The Cybersecurity Vault - Kevin Powers discusses the Uber CISO criminal case

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today, we're gonna talk about the recent conviction of the Uber CISO who hid a breach and paid off attackers. Now, the cybersecurity industry has been buzzing with polarized views of this incident and what it could mean to CISOs. And today we're gonna be talking with Kevin Powers. Kevin is the founder and director of the Master of Science in Cybersecurity Policy and Governance program at Boston College. And today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. Welcome, Kevin. Thank you for coming and talking with us. I know you've done research, I know you've done analysis. We're interested to figure out what you've figured out.

Oh, awesome. Uh, thanks Matthew for having me here today and looking forward to our discussion. Should be a fun one.

So give us an overview of this case and kind of what was decided, because I know there's a lot of people just see headlines and there's panic and people assume certain things and Give us the facts. Let's start with that before we dive in.

Sure. You know, in a brief summary of the facts. So in 2014, Uber suffered a breach and there was an FTC investigation that was taking place. In 2016, Mr. Joe Sullivan, he became the CISO. He joined the team and he was part of that investigation. Okay. So he was deposed in 2016 by the FTC as part of the investigation. After his deposition a week later, there was a breach at Uber of 57 million personally identifiable documents, okay, information of individuals. Plus, I believe there was another 600,000 documents that were accessed involving Uber drivers, so they had their driver's license numbers, their financial—

What's another 600,000? You know, hey, you know, okay.

600,000 alone, right? So You had that take place, and what happened there was that Mr. Sullivan, instead of reporting this up, you know, he never reported to the FTC. Instead, he— and this is from the facts of the case and what happened at trial, okay? So, he covered it up. What he did, he spoke to one of the in-house counsel there, and he told his security team, "This doesn't get out here. This is not a data breach. This is not a security breach." Instead, he made contact with the attackers and used bug bounty money. Okay, so that's what you'd pay white hackers to come into. You'd pay them beforehand, you'd enter an agreement to hack your system, and then you would pay them. That's not what happened here. Instead, he used the bug bounty money to pay these hackers who then signed a non-disclosure agreement saying, you know, one, they wouldn't tell anyone outside of the group, you know, you know, the CISO and others, but then also that they didn't take any of the information or destroy any of the information. It was pretty much saying like, hey, we didn't do what we did, you know, which was they took that information, they, you know, didn't have the authority to access it, they didn't have the authority to keep it. So with that, those were the facts. And what came out later was a new CEO came in and they discovered like, hey, wait a minute, this wasn't a bug bounty payout. Instead, you know, we played the hackers. In-house counsel, not the general counsel, but another counsel who worked in-house, knew about that, and so did the CEO who left Uber. Okay, so that's the folks who were involved. And when they found out this happened, immediately the CISO was fired by the new CEO, and the same with the in-house counsel. Criminal charges, you know, then came about, and really there was two charges that came in. One was obstruction of justice, okay? And the government's thought process here was that the CISO, Joe Sullivan, had a continuing obligation after that deposition to tell the FTC of any other data breaches or any other issues involving security, which he did not, okay? Then the next piece was misprision. It's not used often in criminal cases. That's neither here nor there. But what it deals with is, you know, of a felony that's taken place, and then you concealed, you know, you, you worked willfully to conceal the fact that this felony occurred. Which, looking at this case here, there was a data breach, there's a violation of the Computer Fraud and Abuse Act by the cyber attackers, and Mr. Sullivan did anything he could to hide this. He instructed his team not to tell anyone and also had the cyber attackers sign an NDA not to disclose it to anyone. Ultimately, this all unwound because the cyber attackers were eventually caught. You know, they told the government, "Hey, we signed this NDA with Uber." And then also the in-house counsel, you know, flip sides, got immunity and testified against the CISO. So those are the facts involved in the case.

And this is an unusual situation by any measure. Right. First off, getting a CISO going, and these are criminal charges, correct? This is not civil. We want to sue you for, and the company, and you're hidden behind the veil of a corporation. This is this person being convicted of a crime, right?

Correct. And another piece, you know, to throw in here too is the CISO is a lawyer and formerly worked for the Department of Justice. Ooh, folks bringing the charges against him.

