The Cybersecurity Vault - Incident Materiality and Meeting New SEC Requirements with Malcolm Harkins

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the meaning of materiality when it comes to the new SEC reporting requirements. And I'm going to be talking with Malcolm Harkins. Malcolm is the chief security and trust officer at Hidden Layer. Industry advisor, and a fellow at the Institute for Critical Infrastructure Technology. And he is one of the most respected voices in cybersecurity. Always a pleasure to talk or debate with you, Malcolm.

Hey, thanks, Matthew. Happy to be here. And it'll be great to have some dialogue around this and see where we agree, see where we conflict, and hopefully people will learn something out of it.

Agreed, agreed. You know, and the SEC ruling, you know, and, and everybody talks about the 4-day rule— you have to report in 4 days if it's material. And there, there's a lot of passion, shall we say, one way or another, in regards to this ruling. But one of the, you know, comments that I hear all the time is about how impossible it is to potentially quantify, does it reach that materiality threshold? But could you kind of give us a high level in regards to kind of what the SEC is looking at? And, you know, is it kind of a new precedent that it's setting specifically for cybersecurity?

Yeah, thanks, Matthew. So, you know, the SEC, we've all known, has been around for a long time, what, pushing 100 years, right? And the whole purpose of the SEC is to make sure that A reasonable investor is appropriately informed for the investments they're making and the investments they have by the organizations that they're looking either to invest in or already have investments with. Basic thing. Okay, then you go, okay, now we, we along that path have had a bunch of evolutions to what the SEC has enforced upon and provide guidance on. And 20-ish years ago, we had Sarbanes-Oxley, right? That was passed, and by the end of 2004, companies that were public had to attest to the state of controls around the integrity for financial reporting and all that stuff. And that was because of things like Enron, WorldCom, where organizations and their leaders, in some cases, acted fraudulently or misinformed investors. So, once again, the SEC had to tighten the reins. Roll forward the clock. Now we've got cyber. Now, you know this because of our shared history at Intel, and it's in the paper I wrote, and you mentioned I'm a fellow at ICIT. So roll forward, roll backwards actually into 2009, and there's this little thing called Operation Aurora that started going bump in some organizations, including Intel. Google went public with it in a PR sense in January-ish of 2010. But a number of organizations, including Intel, Google, and others, were starting to work on that together later in 2009. Along that path, at Intel, we had maybe 10, 15 people in total who knew about the investigation. Some lawyers, some security practitioners, CIO, general counsel, as we were doing it. Along that path, while we were doing the investigation, weeks into figuring out what is it, what does it look like, what it might have done, where is it at, I woke up in the middle of the night and said, "Oh crap, this is a Sarbanes-Oxley 302 or 404 reportable event." because we had gotten far enough into the investigation at that point that I had come to the realization under existing Sarbanes-Oxley requirements that it was potentially reportable. I got to the general counsel a few hours later, 7 o'clock in the morning, got to Santa Clara, and I said, "I believe this might be material enough, even though we haven't concluded the investigation, that we have to report it. He said I might be right and instructed me to go talk to the head of SEC legal, who had no idea what was going on. So I went and spent time with the head of SEC legal, walked him through everything we knew, all the things that we had done, and my perspective as to why it might be material. He said, "You may be right. We called outside counsel. We got outside law firm to provide us guidance." And so I did the same thing with them. Walked them through. Then it started becoming the questions back and forth over a few days. Well, what about this? What about that? To really evaluate it in terms of the materiality and material impact to Intel and its shareholders. And what the legal requirements were. Well, guess what? After several days of that and them analyzing the investigation to where it was at, even though it still was in flight, they came to the conclusion that it was likely a reportable event and we should report it. Couple weeks later, Intel's filing its 10-K and doing its annual report. We put the filing in our 10-K report of the incident. So 20 years ago, give or take a little bit, Sarbanes-Oxley came into be. 14 years ago, give or take a little bit, I evaluated and make a conclusion that it's possible and Intel's lawyers and stuff agreed. So for me, this is nothing new. Now what's happened since Intel did that in 2010. There were some other SEC clarifications and guidance in 2011, then again in 2018. Well, guess what? Along that path, more and more breaches, more and more this, more and more that. And how many organizations have actually filed in their financial filings, 8-K or 10-K, cyber risk exposures? Not many. Now, the 4-day rule which a lot of people are moaning and groaning about, is the same rule for anything that is material that becomes a reportable event. You have to do it in 4 days. Doesn't matter if it's a factory fire. It doesn't matter if it's material to the investors. The 8-K 4-day rule is, it's not special to cyber. That's just the rule for the 8-K.

