Discerning Data

U.S. Department of Labor Issues Cybersecurity Guidance for ERISA-Covered Plans

There have been a rash of high-profile cyberattacks in the United States recently. Some of the more visible public attacks include SolarWinds, the Microsoft Exchange attack, Accellion, the Florida Water Treatment Plant and, more recently, the devastating cyber-attacks against Colonial Pipeline. These attacks, while disruptive, also yielded high-dollar payments to the cyber-threat actors.

ERISA-covered plans hold just under $10 trillion in assets and these plans are particularly enticing for cyber-threat actors. Although the Colonial Pipeline cyberattacks was executed by a coordinated hacking group, cyberattacks on ERISA-covered plans have historically been less complex. A typical scenario involves a retired employee’s ERISA account being accessed by an imposter, who then steals the account balance.

Continue reading “U.S. Department of Labor Issues Cybersecurity Guidance for ERISA-Covered Plans”

Cybersecurity Enforcement Trends: A Fraught New Reality for ‘Victims’ of Cyberattacks

New York partners Pete Baldwin and Bob Mancuso authored an article for the New York Law Journal titled, “Cybersecurity Enforcement Trends: A Fraught New Reality for ‘Victims’ of Cyberattacks,” that discusses how regulators have shifted their focus from data breach notifications to overall cybersecurity preparedness.

Continue reading “Cybersecurity Enforcement Trends: A Fraught New Reality for ‘Victims’ of Cyberattacks”

SEC ‘Sweep’ of Public Companies’ & Registrants’ Responses to the SolarWinds Cyberbreach

As publicly reported late last week, the Securities and Exchange Commission’s Division of Enforcement (SEC) sent voluntary requests for information to a range of public companies and investment firms seeking voluntary disclosure of information related to last year’s SolarWinds cyberattack. Specifically, the SEC is seeking information related to whether the companies and firms were exposed to the SolarWinds cyberattack and any remedial measures the companies and firms implemented in response.

Continue reading “SEC ‘Sweep’ of Public Companies’ & Registrants’ Responses to the SolarWinds Cyberbreach”

Department of Homeland Security Announces New Cybersecurity Requirements for Pipelines

The Department of Homeland Security (DHS) recently announced a new Security Directive requiring companies in the pipeline sector “to better identify, protect against, and respond to” cyber threats. Among other things, the Security Directive requires pipeline operators to report cyberattacks against their pipelines to DHS. This new requirement replaces the voluntary reporting guidelines that had been in place since 2010.

The new Security Directive is a response to the May 2021 ransomware attack on Colonial Pipeline that shut down much of the oil and gas distribution to the East Coast of the United States for approximately six days. According to various media reports, Colonial Pipeline ultimately elected to pay a Russian ransomware gang that claimed responsibility for the attack over four million dollars to re-open the crippled pipeline.

Continue reading “Department of Homeland Security Announces New Cybersecurity Requirements for Pipelines”

Faegre Drinker on Law and Technology Podcast: Computer Forensics

Computer Forensics: What is it? How is it Used in Civil and Criminal Incident Response Work? In this episode of the Faegre Drinker on Law and Technology Podcast, host Jason G. Weiss talks with Supervisory Special Agent Steve Crist of the FBI and former Orange County DA Investigator Dave White about the importance of using computer forensics in private sector and government cyber and incident response investigations. They explore the differences between computer forensics and traditional “wet” forensics; how computer forensics has grown to play a significant role in civil investigative and legal matters; the importance of digital evidence in criminal cases; and how a digital investigator works their way through a case.

Continue reading “Faegre Drinker on Law and Technology Podcast: Computer Forensics”

Federal Legislation Considers Banning Ransom Payments to Hackers

The year 2021 continues to reveal an alarming rise in ransomware attacks. Two of the most notable of such attacks include the ransomware attack on CNA Financial Corp., with resulting payment of $40 million in ransom, and the attack on Colonial Pipeline Co., with a ransom payment of $4.4 million.

With these two recent ransomware attacks—and subsequent payments—receiving massive publicity, congressional law makers have begun to question whether ransom payments should be permitted or remain legal, or if federal law makers should step in to prohibit such ransom payments as a means to curtail these forms of attacks. Although no bill taking that approach has been introduced yet, recent discussions of such a law have given rise to debate on the issue.

Continue reading “Federal Legislation Considers Banning Ransom Payments to Hackers”