Okay, so a breach happens, and just coming off of doing testimony about a previous breach, having former background, um, uh, in the government, should have known, yes, I have to report this, has a breach, chooses not to report it, then is complicit in telling other people, don't report this, don't share this. Goes out of his way to engage with the people that have this confidential information and pays them off through a bug bounty program. It doesn't matter how he really paid it off, but it seems like a good way to potentially hide it, right? To masquerade. And ultimately he gets caught because a new CISO or a new CEO comes in and says, no, this, this isn't right and pulls the covers back. So one, I have to give props to the new CEO, right, for doing that. And in my community of CISOs, there has been so much talk about this because I, I, I'm not sure, but it seems like it's the first time that a high-profile CISO has been prosecuted, criminally prosecuted for his or her actions. And the concern there is, wait a second, you know, they're just, they're just following orders. They're just doing what they need to do. And yet they're, they're being thrown under the bus. Is this how kind of you're reading the situation? Is this person the scapegoat? Is this person just, oh, well, you know, other people are trying to hide, duck and cover, the music stopped, and he was the last one standing without a chair. I mean, you know, what's your feel on this? What do the facts say?

Yeah, my take is no on all of that. I don't think he's the last person standing. I don't think it was the CISO as a scapegoat on this one. In fact, when you look, just look at the facts alone, he's deposed, okay? It's an FTC investigation, then there's a data breach. Now the question is, okay, was there a continuing obligation? You know, the jury found, and that's what the government said, yeah, there's a continuing obligation. So step back, if one, he didn't report to the FTC right away, but instead internally they work, they didn't pay a bug bounty, right? You know, they didn't pay and they tried to figure out what was going on and they worked it through the system and the CEO was highly involved, the security team, the board of directors, and you had that. And then there was maybe a delay on reporting it. They go public and say, hey, there was a data breach, 57 million, 600,000 employees. And notify the FTC. Okay, that's not gonna go to a criminal. The FTC or the US Attorney's Office is not gonna come after the CISO and say, "You know what? We're gonna bring criminal charges against you. You know, like, you waited for a time. You took too long. You had a continuing obligation, but eventually you told us, right?" So, there might be civil fines involved, maybe for not revealing it, or they might look and say, "Well, actually, you had to get all the facts together right away." Here, though, I think it was within 24 hours they knew everything was gone. So within that 24-hour timeframe, give or take a day or two, you need to notify the regulators and report accordingly. I don't think that's where you get to the criminal. It's really the criminal came in, okay, you had, I think, the throw-on of the continuing obligation. It was the fact of the cover-up. You know, it never got to the board level. You know, there's a breach of 57 million records of your customers, 600,000 of your employees. Employees highly sensitive information. And what do you do? You cover it up. There's only a certain group of people who know on the security team. Tell them not to share this with anyone. Then use a bug bounty program to pay off the criminals and then have them sign an NDA that they're not going to disclose. I mean, that's where you see it. That's criminal. You're concealing something that's really bad and you're actively concealing it. It's not that, hey, let's figure out what goes here. What should we do business-wise? They just, he just covered it up. So this was a complete cover-up. So I think the facts speak more to that. Should in-house counsel have been, you know, taken a task? Well, I think they were going to. First one, you know, last one to the courthouse gets indicted. He was probably the first one in and says like, hey, I have some facts I can tell you if you give me immunity. So that probably happened. I don't know what happened to the former CEO, why there is no charges against him. That seems suspect in my mind, but there could be more to it that I don't know. But yeah, this is different facts. Should the CISOs be concerned? Well, yeah. I think this, you know, from the government, this was a great case in that there's really bad facts, really bad actions. So you send a specific deterrence, okay, to you, Mr. Sullivan, CISO, you don't ever do this again, right? So now he's going to be going to jail. But the general deterrence and the buzz out there right now, CISOs are going, whoa, you're gonna think twice before you go outside the bounds of the law or do anything that could get you personally in trouble. Not that CISOs are doing that, but you're gonna think twice and go, wait a minute, they're asking me to do something. It doesn't seem like it's the right or legal thing to do. I wanna see all this documented and have an order come down to me to do it. And then you think twice before you do it, cuz you really have to.