Yeah, that makes a lot of sense, right? SEC was founded in the '30s, early '30s, and it's there to protect the shareholders. And one of the things it protects from is fraud and insider trading. So if the company executives have to share material events, right, the hurricane took down the factory for 6 months, that's important for them to know. Otherwise, there's a disparity between what the insiders know and what the shareholders know. So That makes sense.

And even if it's a labor dispute, I guess the biggest issue, even if it's a labor dispute and you have a belief that your factory workers could go on strike, which would affect your output, affect your earnings, affect your revenue, it's a potential material event. It should be in your risk statements.

So it sounds like we're actually on the same page here that the materiality requirement whether it's cyber or not, should have already been followed. And it almost seems like to me the SEC has allowed kind of a free pass, was a little lax on cyber. And finally it said, okay, we're not going to be lax anymore. You need— cyber is relevant enough that we're going to specifically, specifically call you out and say, yes, you are included. You have to file this as well. You can't just have a material cyber event and not report it when you have to report all other events. It doesn't make sense. And I think everybody's like, oh, you're calling and you're picking on cyber. No, we're just reminding you that yes, you have to report all events, not just cyber.

1000% agree with you. And I think many organizations through whatever means, you know, could have been the CISO didn't understand financial materiality. So didn't raise it. Could have been the CIO didn't understand it, didn't raise it. CTO didn't understand it, didn't raise it. Or perhaps when they did raise it, there was enough gray space and the SEC was not enforcing it that a lot of people were like, well, you know, yeah, we don't have to report because nobody else has. And I think because of what we've seen in the world, Frankly, they had no other choice than to say, we are now going to make it really crystal clear that you have the requirement. And then what we get frankly is a level of bitching and moaning from some organizations saying it's vague and I don't understand it, 4 days is impossible. And I'm like, no, it's not. Having done it, you know, 14 years ago, It's not that hard. It requires a level of understanding of your business and setting up, hopefully ahead of time. And again, if, if, if the CISO or the security team says they don't know if it's material or not, I could actually argue they're failing today because they should understand where cyber-related incidents would create a direct or indirect impact to a material event. And if they haven't done that, Frankly, you could argue they haven't done their job in the beginning because that's a risk management requirement. Understand the consequence of things. And if you don't already understand if something is likely to gonna cause a material event, then you frankly, you probably haven't been doing it right all these years anyways. Yeah.

Again, I'm gonna agree with that. And I would say it's an indication the immaturity of the cybersecurity program, it's not tying to the corporate business goals because that's what they speak. They speak those financials, right? And so if your cybersecurity goals aren't tied to that and you're not understanding what your goals are and thresholds are and what materiality is, you're probably not at that mature level where you are in tune and are directly supporting those goals, or at least you're not quantifying it, you're not measuring it.

Okay, totally agree. So where do you think— there's two aspects to think about, right? When materiality— there's materiality by impact, right? Which, you know, we, we can, um, argue whether or not people really understand the potential impact. There's materiality by nature, right? You could have— and Microsoft actually just proved this out with their recent AK materiality by nature. Because executives' emails were compromised, I could argue the, the CEO, the role is material by nature. So if I'm CEO and I'm getting to retire, or maybe I've had a heart attack, or I've been diagnosed with cancer, there's an aspect of that role that is material by nature that could affect an investor's decision. So we have to think about, again, the impact side of it. And then there's the materiality by nature. And sometimes that could be the device, the application, the data, the individual who might be compromised that's separate from the actual financial impact.

