Digital Dilemmas: Legal and Social Landscape of Ransom Payments

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about some of the legal ramifications and public sentiment that is changing regarding paying digital ransoms. And I'm going to be talking again with Justin Daniels. Justin is a corporate M&A tech transaction attorney for Baker Donelson. Specializing in cybersecurity, and he's been keeping track and an eye on ransomware and ties to cryptocurrency for some time. Justin is also a co-author of the book Data Reimagined: Building Trust One Byte at a Time. Welcome, Justin. Thank you again for coming and talking with me about this wonderful and juicy topic.

It's great to be back in the vault. Yeah.

Okay. Ransomware, our favorite topic. We always seem to be coming back to digital extortion. So, you know, since we've talked last, it hasn't gone down. It's only gone up. The targets that, you know, these ransomware actors are going after, critical infrastructure, all those bad kind of things. It seems to be becoming more of an epidemic. How has the public sentiment changed in the past few years based on this growth? How do you see that changing?

Well, I think the public is becoming more aware of the data that is being collected about them, why it has a lot of value, and, uh, in certain kinds of cases, how it can impact their access to services. Or, uh, I mean, heck, you go into a retailer to try on some clothes and they have a camera in the, uh, place where you try on clothes. That's kind of like insane. But what, sometimes in the fitting room?

Oh, hold on, hold on. Okay, I, I can see our topic changing here. Has sentiment though, has the consumer sentiment, are consumers holding their service providers or those digital parties or vendors more accountable if, you know, the service goes down or if the data is breached or things of that sort? Do you think there's more understanding and accountability at this point?

I would say it's understanding with preferences for who you want to do business with, meaning you are seeing studies saying that, hey, if this company has a track record for not caring about my data and whatnot, I'll take my business elsewhere. I think where we're seeing more traction in impacting behavior, and I know you write about this a lot, is the evolution in regulation. And I think a big data point in that is the SEC regulations that went into effect in December, because I think one of the interesting implications of those laws would be you have a data breach, it's material, so you have to report it to the SEC. And then you're going to turn around to the SEC and said, well, we paid the ransom, $20, $30 million. We're gonna trust that the threat actor's not gonna do anything. I think it's conceivable that you could see the SEC turn back and say, you know what, we're gonna fine you out the wazoo for that because all you're doing is facilitating cyber criminals. And oh, by the way, it's the policy of the government as well as federal law enforcement that you're not supposed to pay it.

And so let's dive into that a minute because there's a couple of aspects there that I don't know if the SEC, if that's within the purview of the SEC, but let's get into some of those legal ramifications. But you had brought up an interesting perspective, right? If the average consumer, if this level of trust, right, that, okay, you know, I'm on a web page or a service and if they get hit with ransomware and it goes offline, You know, that's, that is something that's important to me, especially if I rely upon it, right? Whether it be your social media site, whether you be your financial services sites or whatever it is. But it sounded to me like you were saying it's becoming more of a purchase decision criteria for consumers. The security or the trust around that is, is that what you're kind of saying in a nutshell? Because that's That has huge ramifications if it is becoming more of a purchase criteria.

I don't want to overemphasize what I'm saying because I think we have a way to go, Matthew. And here's what I mean by that. When I go to an outdoor mall and I watch somebody walk up to a digital kiosk and they take a selfie of themselves and their kids wearing some cool digital hat, and then they give them the cell phone number so they can, of course, get the picture. Once I start to see people say, you know what, I don't want to do that, or they go to the restaurant, they say, you know what, I don't want to give you my cell phone so I can get my, um, car back from the valet, that will be a tipping point. I don't know that we're quite there yet because I think certain people say, I really don't like Facebook, but what's my alternative? But the days of consumers being completely oblivious to the data that's being collected about them I do think that is changing. I think we still have a ways to go because consumers worship the convenience of technology and privacy and security always take a backseat to that. But having, you know, talked to you two years ago about this, I do think we're seeing a shift along the line of people becoming more aware of better practices for their privacy. More people saying, you know what, I have a junk email for crap, and then I have a separate email for, uh, things that I do care about. I see more people thinking that way. Is it enough yet? I honestly can't say I think it's enough yet.