Yeah, and, you know, in the industry, as a CISO myself, every CISO out there needs to know what are those regulatory requirements, what are those laws that you have to adhere to. And we have seen in many cases where there have been data breaches and it wasn't reported in the first 24 hours, but there was good faith. The CISO and the team brought in people or were working to figure out more data. And then they released it, released that information, you know, with legal counsel and with, you know, their marketing folks and every spin control, but it was released. And we have seen where government agencies both here and abroad have come back and said, okay, well, we're gonna slap your company's hand and we're gonna fine you because you didn't release it in time. You know, your company's gonna pay a fee. But that's completely different than saying, no, you, CISO, you are criminally accountable. And I think his actions, right, show that, yeah, he was complicit in a crime. He chose not to do these things. He chose to act in ways to suppress it, to intentionally suppress it, to hide it, to conceal it. Um, and he was breaking the law. And so, yeah, I mean, it's It's tough to say that the conviction was unjust in this circumstance, but every CISO out there does have responsibility. You have to know if you're breaking the law and they— there are going to be many CISOs, I think, that have, you know, just we'll use a data breach as an example, but there are other laws as well, but may have a data breach and they know they need to report it in some way, shape or form. And if their, you know, their bosses are coming in and saying, no, you are not to release that, we're gonna quiet this down. That's now an ethical question that every CISO has to ask themselves. Do they want to be a part of that? And if that CEO or their boss or whatever says, hey, go find a way to pay them, go do this, go, act in a way, and it may not have been in this case, you know, but if, you know, a CISO in our position is being told to do that, we need to decide, you know, what are you going to do? I know if I was asked to do that, that would be the day I put my resignation in. I'm sorry, I'm not going to be a part of this, right? I am not going to be complicit. Why? Because I know, I know what the law is, and I'm not going to do it because it's ethically wrong. It's also going to crater my career, as it should. And I may be held accountable personally, criminally, civilly for my actions. And I don't want that either. Mostly for me, it's ethical, right? But still, I mean, there are ramifications. But I also know some CISOs are going, well, you know what? Maybe to counteract this, we should just have insurance or we should put in some other controls that we should not directly go through other third parties. Where do you think the industry is going to go with this? How do you think CISOs are going to embrace this? Is it fear and no, we're definitely not going to do that? Or is it we need to have extra layers of insulation here and insurance and third parties? Why wasn't this under attorney-client privilege? And that way it would be considered— what are your thoughts?

Yeah, uh, one, this isn't the CISO's job. Okay, they should not be contacting the regulators or law enforcement or anything like this. This is why you have outside counsel or in-house attorneys, right? So you step back. So any good incident response plan, when you talk about like a determination if there's a data breach, you know, we'll use data breach as examples. Yet you want to look who defines what a data breach is. It's not me, it's not you, it's the law, right? What statutes apply to you? So there could be You know, you're in the United States, you're gonna have 50 statutes right off the gate.

Every state has their own. Sure.

Yes. Right. So as a CISO, you don't want to be making that call and you need the coverage and you should. That should not be your call. Your call is to protect the data, protect the systems. And if there's a data breach, start mitigating as best as possible and get back to operational readiness. That's the goal of the CISO. The goal of the CISO is not to worry about the law. Meaning that you should have proper counsel involved. When there's something going on, they should be part of the team there. And that's the call, like, hey, this is what's going on, this is what we have. And they go, okay, this looks like it's a data breach per bang, bang, bang. We're going to have to notify the regulators. Let me talk to the business unit. I'll work with them. You work on nullifying whatever damage is going on. That's what needs to be taking place. I think over the years, the CISO has been You know, everything they get, well, they get blamed for everything. One, two, they were doing everything. Okay, secure our systems, do our IT, start our cyber, get our cyber culture up and ready. You have to be an ambassador. We want cyber awareness. We want training. You have to align with the business. You have to work the CIO. You have to work. Okay. It gets to the point like you can't do everything, but you do what you do really well, which is building out a cybersecurity program, aligned with the data protection program, and then managing it and running it. But right now, with the regulators on this piece here, this should have been something where the CISO got the information, went to in-house counsel, instead of conspiring together, because that's what they did. That's what you had here, the rogue team, right? So you would hope that at least like, you know, one of the two would have been ethical in this situation. It seems like they weren't, okay? They decided instead of going forth, you know, you know, with the discovery, hit it. But you would hope in normal circumstances, the CISO goes to in-house counsel, "Hey, we just suffered a data breach. Letting you know, you guys run with it. This is what we're doing. Happy to get the team together. We're moving forward." So you're not worried about criminal charges, civil charges, or anything like that. Will you be second-guessed? Will you be blamed for the ultimate data breach? Well, that goes with the practice. And what you have to do is just show Right. Yeah. You come in and show we did everything right. It's not a matter of if, it's a matter of when, as they say all the time now. And we did everything best we could to protect, but look how we got out of the situation because we followed our plan, we mitigated, we recovered, and we're back to operational readiness. So that's my take on it.

