In this episode of CHATTINN CYBER, Marc Schein interviews Jennifer Coughlin, Founding Partner at Mullen Coughlin, a law firm exclusively dedicated to representing organizations facing data privacy events and information security incidents and the need to address these risks before a crisis hits. Jennifer focuses her practice solely on providing organizations of all sizes and from every industry sector with first-party breach response and third-party privacy defense legal services. The second part of the conversation talks about regulatory compliance, investigations and movements, cyber insurance, how to mitigate cyber risks, especially those due to ransomware attacks, and the present and future cyber threats.

On the regulatory front, many new laws and guidelines on cybersecurity are being proposed; regulatory investigations, too, are picking up well. Data shows that while over 30 movements happened in 2021, so far in 2022, 20 have occurred. These indicate:

1. Increased reliance upon data and information systems
   
2. A recognition of the impact of losing access to data and information systems
   
3. Uncertainty around what businesses are doing with the massive amounts of data collected
   
4. Consumers’ recognition of data privacy
   
5. Victim organizations have a ton of data that could help in the fight against cybercrime.
   

Cyber insurance companies are helping organizations reduce the uncertainty due to cyber risks by setting up a vetted procedure and providing the necessary education to respond to data privacy incidents. With an evolved cyber insurance underwriting, companies can have increased safeguards, better implementation, and response to cyber incidents.

How can your company mitigate cyber incidents? Conduct a data-mapping exercise, considering carefully the data you have on your system, the access controls, cost, loss in the case of security violations, and testing around that. Next, consider Multi-Factor Authentication – it’s a necessity in any company. Mullen Coughlin has a 3-2-1 plan indicative of their practice of keeping 3 backups in 2 different locations, 1 of which is offline.

Before dealing with ransomware attacks, companies need to take the time to understand their contracts, obligations, and responsibilities, so they’re aware of the laws that apply in the case of a cyber incident. Being aware of the timelines and laws could help faster implement the necessary cybersecurity controls and practices.

Additionally, training the employees properly about healthy cyber practices is essential. There needs to be proper learning and reinforcement of cybersecurity practices in organizations.

Towards the close of the episode, Jennifer shares that cybersecurity incidents are not predicted to decrease in a coming couple of years. Job security in the industry appears strong.

Listen to the conversation for more details!

Highlights:

“All these movements (around cybersecurity laws) are indicative of their recognition that victim organizations have a ton of data that would be really helpful in the fight against cybercrime. And they’re not getting their hands on that. So under all of these movements, they’re talking about sharing more information with them. So that when these laws are crafted, when these government meetings are happening, they have additional information that can be really helpful to the conversation.”

“The cyber insurer has already figured out the call you make to set into motion, to ring the bell that is going to set into motion everything that needs to be done to efficiently and compliantly respond to these data privacy incidents; they’ve identified the resources that are needed to do so, they vetted these resources that are needed to do so.”

“Vulnerabilities are being identified all the time, you’ve got zero day exploits being identified, you need to make sure you have a patch management program so that you’re monitoring for patches issued for vulnerabilities, assessing whether or not those patches need to be applied to your system and making sure those patches are being applied to your system. ”

Time-Stamps:

[00:45] – What’s going on in the regulatory front of cybersecurity?

[03:34] – Insight into the plaintiff’s bar

[10:59] – Reducing or mitigating a potential cybersecurity incident

[20:49] – Cyber risk prediction for 2022-23

Connect with Jennifer:

Website: https://www.linkedin.com/in/jennifer-coughlin-59b81425/