So do you think there's a bridge in the consumer's mind between that privacy aspect and the potential ramifications of one of the companies they're using getting hit by ransomware and You know, we've had a big healthcare company get hit, so their financial transactions and everything else can't be processed. And that's a major hit to, well, everybody that's trying to get medical services right now in many different parts of the country. Ransomware has affected people needing to consume healthcare services. Is there, you know, a connection that is resonating that you think? In the mindset of people that, yes, me handling privacy and me choosing good vendors and me, you know, signing up for one service versus another, one's more secure versus another, less chance of ransomware, less chance of an outage. So I can use my ATM so I can actually get my prescription so I can do X, Y, or Z. Do you think there's a, again, an understanding in the average person's mind that they're all kind of connected?

I think what I am seeing anecdotally in my own life and talking to others is there is more of an awareness. However, taking the awareness into concrete action, which causes inconvenience, that's the next step. And I don't know that we're there yet because it's one thing to be aware of the fact that I should eat better and exercise more, But then there's taking the next step to actually making some of the sacrifices or discipline to maybe eat more healthy or make sure I work out an hour every other day.

That makes a lot of sense, right? It's, it's the knowledge is the first, is awareness and accountability, and then the next step is that inconvenience, that pain that you have to, to choose to suffer with maybe going with a different vendor, maybe eating your vegetables, but whatever it is, realizing that you do have some power over the situation by your choice. And for consumers, it's the choice of their wallet, right? That has a huge impact. Okay. Now you had talked, started talking about regulations and as a lawyer, right? We've got lots of interesting things coming up. We've seen companies and CISOs get sued by the SEC. We've seen the FTC recently come out for telcos articulating certain requirements about disclosures, right? Updating those requirements. We've seen the SEC rules come into place where you have to file your 10-K quarterly and, and talk about your cybersecurity posture and oversight. And then the 8-Ks, whenever a material impact is determined, you have 4 days at that point then to file that 8-K to inform shareholders, right, to make sure everybody's on the level and there's no insider information and shareholders are, are, you know, it's their right to be informed. So how do you think paying digital ransoms like ransomware, paying off the bad guys, is going to get impacted, or how is it going to change? We saw a huge— in the last couple of years, a huge percentage of victims pay. Um, do you think the regulations are going to change that in any way, shape, or form?

I think the regulations for them to change ransomware payments, I think it means some companies are going to get whacked if they paid it. Because right now—

by regulators, or the fact that it's now more transparent because of the regulation, and then the consumers will go, wait a second, you keep paying, right? Or shareholders, stop spending my shareholder value to these criminals, right? Where, where's the pressure going to come from?

If I had to pick between the two of those, and I put my executive hat on, Where it may come from, Matthew, is derivative lawsuits, because these things get disclosed and they pay it, and then the class action lawsuit is, you've not only been hit once, you've been hit twice. We want to hold the board accountable, we want to hold, uh, you know, the executives accountable. So I think that's an area, like, when you start to see breaches come out in their material I think you'll have class action litigation against publicly traded companies. But the problem with that is, you know who mostly benefits from class action litigation?

The lawyers. Always the lawyers. But that's a big hammer. I mean, that's something that boards and C-suites definitely want to avoid. And you're specifically talking about shareholder or customer lawsuits, class action lawsuits going after those boards and them having to invoke their D&O and E&O and, and insurance and bring in the force of lawyers and have to potentially disclose even more information than they're comfortable with. Right. About what controls they have, what oversight, what actually happened. That sounds very painful and uncomfortable. Do you think it'll be enough to force the industry down a different path?

Maybe not that alone, but then if you have regulators who are then stepping in and, you know, they find your cybersecurity program inadequate, or if you disclose a material breach and they investigate and they find that your cybersecurity program was inadequate, then you could be looking at sharp fines. To me, okay.

But let's, let's tear that down a little bit. Because, you know, it concerns me if we're saying, hey, there may be regulators that apply to all companies, and you have to have a certain standard. And there are sectors, right, the defense industry, sector, defense industry sector. They have certain requirements. CMMC, actually CMMC 2.0 is going to be active in 2025. Right. So there are certain requirements there. In the finance section, there are certain requirements for availability and confidentiality. Right. So, but there's not an overarching— it's not like the SEC is saying you have to have certain controls. In fact, I mean, that isn't even part of their purview. All they're saying is you have to be open and transparent to your shareholders. Doesn't matter what security you have. You just have to be forthright to them in a timely manner. If you choose to have zero security, awesome for you. Right. But you have to tell your shareholders that. Right. It does. You know, SEC isn't saying you have to have some certain standard.