Well, you bring up an interesting concept here, you know, because you keep talking about plan, and I think that's part of the industry best practice. Right? When we talk with, you know, peers and we talk with other companies and even with government agencies and so forth, because they have challenges like this too. It's not unique just to businesses. It can be small, medium, large businesses. It can be government agencies. I work with educational institutions all over the globe. Everybody can suffer these kinds of things. But what you would mention is really tied to industry best practice, right? It's making sure you do have a cyber response plan. If you have a plan and it's documented, right? We think we have a data breach and you're going in and you can dust off that plan and go, okay, step 1, let's validate whether we really do, figure it out. Step 2, we're engaging legal. Step 3, we had marketing folks have to be in there, have to be in there and everything. You know, step 4, we're communicating, you know, but having a plan that is approved, Right? It's approved by legal, it's approved by the CEO, it's approved by the CISO. You've got roles and responsibilities. You know what has to happen. That should, should eliminate a lot of the risks of those rogue actions. And I've run a lot of crises. A lot of time people are just in panic mode and they don't have their brains, you know, in their head. And so they do do kind of crazy things. That in hindsight, oh, that was criminal. Well, okay, let's avoid all of that and let's document a plan. And part of that plan, you know, as you were saying, you got to bring in the legal folks. You know, I'm not necessarily a privacy expert. I work very, very closely with privacy teams and industries. And I can say, yes, I know enough to say I don't know. But you got to get the legal folks in, right? Because it's not just the 50 states that you have to worry about. You have to worry about the EU and wherever your customers are at. Right? If some of that data was from European customers, you've got a whole different, you know, circus to deal with. And then, you know, lastly, the other part of the industry best practice that I think every CISO should be doing, because again, you got to have your plan, your response plan, you got to have those ties with legal to be able to call them up at 2 o'clock in the morning and go, we've got that bad thing. Right? But the third thing is start preparing ahead of time. Do tabletop exercises once a year. Do a tabletop exercise with legal and marketing and the CEO and maybe a board member that is savvy in security that you've been grooming on the side to be your advocate, right? Get them all involved and say, all right, let's do a quick tabletop exercise. We find a, you know, we dust off our plan Plan B, C, D, E, this is the way it rolls out. Does that sound reasonable? And with everybody going, yes, this sounds reasonable, great. Now you get a little experience under your belt. There's less panic, there's less fear. And that right now seems industry best practice. Short of bringing, automatically bringing in a third party that specializes in this, which I know a lot of big companies will do. Do you think if Uber had that in place, we would see the same problems that we saw in this case?

I would be shocked if at the time Uber didn't have an incident response plan. I think, you know, the facts here speak, they just went absolutely rogue, right? But I think everything you said, I agree with 100%. You know, I teach a course in incident response planning and management, okay? You know, and what we talk about too is everything you just said. One, you wanna have a plan, you know, then who's on the team, and then you train, train, and train. It's all muscle memory. You know, as a retired naval officer, you know, you never went out on a ship, it wasn't the love boat and you hope for the best. It was always, you planned for the worst and trained for the worst. So if something happened, you'd mitigate, recover, back to operational readiness. That was always the play. So I think you're right on that. But it's really important that everything is documented, that you have the policies and the procedures in place. And I like how you've been saying, like, these are industry best practices. The way things are going on the regulatory forefront, the proposed rules from the SEC, what you see in New York with the Department of Financial Services, and then new updated amendments that are coming forth, the FTC's new safeguard rules that are in place, A lot of these things no longer are best practices, they're requirements. It's almost turning, you know, incident response compliance. You have to have this. You know, show us your compliance program, multifactor authentication, encryption of data, you know, all these things that, you know, written cybersecurity program, you know, and how you build that program. Sure, it's based on your unique risk, but there's a checkbox of things you have to do and have to show. So I think on that front, It makes the CISO's job a little easier. But again, these are facts where it's, you know, really you had a group of rogue people doing something outside the policies and the procedures. They clearly knew better and they thought they could get away with it. I mean, that's ultimately what happened here.

Okay, then let's up-level this conversation. Not talking to the CISOs, let's talk to those board members. Let's talk to those CEOs. Right? Because there's always a risk of rogue players, rogue individuals or groups of people. We call them insiders, right, in the cybersecurity world. People knowingly doing bad things, right, who have trust. And the CISOs we trust, and in-house counsel we trust. But there is a risk that they may go rogue. And we've seen this. We've seen this with product developers. Where their product gets hacked and they decide to conceal it because it could be the end of their product, which is their career, right? That's their baby. So they hide it from the rest of the company. But it can also happen just like in this case with the CISO. But as a board member or as the CEO of the company, there are things you can do, right? It's not just, oh well, I hope that doesn't happen to me. Not only can you build a culture to make sure that there is resistance to those types of activities, thoughts, and practices, but you can also institute controls, right? Oversight controls, right? Release of money, right? Who, who approved the release of these funds? Is there a process for that, right? Did it take external counsel and internal counsel to approve that? Right? Does the CEO have to get involved, or the president, or the CFO, and have to know the details? Are there checks and balances that are built into process so we always have process that we can potentially rely on to help uncover these things or stop these things from happening from rogue players? But there's also behaviors, and this is something that I think is hugely important. If you build a culture where see something, say something, right? It doesn't matter if it's your boss, it's fine. There will be capabilities and it will be accepted that it's okay. We want you to report unethical actions. And maybe we even have, you know, if you're uncomfortable with that, we have an external web presence that you can go to and anonymously report it. Fine. I know companies that will actually put a bounty on it. We want you to. And the government has bounties, right? You are a whistleblower to the government, it's 20%. They'll give you a reward, right? When, when a, you know, a supplier or something like that is doing something unethical or defrauding the government. So there are behavioral things that you can put in place, and even that can be a deterrent to somebody thinking, hey, I'm going to go do this. But wait a second, I have to tell my entire team of cybersecurity professionals who are also ethical, conceal this. I know it's against the law and you probably know it's against the law, but conceal it. You know what? That's gonna be a deterrent. Now, there might be one that report, then the gig is up, right? So we've got potential process controls that a CEO and board can put in place and potential behavioral controls. And I'm thinking in this case, those weren't in place. They may have had a response plan, but I'm guessing Uber did not have the process controls or the behavioral controls in place. What do you think? Do you think they did? Is there any evidence to that? I'm making stuff up here.

