Focused commentary on the latest in data strategy, cybersecurity preparedness, regulatory compliance and incident response
Davis Polk’s Avi Gesser, associate Matt Kelly, and law clerk Samantha Pfotenhauer co-authored an article, The Expanding Role of Lawyers in Addressing Cyber Risk at Financial Firms, appearing in this month’s issue of The Review of Securities & Commodities Regulation.
Not that long ago, cybersecurity was viewed as…
Continue Reading The Review of Securities & Commodities Regulation Publishes Davis Polk Article on the Expanding Role of Counsel for Financial Firms in Addressing Cyber Risk
Two-factor authentication is one of the most common measures that companies use to reduce cyber risk, but it is not very effective if companies don’t also have a good lost-phone protocol.
Various regulations and industry rules require two-factor authentication (also referred to as multi-factor authentication or MFA) including the NYDFS …
Continue Reading The Weakness in Two-Factor Authentication—Your Lost-Phone Policy
Insider data threats – which include the deliberate theft or destruction of sensitive information, as well as innocent mistakes that result in a loss of control of confidential data – have become a primary risk factor to most businesses. To properly maintain cybersecurity and protect confidential information, companies need to…
Continue Reading Monitoring Employees – Balancing Between Privacy and Cybersecurity Isn’t Getting Easier
In Part 1 of this blog post, we discussed some key contractual provisions that lawyers should consider when entering into agreements with cloud service providers (“CSPs”). In this Part 2, we discuss some additional contractual considerations to keep in mind, as well as some post-contract practices to consider in order…
Continue Reading Cybersecurity and Cloud Migration, Part 2 – Additional Concerns and Best Practices
Companies have good reasons to limit business-related communications to devices and applications (“apps”) controlled by the company, and to avoid having sensitive company information on the personal devices and apps of employees:
…
Continue Reading Company Documents on Personal Phones? Consider Updating Your Policies
In early August, the City of Atlanta reported that the costs associated with its SamSam ransomware infection could reach $17 million, and the FBI has estimated the number of ransomware attacks may be as high as 4,000 per day. To help address the complex issue of when organizations…
Continue Reading Ransomware: Never Say Never – A Framework for Deciding When to Pay
There are many good reasons why companies are increasingly migrating parts of the information technology to cloud service providers (“CSPs”), including lower overhead costs, greater data accessibility and mobility, and more efficient disaster-recovery response. For cybersecurity, cloud solutions offer companies many benefits, such as full-time data security monitoring and data…
Continue Reading Cybersecurity and Cloud Migration, Part 1 – Contract Terms to Consider for Reducing Risk
The recent convictions of two traders for using hacked press releases and the settlement of SEC insider trading charges against a former Equifax manager highlight the significant insider trading risks companies face when dealing with a cyber event. These risks come in two forms.
First, there is the risk that…
Continue Reading Two Recent Cases Highlight the Insider Trading Risks Associated with Cyber Breaches
On April 23, 2018, Senators Klobuchar (D-Minn.) and Kennedy (R-La.) introduced the Social Media Privacy Protection and Consumer Rights Act of 2018 (“the Act”), which was referred to the Senate Commerce Committee. Like the CONSENT Act introduced by Senators Markey (D-Mass.) and Blumenthal (D-Conn.)—discussed in detail in our…
Continue Reading New Bipartisan Bill Shows Renewed Congressional Attention to Data Privacy and Security
In January 2018, at the Eleventh Annual International Conference on Computers, Privacy and Data Protection (the “Conference”) in Brussels, one panel that made some headlines centered around blockchain technology in the context of data protection. The core inquiry of the panel was two-fold: (1) whether blockchain technology can…
Continue Reading Blockchain for Data Protection: A Double-edged Sword or a Techno-regulatory Oxymoron?