Well, but here's the thing, Matthew. I think one of the reasons behind the regulation is the more companies that have to disclose what their practices are, you know, in most contractual agreements, at least security addendums that I look at, they want you to use industry standard types of technical, administrative, and physical controls. Mm-hmm. Well, now that the SEC has, you know, will develop over the years all of these filings with all of these companies, Like, for example, I was on a webinar today talking about this. Look at how many companies disclose in their annual filing for cybersecurity that they follow the NIST CSF framework.

Okay.

So where I'm heading with this conversation with you is to me, if you're a company in whatever industry and you're seeing all of your competitors using the NIST cybersecurity framework and you don't really use anything, Seems to me that with all these disclosures, that becomes maybe not the industry best practice anymore. It's just the industry standard.

Ah, that becomes the baseline that's expected. So even if it isn't regulated, it is market pressure among themselves to say everybody is following this CSF 2.0 and you're on 1.1, you're behind the curve, even though the regulators aren't necessarily going to hammer on you. Well, the SEC isn't. Okay, that's interesting.

I mean, but, but yes, go ahead.

So, you know, you mentioned this boilerplate kind of wording, and I see this all the time, right? If you go out to some company's web page and you click on their security, it'll say, hey, we use physical and logical controls, and, and sometimes they'll even say, you know, best in breed or XYZ, right? But it'll— it's, it's it's crafted in such a way that I can tell it was a marketing and salesperson behind it that wants to convey, we're very secure, you should trust us. And that's great, especially if it's true. But if the next 10-K that comes out paints a completely different picture, right, that it isn't best of breed and they don't have these controls and they don't even have a CISO, you know, and no, they don't review it at all at the executive level, right? Now you've got this disparity that I think could also lend itself towards those shareholder lawsuits or those customer lawsuits to say, hey, you know, false advertising here. You said— and the reason that I joined you is you said you had all these security controls and best in breed. But then when I look at your 10-K, it's not that. So when you have to tell the truth, You paint one picture that you're just mediocre or subpar, but on your marketing webpage, you say you're the best, right? Do you see that as a conflict of interest and a potential red zone for these companies?

Yes, because that could be deemed a material misrepresentation if there's some type of litigation arising out of a data breach. And remember, the rules themselves are you're supposed to disclose what your practice what your practices are. Saying that you really don't have any isn't really an option anymore. The other thing I really wanted to say was, if you read the comments to the final regulations, it's pretty darn clear what one of the main focuses of the SEC is in doing this. As you know, one of the biggest concerns from cybersecurity is your third-party vendor ecosystem.

Mm-hmm.

And so a lot of private companies don't realize that these SEC regulations was intended to ensnare them in a web. But since the SEC can't go after them, they go after the publicly traded companies. But it's pretty clear in the regulation is part of your cybersecurity hygiene needs to be third-party vendor management. So I think what you are going to see is a flow down of these terms where these smaller companies who have non-existent or crap security, you won't get the deal anymore. And you're gonna have to spend the money as table stakes in a cyber program so you can get the business deal. That's how I'm starting to see new opportunities when I talk to people. Yeah, we'll talk to you in a few months. And they come back, oh, we have this new insurance client and they want to see all our security hygiene and policies and whatever. And We don't have any. I'm like, yeah, you're not going to get the deal without it.

I like where you're going here, right? Because of the regulations, it forces transparency, right, of your cybersecurity practices, kind of how mature you are, whether you have a CISO, those kinds of things, whether it's reported into your board, all that. But as part of that, you're not an island unto yourself, right? You're part of this chain, this supply chain. And your suppliers and vendors are part of that upstream and downstream. So that transparency now flows again upstream and downstream to those third parties. And if they don't have appropriate security, that impacts what you're having to report to then. So that in itself puts pressure on all those vendors out there who are, you know, who are third-party suppliers or vendors or whatnot. To now have to elevate and invest in security so they aren't the weak link. Otherwise, yeah, you're right. Why would you? It's a complete disincentive to try and continue those, those business partnerships if they become a liability to your cybersecurity and what you have to report in your 10-K and possibly an 8-K. That puts tension in the system. I love that. What's the sentiment on the business side, though? You being in those discussions, those M&A discussions and those, you know, supplier and vendor discussions, what's their sentiment on this?