No, I think you hit it on the nail. You know why the incident response plan didn't come into play? Because they never said it was an incident. They hid it. It was part of our bug bounty program. So that was involved. But you did have the whole tech team, right? The IT team on security was then told not to tell anyone about this. This is not a breach. And for those who knew, you know, if those mechanisms are in place like a whistleblower and there's those protections, and I think you're gonna see more and more of that coming down the road, especially in cybersecurity, that mechanism could have stopped that right in its tracks. That could have got reported out. Looking at these things here, right? Like how do you deal with, you know, from a board level? So we'll start with the board, go down to the C-suite and then go down to the business unit. At the board level, you know, a company like Uber, they're probably meeting, you know, quarterly, the committees are meeting as well, probably every other month. What information are they getting? So on a bug bounty, you know, does it even get to the board level? You know, you would hope, you know, it would like, hey, we have a program in place. This is what we're doing. We hire these groups to attack our systems. This is what was found. That's great. You would hope there's policies in place that show that like, this is when we hired Kevin Powers to hack our systems. He signed this contract. This is what he was gonna do. And this is his result. I don't think they had that type of paperwork. There was a non-disclosure agreement and that's it.

Well, that's red teaming, right? Where you hire an external vendor, a white hat hacker to come in. They may have a bug bounty that's just open, right? With, you know, HackerOne or something like that that says if you find, a remote, you know, zero day, we'll pay you X amount. Current rate right now for like Apple or Windows is about $1 million. I think $1.5 million just got opened up for Signal, right? For a remote bounty. But, you know, and I assume Uber paid or the CISO paid a good amount of money, probably—

It was $100,000. So that's, you know, that's—

Okay, it was a good amount of money.

It was a good amount of money. And you think there'd be a sign-off, or if he's signing off on it, but at least it'd be, you paid $100,000 on this.

Yeah. I mean, can he just cut $100,000 checks to anybody he wants? Wait a second.

And what do they— what do we get for it? What do we find? You know, what was the result? You know, so yeah, you'd want those mechanisms in place. I think this is a lesson for anyone that you need policies and procedures in place. And from the board level, this goes to, hey, you have a duty of oversight. It's a duty of loyalty. That's where the oversight comes in. And you have to make sure that, you know, and this is where things are going, you know, regulatory-wise, you know, you have to have an understanding of what your cybersecurity program is, what's the strategy, what you're doing, then the oversight of, okay, so we have bug— you know, why doesn't that come up once a year? You know, like, hey, these are like the type of tools that we use. We have a bug bounty program. This This is what we spent. You authorized us to spend this. This is what we spent. This is what we found. And this is what the results— open it up for questions. You know, you're not gonna like, you know, you're gonna have to take the CISO at his or her word in many ways, but there's gonna be documentation to back it up. That's the key. You can always fudge everything. You know, that's where it comes down. Do you have to trust? And then if they're not trustworthy, ultimately you're gonna find out. And that's what happened here in the Sullivan case. Case.

It's very interesting. Do you know, um, if he served any time? Was he incarcerated? Was he arrested? Did he serve at least one day?

Uh, not yet. I think that what will happen now, once you're found guilty, then there will be a sentencing hearing. So he wasn't a flight risk or anything like that, so they didn't have any pre-trial confinement. But there will be a sentencing hearing. It'll be interesting, you know, what the result is. It could be time in jail, or it could be, you know, a fine and probation or something along those lines. It's really interesting to see how it up.

How much do you think it's gonna affect the CISO community psychologically? And I know you're not a psychologist, but, right, um, it's one thing to be fined or have your company fined. It's another thing to be sitting in a 10x10 cell or a 6x8 cell wearing an orange-colored, you know, jumpsuit or whatever it is. Um, how do you think this is going to ripple through the CISO community?

The same way you think and you're seeing right now is exactly— it's like a tidal wave. It's not a ripple effect. Everyone's looking at, wait a minute, you know, the facts are awful. Okay, the CISO's head rolled. What about in-house counsel? What about CEO? What about board? You know, where's the other folks here?

