm.com, or on Twitter at @GMOrumHernandez.

Instant Insights /

4 Lessons You Can Learn From 2017&rsquo;s Data Breaches

Related Stories

Recommended For You

4 Lessons You Can Learn From 2017’s Data Breaches