I don't think they fully appreciate what's coming their way, meaning they may sign these security addendums that say, hey, You third-party vendor have a data breach, we're coming in, you're gonna give us all the information, we're gonna basically take it over, and if there are public announcements, we're gonna be the ones who control that. I've seen that data security addendum from large healthcare companies before the SEC rules ever came into effect. I don't think the privately held vendors really appreciate that they're about to see a difference in what they're going to have to do if they want to do business with their publicly traded company. Because here's what you have to think through: if your third-party vendor has a breach and your vendor management wasn't really holding them accountable, their breach, depending on what kind of vendor they are, could require you to have to report that to the SEC and subject yourself to an investigation, subject yourself to a class action lawsuit because your third-party management was terrible. Because Think about if you had Target today. So Target had an HVAC vendor that had all this access, and the data breach happened through them. That's probably material. Now they have to report it. And on top of everything else, they're going to say, well, your third-party vendor management, where was it? You gave this HVAC vendor access to all this stuff. We're gonna, we're gonna hammer you. So now you've got to go to the third-party vendor and say, look, if you don't have these minimum requirements, We just can't use you anymore.

Which then puts more pressure on those third parties to actually understand what the requirements are, to actually read the contracts and understand those. So you need security expertise, you need legal expertise, you're going to need privacy expertise because there's going to be some privacy, uh, interwoven in all of that. And I mean, on I like it because it puts tension in the system, but playing devil's advocate, especially if you're a small or medium company, that can be quite a price tag. I mean, you can't afford a full-time CISO, a full-time chief privacy officer, full-time attorneys to be able to do this. Is there, you know, in the circles that you're in, is there a lot of concern about that economic pressure to be able to do these things?

I think there is that concern, but then the question is, you know, can smaller companies band together and pool resources for cybersecurity services? You know, I think the bottom line is we live in a society now that's really data-driven, and if you're going to be a smaller business, I don't know that it means you have to have a full-time CISO, but it might be that you have an outsourced part-time fraction fractional CISO or something like that.

I think the industry is going to grow in that space, but that's a completely different topic. But I agree with you. Yeah, because they can't afford— they need the knowledge, at least the strategic direction.

And you and I both are talking about having to do, oh, I have to have exotic endpoint detection and all— you need to do the basics, which is using multifactor on, you know, for all your employees, having some type of endpoint detection, having a decent third party who's helping you manage your network, not thinking, oh, if it's on Amazon, I'm covered.

No, it's secure, right? All cloud is secure.

But what these regulations do is, to your point, they put pressure on publicly traded companies who then put that pressure on these other companies And then they kind of have no choice because if you want the business, these are now table stakes. This isn't a nice to have. There's regulations out there that means these are a requirement. That's where regulation, if done well, can be helpful because you're always going to have this tension between stifling innovation and protecting the consumer. I mean, look what just happened to the cryptocurrency industry. They didn't have any guardrails and they ran amok. Now we're gonna see the same thing, I think, play out with artificial intelligence. They don't have a lot of guardrails. Yeah. And it's a race to get market share. Yeah. And, you know, we're gonna see a new form of cyber threat there, I think, with—

we're already seeing it. It's already there. The first worm was created for AI. You know, so I agree. Okay, so I want to get back to ransomware and ransoms, but you brought up a really interesting area and I got to take this sidebar here. So, you know, SEC governs publicly traded companies and, you know, you work in the M&A space and so forth. Do you think the, you know, those baselines we're talking about that are going to be commonplace for the publicly traded companies Do you think that's going to bleed over to the private companies? And, you know, what I'm thinking here is that, you know, the private investment firms and so forth, are they going to go, hey, I like having those kind of standards on the public side. Let's bake that in. If we're going to give $10 million to a company, let's make sure they're following the same level of care and they've got the same kind of oversight. That we would expect from a public company because eventually we may want it to become a public company, right? Or if a company is thinking, hey, we want to get acquired at some point, um, will the acquirer have these same expectations? Should we start building that in now? Otherwise we may not look very attractive to being acquired. So do you think it'll flow into the privately held organizations out there?