You know, where does the line get drawn? All right, who's safe? Who isn't?

Yeah, you have one bad actor, but there's several bad actors too. Right? Like, where's the other folks? You know, there's a mention the CEO, the former CEO knew. Why wasn't he charged? Or why wasn't he a witness in this case? You know, where's he? And why is this other guy getting immunity, the in-house counsel? Did you have no other evidence to go after, you know, the CISO here? So I think in talking with CISOs, people are just really down and they're down, right? They love the job. They do good, good work. They're working long hours. Now it's like, well, wait a minute, if something happens, you know, the chief information scapegoat, you know, like, I like that one.

Let's not share that, all right? We don't want that to become popular.

Yeah, but, but it's really like that security program, and we're developing, you know, some of today's CISOs and some of tomorrow's, and they're, you know, they're excited, but they're concerned, like, hey, wait a minute, is everything following on the CISO? And I, I hope not. You know, I, I think the way things are going and with the regulations are starting to really push it back up to the board. If you look at what happened in the Drizzly case where you had the data breach, um, there were 2 million, um, records that were disclosed. This happened in 2020. The FTC entered into a consent order, so that's a settlement agreement with Drizzly where they agreed to follow best practices over the next 20 years. But the CEO agreed to do this too, that for the next 10 years he agrees to make sure that he follows best practices as put in place by the FTC. But if he left Drizzly and enters into another senior management position, that order follows him to the next—

follows him.

Okay, huge, you know, right? So that's up at the C-suite. So you can see this moving up with the board, especially with the expertise, their oversight responsibilities with the new SEC rules and other rules out there. So I think there's a change in there and I think there's going to be more protection for the CISO and an understanding from the regulatory side, I hope, you know, right? Because you never know. It could still be like, hey, the CISO is the target. Hey, we, we trusted we had the reporting mechanisms in place. We trusted the CISO. So sorry. So sad. It's all on you.

Single point of failure, which makes you the single point of responsibility too, unfortunately. And that's not best practice.

Yeah, and I think the CISO really is pushed back on the job requirements. You know, again, they should not, you know, working on the incident response plan and the team, they're doing that with counsel and the business units, and then understanding what's their role in that. That's controlling the data breach or the network attack. It shouldn't be dealing with law enforcement, the regulators, and things along those lines, right? That's where the lawyers come in, and they shouldn't be worried about like, hey, do we have to report this? Once it happens, they report to legal, legal's involved, and let them push it around. That's where the protection comes in.

It's interesting here. So that's from kind of the, the CISO and the business perspective. Let's change it up a little bit. What does this case mean to the SEC prosecutors? Is this opening a door now to say, hey, you're free to go after— if you think there's culpability, if you think there is an individual in an organization as part of these data breaches or whatnot, you have the leash to go out and prosecute criminally the C-suite, including the CISO, for crimes like this. Is this opening a door to them?

I think with the SEC, you're gonna see more civil litigation, you know, really coming after the board, coming after the business side of the house and the CISO. I think you're gonna see that just how the proposed rules are going. I think on the criminal side, you're gonna need facts. Hey, was it active concealment? It can't be willful ignorance, you know, like meaning that like, oh, we know something's not going on, but we're working on this. We know enough. I don't think you're gonna get criminal there. I think it's gonna have to be something where it's intentional, like here. Hey, we know there's a data breach. Or we know there's impact to our shareholders and we're not telling anyone. Kind of like Equifax, you know, if you look at the Equifax breach there, what they did, they knew in July, they didn't tell anyone, and they started dropping the stock and selling it and then made a notice in September publicly but not to the regulators. That's, that's a bad case.

But were there criminal charges on that?

I believe there were. I, I don't have to look that up on Equifax.

Yeah, I see. I don't recall criminal charges. I know they, they spanked them civilly.

Yeah, I think for the individuals involved, if there was inside a training, there was not civil litigation, but criminal litigation. I'll take a look at that.

Right. But not necessarily on the data breach, what they did with the data breach.

For example, they did a stock drop after. Right. So they knew the, it's similar here. You know, the coverup is, hey, if we don't tell everything and smooth sailing, then they just couldn't cover it up.