Yeah, I, you know, and I think it's a great aspect. It's not necessarily the quantity of records lost or number of servers down or, number of minutes of, you know, outage. It may be the severity of the data, the importance of the data itself, right? What company are you looking to acquire? What is that bid price? What are all these other initiatives? And, you know, a simple email may be enough to manipulate that stock price. And again, if some people know it and bad guys now get it or whatnot, it may cause a situation. That the stockholders need to know. And that's where you're gonna file that Form 8-K. It still is gonna make a lot of people unhappy, lot of people nervous. This is something new because you haven't been forced to do it. So go back a little bit and talk to me about the 4-day, 'cause the example you talked about, you know, with Intel, that sounded like that was a series of laborious discussions with legal and expert and this and that and probably took weeks. And yet you said the 4-day rule really isn't, it isn't beyond the grasp of a good security organization nowadays. Can you kind of firm that up and help us understand the disparity there?

Yeah. So again, the 4-day rule is after you've determined it's material. You have a 4-day clock. It might take you 6 weeks to come to that determination. It took, you know, me and everybody else as we were doing the investigation, 4-ish weeks into it that I had the, oh crap, I've got to think about Sarbanes-Oxley and the reporting requirements. And then that took an extra, you know, couple weeks of elapsed time back and forth with meetings and stuff like that. Now, the one thing we didn't do, and people could look at this at the time, we didn't file it under the 8-K in the 4-day rule because it was possibly material, because we were still in flight with the investigation. We did it in the 10-K as an aggregate risk item. Now roll forward you know, let's say, you know, that the clarification from the SEC had been out, we would've filed it as an 8-K. But at that time, Intel was the first known public company that I'm aware of that actually filed in our financial reporting in any of those things, an actual incident and a cyber risk statement. And so, you know, again, with the guidance, it would have now gone under an 8-K. But at the time, we did it in our 10-K going, okay, well, it's possibly material, and we were still in flight. So being precautious, we wanted to inform the investors. We hadn't yet concluded it was actually material. If we had, we probably would have kicked into the 8-K 4-day thing, but we were still in flight with the investigation because that took quite a while considering the complexity of what was going on. And kind of tracing down what occurred and what systems were touched.

Yeah, I see Lockheed Martin Q1 of this year, and they were one of the first, right? They published their 10-K and they had a specific area outlined specifically for cybersecurity. Prior to that, it was embedded in different areas and aspects, and or it could have been, you know, if it was a a slow year in the cybersecurity world, it could have not really been mentioned, but it looks like that they're kind of setting the trend saying, we're gonna call this out as a separate field, a separate topic, and we're gonna cover it every, for every 10-K. And I think it's a smart move and I hope to see other companies follow suit. Do you think that's gonna happen or do you think people are still gonna kind of wanna keep it under wraps, hidden within the lines of other sections?

I think by and large they will call it out separately now in their 10-K. The question still becomes one of the 8-K and what people will disclose as an actual incident. Now, I will tell you something that some people would disagree with, but if you, in Malcolm's perspective, even looking backwards, ignoring the current guidance, If you were a public company and you paid a ransom, I believe you already had the obligation under the 4-day rule to disclose it, and you failed to do so. For the simple reason, you'd only pay a ransom if it was potentially materially impacting. So if you ever want to go find out and look backwards and figure out where you probably should have done something and didn't, look at the ransoms you paid if you're a public company, and I'll guarantee you they were material events and you failed to disclose and you should have.

100%. And I hate paying ransoms anyway. It's the scourge of fueling the enemy. So, you know, if you are, just as you said, if you've gone to that extreme to say, hey, I'm going to cut money to these bad guys who victimized us, right? You're going to pay the bully. It had to have been material because if it wasn't, you would have given them the finger, which finger I won't get into, but, and walked away from it. So, okay. Now tell me, in your mind, with companies feeling the pressure of the 4-day reporting rule on the 8-Ks, and they've never done it before because most of them haven't. What should they be thinking about now? Because having to think about it once something potentially happens is the wrong time. You will feel that 4-day pinch probably. What do they need to start doing now from a business process, from a communications perspective?