So I think it will, depending upon what industry you're in, what the profile of the strategic acquirer is. Like, if you want to be bought by, to your point, publicly traded company, this is all going to be on the table. Um, healthcare company, all on the table. Financial services, fintech, it's going to be all on the table. Having said that, I still see pockets within the private equity space when I work on the deals as to how sensitive they are to it. They might have some check to it. Haven't one outright stop a deal. I've seen it where they'll say, okay, we're going to hold money back or we're going to require that you spend money on this. But I've been working with one fund. I've tried to get them to put in place what I call minimum viable security across their entire portfolio, which means if you're going to be one of their portfolio companies, This is the minimum you have to do, and then we'll tailor it to whatever your company-specific risks are. But they're just— they don't see the value. I think it'll take probably another type of security incident, or they'll have to feel more pain before they become a believer. That's what you're talking about, because honestly, when we're talking about regulation, we're talking about feeling pain. I mean, I think there's a reason why privacy industry has grown so much because we now have 14 states that have legal requirements in terms of laws on the books. And that's why I write a lot about, well, regulation is one of the levers around which you take something from being a nice-to-have to being more of a have-to-have. And that's always where security has really struggled. It's been thought of as a nice-to-have. And not so much as a have-to-have. And the SEC rules, in my view, are potentially a huge data point to take us off in more of the have-to-have direction.

I love it. I love it. Okay, so back to ransomware.

Yes.

You know, it used to be a dirty little secret out there. And again, now we've got more and more transparency coming out. We knew a lot of companies were very quietly, when they were getting hit by ransomware, paying off the attackers, and in many cases doing the right thing and notifying consumers. There were some cases where companies weren't until it became public or a whistleblower came in and told the public, and then all of a sudden they came out and said, oh yeah, we had a breach, you know, 5 months ago. But do you think from a stigma perspective that there are ramifications for paying or not paying ransomware today and moving forward? Where do you see that?

That's an interesting question, because if I talk about public companies, I really am going to be interested to see what the SEC does when a company discloses a material breach to them and discloses that, yes, we paid the $22 million, for example, This whole— the subsidiary of UnitedHealthcare, apparently there was a $22 million ransom paid. Yes, that's already in the public eye. So then what are they going to disclose to the SEC? Because UnitedHealthcare is a publicly traded company.

Mm-hmm.

And then the question is going to be, is that going to trigger an investigation? And then how will the SEC perceive the fact that they paid $22 million to a threat actor when the policy of law enforcement, and that's not necessarily SEC's criminal purview, but that's the policy, is you shouldn't pay ransom.

But there's a difference between you shouldn't pay, which is what they've always said, versus you cannot pay. And they've never said you cannot pay. And I'm also interested, is it even a requirement requirement for public companies to indicate whether they've paid or not paid? Because I haven't seen anything in, you know, written down that says you have to, you have to disclose that.

So Matthew, that's going to come down to an interpretation of the regulations because you're supposed to discuss the nature and the scope of whatever the incident is. And so, you know, if I'm UnitedHealthcare, I don't know, is $22 million, if that's what they paid, is that material? Now it's already out in the public, right? So, you know, you're not going to tell the SEC that. Well, they're already going to know. And so what I don't know yet is if you had to pay a ransom, does that get factored in? Because you're telling the SEC, well, we don't think this is going to repeat because the threat actor made a promise because we paid him the $22 million.

The threat actor is so trustworthy. Yes.

But here's the thing, Matthew, I've had this conversation with other security professionals. They're like, well, why would a threat actor not follow through? Because now they're going to damage their reputation. And I'm thinking, well, what if the threat actor has different motivations? And they—

Yeah, like getting paid again.

—themselves as something else. I still have these conversations. And one was the guy was adamant. But I guess that's why I'm telling you, I want to see how they react when they start to get in material disclosures of data breaches from publicly traded companies. Now, privately held companies aren't necessarily under the same legal requirement, right? With those, I think it's going to depend upon how important they are. What kind of services that they provide, because I think a lot of people are still— they're kind of resigned to what is going on, but that is starting to shift. I mean, look, what could you and I do when Equifax got hacked and our Social Security numbers are out in the, in the dark web? I— you and I have no choice. You have to do business with Equifax if you want to get a car loan or whatever. They're going to that, and you and I have no choice. That's what really stinks about that data breach. No choice. You're stuck.