But the seal's been broken here, right? I mean, in essence, Because I can't believe— I, I can't believe that the CISO of Uber was the first one to do this. Right. There are ways to move money. There's a lot of ransomware attacks. You know, there probably were other companies. And this is the first one that I'm aware of that the SEC went criminally and has made a big deal out of it. Right. They've showcased this. And in my mind, they're sending a signal. Hey, the game has changed. Yes, you can try the corner cases, you can try and get around things, but the rules have changed. If we catch you, we may now criminally prosecute you. And I think that's the tingling down the spine that is going through CISOs, that the game has changed, that it's no longer, yeah, we can probably play this and we'll be fine. We may get slap civilly and the company will pay for it. Now somebody's butt is on the line, just as we saw with some other regulations where, you know, the, the chief financial officer, Sarbanes-Oxley, right, the CFO is on the line. You could spend time in jail. And that caused sea change. It fundamentally changed how organizations were going to look at it, and there was clear accountability. I think this is saying the same thing, you know. In a not so subtle way, CISOs, you can be held criminally accountable. And yeah, we'll come after you. If it's egregious, we're gonna come after you. And I think that's a psychological change. I think it is.

Yeah, and I think for the CISOs too, and if you look for an organization, I think what, you know, the first line of business would be one, make sure you have proper reporting mechanisms in place, you have proper oversight. Then the next piece is, If any time you're getting involved in negotiations with criminals or cyber attackers, you pull in law enforcement, you know, you pull in the FBI.

It's always a good practice. Yes. Yes. It doesn't always happen, though.

And now this is— this is the best must practice, right? But just by notifying them, getting them involved, that's going to give you coverage in anything you do. And if you look at some of the laws coming out now with the new I think it's the Cybersecurity Critical Infrastructure Reporting Act. It won't go into effect until I think it's 2025, but they have the reporting requirements within 72 hours report to CISA. But then if you make a ransomware payment, you have 24 hours to notify them and then justify the money paid.

Which is the worst thing you can do. I am completely against making ransomware payments, but don't get me off on that tangent. So, okay, so you had mentioned some, how is this case and how is the mentality in the industry now change from a regulatory perspective? How are the regulators, what are they coming out with? What are the new rules that we're seeing either being approved or are being floated to try and get approved? What are you seeing?

Yeah, what I see is more scrutiny and pressure on boards of directors and senior management. Just look at the SEC proposed— So pushing it up, pushing the responsibility up. Yeah, pushing up. So for public companies, for investment advisors. And then you have New York's Department of Financial Services Part 500, which has already been in place, but they have new updated amendments coming. And then the FTC's Safe God rules, which are already in effect, right? You know, in some, what they're doing is they're requiring boards— what, you know, first off, what's your expertise? Does your board have any expertise there? Do you have an expert on the board? What's their level of understanding? So now you're going to have more training to the board of directors. Also, how do you understand about your cybersecurity risk strategy, your program? How often do you talk to the CISO? What do you hear from them? You know, that's going to be in the minutes. You know, what's your understanding? How are you overseeing this? And then for the management, what's your expertise? How do you understand this? How do you work? Why are they building this cyber type of strategy, you know, cyber program? And how does this align with the business? That's all being required. Then they're saying like what the program should look like. So, and then, you know, like you look at the sign-off. So you have the proposed rules for the SEC, those go into effect. So now you're going to disclose, this is what we do. This is our expertise. This is how the board and senior management work with the CISO. Okay. Then you sign off on that. And if you're not doing that, you just violated the law, right? That's a public disclosure, right? You're lying to the shareholders and the SEC. Same with what's already in place with New York's Department of Financial Services. You have the CEO signing off that we, we are in compliance with this regulation. Now, if you sign that, that means you are. And if something happens and they come in and do an investigation, you're not, you're in trouble. The same with the FTC. They're saying you have to do this and then you have to have board insight, senior leadership. So there's a lot there. So I think it's going from the CISO and it's really moving up. And the reason is for the past 10+ years, it's always been like, hey, we have to get the boards more involved. We have to get senior leadership. And cybersecurity is not an IT issue. It's more of a business risk management issue that needs to be managed from the top down. And you know this. And there's been a talk about that, but it's never happened, right? Some companies do it. The financial industry does it. Most don't. So now you're seeing these regulations saying like, we gave you a chance. Now you— it's no longer you should, you shall. And that's where things are playing out.

Which I think is necessary, right? And I think this also in a weird way provides air cover for those CISOs. Because imagine if you're a CISO and you don't have these regulations in place, you don't have this case that came up and you do have a data breach and your boss, right? The CTO, CIO, or CEO says, no, keep it quiet. Quiet. Can you make this go away? Right? We'll allocate some money from this weird little budget here. You go pay whoever has, and we just don't want to hear about it. Right? We're not going to disclose. Now you've got these regulations. You've got this case to go, no, no, it's clear. It's clear. We are not going to violate, you know, it's not, it's in a gray zone. There is clarity. That is not right, that is illegal, I'm not going to be a part of it, right? And do you want me to leave the company after I say I'm not going to be a part of it? You know, it's just, it's not going to end well. So I think in a weird way it provides CISOs that air cover that they need as their role continues to expand.