Well, I mean, to be honest, I think hopefully people have already started doing this last year, But if you haven't, I'd say this isn't too hard to script or templatize, right? If you have done the work to understand what could create a material event, you understand the direct or indirect connections of cyber to it, you should be able to say, you know, we had a cyber event, leave out some details, it had a material impact to factory operations, it had a material impact to design operations. It had a material impact because it breached consumer data, and we reasonably believe that we will have remediation and lawsuits that could be material. I mean, you could templatize out some generic 8-K statements, have a book of them, so that way you're not crafting the statement at the time, because again, the SEC is not wanting you to disclose every little nuanced detail of the investigation. It's what a reasonable investor needs to know. So go work with your legal counsel that specializes in SEC law, either in-house or outside. Rope in your finance team, right? But let the lawyers help you craft that. If you have— if you're a public company, you probably have an analyst relations organization whose job is to keep investors informed and work with, you know, investor relations and analysts and, you know, equity firms and stuff like that. Go engage them. Why? Because they speak their language. Leverage the legal team, the finance team, the investor relations team, the PR team, right? Have that cohesive group craft those templates And then you're not doing that work and that saves you a lot of time in that 4-day window by having 10 or 15 different potential scenarios that could occur. And guess what? If you've done that, now you also have almost your 10-K statement, right? Because that's meant to be a broader, what are the potential systemic material risks that could affect the organization and you make that broad set of statements, and now you've done one to also help generate the other. Those are simple things that I think people can do.

So, setting some rough thresholds, working with the right people, creating templates, and it sounds like also embedding that into your playbook, right? If you've got those templates that you can reach in there, that's shortening the amount of effort during those times of crisis. Would you also recommend wargaming this with the senior executives? Is this either an opportunity to slit your throat or an opportunity to showcase how important cyber is? You know, what do you think? Is there a right answer here or is it tread carefully?

Well, one should always tread carefully, but I think there's two different types of, what I'll say, wargaming. One is the how we're going to deal with it. Who's the decision maker? Malcolm opinion, the CEO's not the decision maker in this. The decision maker should be the legal person responsible for the risk statements that, you know, has the SEC legal experience, right? In Malcolm's opinion, it's not the CFO. Some cases it could be, depending upon where that legal organization reports up to, but I, I relied on, on SEC legal experts to provide the direction that we need to take. I think that's the way in which you go. Again, different organizations might have different decision-making, but it gets back to the governance. Who's the decision-maker? Getting that clear will also help this stuff. Now, the other thing in terms of the wargaming, you can go through that wargame of the attack and how executives play or not play and the response and the communication stuff. The other wargame that I'd highly suggest you do is one that I'll call a mock deposition. What is the discovery and the deposition look like for yourself, your executives, your CIO, Go, go have your legal team go pull all the communications on everybody who's touched the incident, the banter back and forth, what was done or not done, and then go do a war game around the fact that if it was potential for a lawsuit, you had the requirement for preservation of all all communications and data? And did you actually preserve all communications and data? And when your security team gets questions, they get, well, we did some out-of-bound stuff. Well, what do you mean out-of-bound? Well, we use Signal, we use this, we use that. Oh, so you used encrypted communications within the response side of things outside of the company's systems. Okay, now how did you preserve that? That is where people are going to be getting in trouble.

And if you didn't, you're concealing— you probably had the intention of concealing the evidence as part of a litigation case or a criminal case.

Well, you might not have intended to conceal. That's vicious. You may have said, we've got potentially compromised communication mechanisms in the company, we need to use something out of band. That we, we suspect not there. So there might not have been intent to conceal, but a plaintiff's attorney will say you used out-of-band encrypted communications to communicate on things that were material, and therefore you did it in a way that were undiscoverable, and so you were trying to conceal. So you might not have been trying to conceal, but a plaintiff's attorney will absolutely say that you were trying to conceal. And so that's, I think, the bigger war game that needs to be done, because I think a lot of people don't understand that preservation requirement, or they don't understand that the emotional anecdotal things that go on in an investigation where somebody spouts off and says, So-and-so never knows what they're doing, that's why this failed. So-and-so, we've chased them down numerous times to patch these things, they have ignored us. Or something that says the CEO or CIO doesn't care, they never have. Those type of communications and banter that in some cases may have some shards of truth in them, but are because you're worn, you're exhausted, you've got emotional heightened stuff, and you have all these things that are going on in that fog of war that sometimes spill over into what I'll say inappropriate moaning and groaning and about people and processes and stuff like that. A plaintiff's attorney is gonna grab that and use that against you as the CISO and your organization to again meet their objective, which is to get you to pay in some lawsuit.