So if I had to guess, yeah, the way the regulations are currently written, that if— and let's take the recent healthcare breach. Yeah, they file an 8-K and say, we've had a data breach. It's material. It's impacted our ability to conduct financial transactions. So we can't paid between, you know, patients and healthcare providers. You know, we don't know right now when it's going to be resolved. We'll let you know. This was an intentional cyberattack. Okay, that's it, right? When they have resolved it, they will come back and go, here's an update. We've gained access. We've restored access to our systems and gained access to our data. The data was exposed, but we are now up and running again and operating normally, period. I don't think they're going to talk about how they resolved it. I don't think they're going to get into the details of what vulnerability was exploited. They don't have to say any of that, I don't believe. And from a shareholder's perspective, which is what the SEC is designed to do, it's to you know, they were created in 1929 and these rules were set forth in 1932 to basically say you have to inform shareholders when there's a risk to their money. Right. So if a factory goes down or if you can't do business or your major supplier stops sending you, you know, stuff. Right. Those are all material. And that investor may want to withdraw their money. Right. You don't want to give the insiders, the executives, more information because they also own part of the company. Compared to the outsiders. But that doesn't mean you have to give all the details. And so I think they're going to come out and say the minimum amount necessary to satisfy the regulation so that they're not going to be investigated. But I don't think they're going to give— go down that path. And in this case, it wasn't the company that said we paid. It was actually because it was being paid via cryptocurrency., and that's a pseudo-public, right? Pseudo-public/pseudo-private mechanism so people could see, hey, $22 million or however much it was just got sent to this attacker's account. All right. Unless there's a benefactor out there that was just nice enough to send $22 million of Bitcoin on behalf of this company, right? Chances are that it was actually the company that did it. So as far as I know, the company hasn't come out and said that they've paid it. I don't think they will.

And depending upon what happens in 6 or 9 months or even shorter time, this is where the other prong comes in. Does UnitedHealthcare get a derivative lawsuit? Yeah, I think they're going to.

That's already in the cards. There's enough hungry lawyers out there that are frothing at the mouth going, yes, yes, and rightfully so. This was kind of an egregious breach and it affected a lot of people, unfortunately. And when you're, you know, you're taxing people's ability to maintain good health and get their medicine and see doctors and doctors getting paid. And so, yeah, I think they've already earned that. I think that's coming regardless.

That's why I'm saying You could get, in that instance, a derivative lawsuit, and then depending upon what they do or don't disclose, this may rise, and may likely rise, to the level where the SEC wants to investigate. So now you're the company, and you've had a data breach, and now you're dealing with a multi-prong issue. You're dealing with a lawsuit, an SEC investigation, and then all of the negative stress that the combination of those two bring to the fore. So now what does that do if Matthew, I'm the CISO.

Oh, oh, can I add one to the list potentially? Go ahead. If this threat actor was deemed from an aggressive nation state, let's say a sanctioned nation state, right? A terrorist actor, Iran, North Korea, or something like that. Can you also be investigated and criminally prosecuted for lending aid to a terrorist organization?

Well, what they would have done before they paid the $22 million is done an OFAC check, right? Yeah. And if for some reason they did that wrong, they could be prosecuted for money laundering under the OFAC, right? Office of Foreign Asset Control. So that could be a fourth area of pain and suffering. But the first 3, you know, are pretty— are probably highly likely. And then it also highlights that I think from the payment processing standpoint, you're concentrated in vendors in healthcare. But really what we're talking about is you're seeing, by example, this two-pronged approach of regulation from the SEC and these disclosures now prompting potential class action litigation, which always keeps executives up at night, the negative fallout from all of that, then you start to say, okay, where does that start to lead us? Because I think— and I wrote about this in my book— it's the combination of education and regulation that got people to say, hey, when I get in my car, I just buckle up because That's just what you do. As you know, that used to not be the case. At least when I was growing up, my parents didn't do it. So what changed? Well, education from Mothers Against Drunk Driving about the value of the seatbelt. And then every state has a regulation now that if you don't buckle up, you can have consequences for it.