I, I, I agree on that, and it's one of those be careful for what you wish for. For years everyone says I want to be in front of the board. You're going to be in front of the board a a lot. You know, a lot. I think you're gonna see the, uh, setup of cybersecurity committees or emerging technology committees, and the CISOs will be on there with board members and senior business leaders. And I think it's a good thing. I, I think it's, you know, like, hey, the regulations are coming out fast and hard right now. Well, they should have done that 10 years ago.

You're absolutely right. And I work with a lot of boards, and, you know, in the industry, we're telling them you need to have somebody on your board that is cybersecurity savvy, right? And if it's, you know, even if it's on, you know, a sub-board member or subcommittee member, but you need somebody there. And it's almost unfair for the boards to think, oh, well, we'll just train somebody. We'll train our financial expert. Well, cybersecurity is its own beast, right? And you may be brilliant in finance. You may be brilliant in IT, but that doesn't mean you're good at cybersecurity. And so you need to have that level of expertise that savviness to be able to understand and detect when unusual things are happening because you need to scratch a little bit more and get a little more information. And if you're not savvy, someone like this, even if they were reporting to the board, could probably tell you a story that would sound plausible enough that you wouldn't ask those detailed questions and it would get by you. And now you're involved. So get somebody that's savvy, that's on the board about cybersecurity, especially if you're dealing with sensitive information, sensitive data, you're a contractor or sub-con, you know, to the government or anything like that. It's an insurance policy. It really is to make sure you're doing the right thing.

Yeah. And you know, half, I bet you more than half the board would not know what a bug bounty program is. And that's what's important is, you get the training of the board on a regular basis on cybersecurity. Maybe like, you know, twice a year they have in-person training, and then you have, you know, asynchronous training where they start learning what a cyber program is, and they develop it over that time. Because I look at cybersecurity now is no longer just the IT issue, it's a core function of any business.

It's everything, it's woven into everything. We have our tentacles everywhere, right?

It's like every company is a tech company, no matter what industry you're in. You can be in healthcare, retail, finance, education, you name it. Everything runs on a system. So if that goes down, your business isn't working. So as a board member, you need to understand technology and you need to understand cybersecurity, not to be an expert, but a broad understanding. And then you have that expertise down at the cybersecurity committee, if you have a committee set up where they're bringing up and they're briefing the board and they understand, they can have an intelligent conversation. So you're absolutely right on that.

Okay, so let's close out with kind of some key messages, recommendations here. We've covered a few, right? You have to have board-level, executive-level understanding and involvement, right? And even accountability. You need to have an incident response plan, right? I know you teach organizations how to do that. You have to have that and strongly recommend you try it out, even if it's just tabletop exercise, right? You gotta get that muscle memory as you stated. Third, and I'll add this, I mean, you have to be ethical and you have to have an ethical program for the behaviors, the policies, oversight. You need to do the right things, otherwise it's going to come back and bite you. And it sounds common sense, but a lot of people, when they get in, you know, they're, they're— it's their product that's been hacked, I just don't want anybody to know, or it's their company, or they're just about to go IPO, we can't make this public, right? There are many things that sometimes force us to do things that we shouldn't do that are unethical, and we have to be able to delineate in that, in our mind, and do the right thing. So we have— what else? What are other key things other than don't break the law?

I think you summed it up nicely, and I think the whole approach is that if you don't want what you did on the front page of the New York Times where you're going to feel squeamish and you're going to feel like if your mom or your dad, your teacher, or your family, you know, would be like, oh my gosh, how could you have done such a thing? You know, you, you know not to do it, you know. So the key here is like, you know, you stay within the bounds of the law, you do what your job entails, and don't let anyone push you otherwise. That's the key here. I mean, these facts, um, they're really amazing, you know, how they came out. And you can make the— like, you know, people say, oh, this happens all the time. It's like, well, I hope not, because what happened here is you, you had a data breach, which is awful, and then what you did is you covered it up and then you lied to senior management and your employees and your investors. That, I hope that doesn't happen all the time. So I think this sent a good message to everyone to think twice before they do something outside the bounds of the law and then to do the right thing, like what you said. And then if something bad is happening, you have those whistleblower mechanisms in place that protects the individual who's trying to do the right thing And they're not just protecting themselves, they're protecting the company and they're protecting our citizens, our community, 'cause that's who we invest, those are our customers, right? Exactly. So I think that's important. We have, you know, like if there's a data breach, you know, fix it, right? That's your job as a CISO and work with the team. Don't try to hide it.

Great insights. Thank you so much for sharing all the research you've done and sharing your expertise here. Really appreciate it. Thank you very much. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Kevin here to dive into the most relevant and interesting cybersecurity challenges, perspectives, and industry best practices. Thank you much. We'll see you next time.