That's their job, right? And so they are going to go after that, and they're looking to establish a perception of incompetence or maliciousness or coercion that, you know, they— that people knew and chose not to do anything, uh, and weren't fulfilling their responsibilities to their shareholders. Yeah, it's ugly. I mean, having that kind of war game, that's brutal. I love it. I absolutely love it. I think it would be eye-opening and, you know, quite scary, unfortunately, to most organizations out there, unless they've already gone through this. But yeah, that's— yeah, I love the technical war game and the process war game, but also, okay, here's worst-case scenario. You're sitting on a stand.

Yes, sir. Legal war game.

Yeah, that's ugly. Okay. So, last question. We've talked a lot about this, the SEC rules. They've had a couple of cases last year and another one's continuing this year. But this reporting on the 10-Ks and the 8-Ks, where do you stand? Do you think this is a good thing for the industry, causing friction but still getting us to a better place? Or is this regulation that is overstepping and making a hard job even harder and will be a detriment at the end of the day to digital technology?

I don't believe it's overstepping. And I actually have applauded the fact that the SEC finally came out to make it much more black and white for folks. You know, it's just my opinion because I always looked at things. I was a former finance guy, as you know. And so I always looked at that perspective, hence why Intel reported 14 years ago. But I don't think it makes it worse. If you roll back in time, even not that long ago, you could probably go certainly into the '80s, definitely the '70s, and in the '60s and the '50s. CFO role, what was it? Mainly a chief accountant. In many organizations, right? It wasn't in some cases even a corporate officer. It was doing backend accounting and fiduciary work and it took direction from the CEO and others, you know, but guess what ended up happening? You had much more stringent requirements on the CFO start evolving in terms of their personal liability, the accuracy, what it means. And you look at the CFO today, it's a core part of the executive staff setting strategy, managing risk, doing all these things. So, I look at it and I go, okay, well, you know, we're almost in a similar role. I've, again, former finance person. My job as a finance person was the integrity of financial reporting, the accounting for the numbers. As well as the integrity for the forecast, right? The data and logic to the future financials had to have a level of integrity to it. Okay, go into risk. Well, I'm responsible for actuals. As the CISO, what is the actual state of risk? What is the actual state of controls? And I have to have integrity in reporting that. And my future casting of risk, no different to financial forecasting, has to have data and logic to support its accuracy. I always looked at it that way. And guess what? And you know this, I reported to a number of CIOs and others that sometimes had a different view. Okay, great. My view is the one that goes on record. Why? Because I'm the person in charge of it. Now, if you have a different view, then don't just tell me your opinion. Bring to me data and logic that causes me as the person who's responsible for the integrity of the risk statement and the risk forecast to bring new information that I can then incorporate to adjust the dynamics. No different than if a CEO says, our revenue number was $2.6 billion this quarter, and the finance team says, no, it wasn't, it was $2.4 because we had deferred revenue of $200 million. Well, no, it, it's $2.6 billion. Well, okay, here's how it was accounted for and why it's this. Why do you think it's The bigger number? Well, because I do. Well, okay, sorry, that doesn't fly with changing the reporting of your revenue number, your net income, right? Now, if the CEO happened to be a financial expert and said, well, under this rule in GAAP and the way in which looking at it, there are some gray spaces and it's equally appropriate to count the revenue in this fashion. And the finance team says, "Oh, we missed that. Yeah, that's equally correct. Okay, thank you. We will move the number up." Then you go, "Okay, I've got data and I've got logic," and you adjust the number. I just looked at risk the same way. I think CISOs have to do that and have to say, "Other than just giving me your opinion, CTO, business unit general manager, CFO, general counsel, whatever," Where's your data and logic that alters the analysis, that changes the portrait of risk? And if they don't have it, don't change the portrait of risk, because when you do that, you just created yourself a ton of problems and increased your personal liability for going along with potentially diluting the portrait of risk when the data said otherwise, that that you were in charge of gathering, collecting, analyzing, and making the statements around.

Outstanding. Malcolm, thank you for joining us and giving us those insights, especially from a finance perspective, 'cause you've got that background in addition to cybersecurity. Always appreciate your insights, especially on materiality. And thank you all actually for watching, and be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you much.