Yep, you get cited for it. Yep.

You know, that took time, probably a good, what, 20 years? How do we make cybersecurity and privacy kind of the digital seatbelt of the 21st century? And I think you're starting to see us go down down that path. What worries me is no guardrails around AI, which weaponizes a lot of really bad stuff and is just catnip for threat actors.

But again, I don't want to go down that sidebar, but we'll do another discussion on AI because that's just the tip of the iceberg with, with AI. But I like where you're going there, right? I mean, you're saying, hey, this is— we're, we're making a turn that's going down a long road. And if we start looking way down there and it may not be the SEC, it may be some other regulatory body out there that says that there should be minimum standards. And especially if you're, you know, in the critical infrastructure sectors and healthcare is, you need to meet certain minimum requirements of due diligence. And this is something down the road. And, you know, I like seatbelts. I think they save lives. And I think that that same kind of concept can and likely will apply in cybersecurity. I think, I think it has to down the road.

I mean, Matthew, I have a client that their entire customer base is critical infrastructure, and we're a smaller company, but boy, do we have a very mature cybersecurity program because we can't get the business without it. Now we're starting to get audited and these things, and, you know, we deal with it, but we're not starting from scratch. And so where I think private companies are going to finally start to change their tune is, hey, where's your cyber hygiene? If you can't document it for me, you just don't get the deal. Yeah, then you have no choice because without the deal you don't have a business. Yeah, why I'm saying private companies don't appreciate the SEC rules are in significant part designed to get at them through the public companies that the SEC can regulate because supply chain cyber risk is such a pervasive and persistent problem.

Okay. Let me ask another ugly question of you. Actually, let's do scenario-based here. Okay. And, you know, having a data breach or let's go back to the healthcare, right? This healthcare and the finance system go down in ransomware. If you're the executives at that point, right, you already know you're in trouble, right? Your systems are down. They've been down for a week. It doesn't look like you might be able to get them up without the help of the, the threat actors that victimized you to begin with. But there are obviously negative connotations in having to spend $20 million and pay it to your attacker and the potential legal consequences and the sentiment and everything else of that and the shareholder impact. But if I'm the executives and you're my lawyer and I'm faced with this dilemma, don't pay and we could be down for a really, really long time or pay and we're still going to be down, but not as long. You as the lawyer, do you have an argument a legal argument that says you should pay or you shouldn't pay, a legal argument at that, you know, for the executives trying to choose the best of the worst options of this dilemma.

Am I a publicly or privately traded company?

Either. Both. Both. If the advice is different from, you know, as the legal chair in these scenarios, you know, You know, what would you say for either if they're different?

Well, with a publicly traded company, the larger the ransomware payment, the more you go down the road towards materiality and disclosure. So you have to— I think you have to think about that. Okay. Then you have to think about what industry you're in, because certain industries now, like financial services, I want to say telecom, And also, you know what, I should have mentioned this, but the New York State regulator for the Department of Financial Services has become a big, big player. Yes, it has. So where I'm heading with this is if you do have to pay a ransom and you're regulated by them, you have to notify them under their amended rules.

Right. So, and that's relatively new, right? New York has kind of taken a progressive stance on this that other states may follow.

Right. And so where I'm heading with this, Matthew, is you're seeing the evolution in the regulatory landscape where depending upon what industry you're in, we might be regulated by— if you do pay it, you're required to notify a regulator, or in the case of the SEC, it could push you down the route depending on how much it is to materiality. So now that impacts my analysis because if I have to do that, Now I'm inviting regulatory scrutiny. Now I have to— against— if my— if we don't have any hope of getting the backups up, or they're really untested, I might have to choose between what's the lesser of the two evils. And I might say, I gotta hold my nose and pay because at least I'm gonna stay in business, get my business back up running, and then I'll deal with the regulatory scrutiny, whatever that may be. As opposed to, I don't want the regulatory scrutiny, but if I'm down for 2 weeks and I start losing customers because I breached my contract, you begin to see why tabletopping is so important. Because to try to make these decisions without practicing, it just gets a lot harder. I've done it plenty of times, but so now if I'm a privately held company, again, it'll depend upon who I might be regulated by. If I'm regulated by DFS, I have that same concern. But now if I'm, I'm really not and it's a small one and maybe I'm going to pay $50,000 in a ransom, they're probably— I'm probably going to tell them that's probably your best business decision because all I'm really doing at that point is trying to understand the law, weighing the risks of a regulatory, you know, regulatory investigation versus not being up versus risk of losing customers. And making a judgment call. And that's the art of incident response. It's making a judgment call with incomplete facts, under time pressure, with all hell breaking loose.

Digital extortion has always been an ugly situation for those victims, but it, it sounds like with the legal and regulatory pressure, it's just gonna get more complex, and there's gonna be more and more pressure to not pay and to make sure that you're a little bit more mature, maybe have some proactive measures, tabletops, basic security, things like that. So my last question to you then is for the audience members out there, and I've got a lot of CISOs out there, I've got a lot of CEOs, I've got a lot of board members. You know, they're obviously they're concerned about ransomware, either they felt the pain before or they worried it's coming and probably eventually it is. What is it that you recommend that they do? Right. Sitting there in fear is probably just crossing your fingers and hoping you'll get through the day every single day without being, you know, hit. What are your recommendations to them?

I think this is my recommendation at this point. Gonna channel my inner Jerry Maguire. I'm gonna say, oh, okay, this is good. I'm gonna say, show me the documentation. And so here's where I'm heading with that, Matthew, is get a risk assessment against NIST CSF, do a gap analysis, and then put in place milestones for what we're going to do to get ourselves further along that maturity line. Because here's the bottom line. You and I both know if some threat actor wants to be persistent, they're going to be able to get in. But at the time, you may be scrutinized by a regulator. You could be scrutinized in a lawsuit. You could be scrutinized by customers. If you're able to show every year I do a tabletop, every year I do a third-party risk assessment, every year I'm looking to update update stuff. It still stinks that you got breached, but nobody can say you sat there, you didn't think about it, you didn't try to do anything about it. It's all about going back to your fourth— sixth grade algebra teacher and being able to show your work. Now, does that mean just have policies in place? Because you can't write your way towards cybersecurity compliance. You can't. It's a combination of that plus putting the controls in place. And being able to document what you've done so you can prove to people that we did this so that if you do have a breach, they may disagree with, you know, what you decided to do. But they can't say you sat there and you did nothing. Because to me, that's when you kind of deserve to get whacked.

I can just get the visualization of a CISO on the phone passionately screaming, let me help you, let me help you.

Maybe for our next chat, you and I should combine efforts and take a couple of the scenes from the two you mentioned and, and do over Tom Cruise's voice in a deepfake. Help me help you. Cyber documentation. I think it'd be a fun way for people to see how scary deepfakes are, but also make make an important point in an entertaining and educational way.

It does, it does. You know, just hoping your way is not a strategy. You, you got to put forth the effort and figure out that optimal level. It may not be hiring a full-time CISO and spending millions of dollars on security program, but it's probably also not doing anything, right? You know, got to find that optimal level that's right for organization of where you're at, what your customers expect, what the regulators are going to demand, all those kinds of things. And you need the right expertise to help navigate that, I think. You know, most CIOs or CTOs or even CEOs, you know, they don't have that in their expertise. You got to get the right experts in and then you can get something streamlined and optimized, I think.

I think that's right.

So thank you so much. You know, where can people get a copy of your book, right? Data Reimagined: Building Trust One Byte at a Time. I love the title, by the way.

Well, you can go to Amazon. We have it there. I think it's running for Kindle for $0.99 right now. And you've been on it, but I also do a podcast with my wife called the She Said Privacy, He Said Security podcast. That's on all your typical Apple and other Spotify and other podcasting outlets. And like you, you can find me pretty regularly on LinkedIn posting, having good conversations with folks like yourself.

I'm not hard to find. Outstanding. I'll put all those links in the description so they can get to the book and the podcast and of course your LinkedIn. You know, Justin, thank you again. It's always a pleasure talking with you and thank you for sharing your insights. I'm sure this problem is not going to be going away anytime soon. And we're going to be talking a lot more not only about ransomware, but I also think we're going to be talking about AI and some of the pitfalls in integrating and embracing that without the proper security, privacy, ethics, and foresight.

I look forward to that conversation with you.

And, and thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.