Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Infrastructure

Understanding Global Differences in Data Breach Laws Critical to Incident Response

San Francisco — RSA Conference 2015 — Examine the Ponemon Institute’s ‘2014 Cost of Data Breach Study’ and it becomes clear there is a vast difference in the costs of dealing with a data breach in different parts of the world.

San Francisco — RSA Conference 2015 — Examine the Ponemon Institute’s ‘2014 Cost of Data Breach Study’ and it becomes clear there is a vast difference in the costs of dealing with a data breach in different parts of the world.

According to the report, one of the main factors affecting cost differences comes down to the severity of the various data breach laws and regulations in each country and how well those rules are enforced.

This reality makes it critical for businesses to understand the laws in the various geographies they operate in. At the RSA conference, a panel of experts explained Thursday that ignorance of data breach laws can drive up costs and potentially open a business up to penalties that make the bad news of a data breach even worse.

“We are facing a three-headed monster,” Larry Clinton, president and chief executive officer of the Internet Security Alliance, told the crowd. “The system is getting inherently weaker, attacks are getting…more sophisticated, and we are being faced with an explosion of new regulations.”

And more regulations seem to be always on the way. For example, earlier this year the NY State Attorney General proposed a plan to toughen the state’s data breach laws. There is also the ongoing controversy about the proposed federal Data Security and Breach Notification Act. 

But the situation can be even more complicated for businesses that are international in scope. Panelist Gene Fredriksen, chief information security officer at PSCU, recalled an incident at a company where a salesperson was laid-off following some merger and acquisition activity and responded by stealing proprietary information – including client lists. While uncovering the perpetrator was not difficult, he said, problems emerged when the situation was discovered to have impacted Germany, Spain, France and the U.K. as opposed to just the United States where executives felt they would have known what to do.

The executives were forced to rope in the legal staff to figure out how to handle the situation, which ultimately became a “laborious process,” he said.

James Halpert, a partner at international law firm DLA Piper and co-chair of its U.S. cyber-security practice, noted that different countries require different approaches. South Korea, for example, requires data notification up to “wazoo,” he said.

Advertisement. Scroll to continue reading.

Studies have shown that moving too quickly in the aftermath of a breach can drive up costs, with organizations for example notifying too many people by mistake. Then there are the costs associated with fines and other expenses. 

“You want to know this if you going about running your incident response,” said Halpert. “You want to know what information has been lost and does that trigger a notice in these countries.”

Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Security Infrastructure

Security vendor consolidation is picking up steam with good reason. Everyone wants to improve security efficiency and effectiveness while paying for less.

Management & Strategy

Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Cloud Security

The term ‘zero trust’ is now used so much and so widely that it has almost lost its meaning.

Security Infrastructure

Instead of deploying new point products, CISOs should consider sourcing technologies from vendors that develop products designed to work together as part of a...

Security Infrastructure

Comcast jumps into the enterprise cybersecurity business, betting that its internal security tools and inventions can find traction in an expanding marketplace.

Audits

The PCI Security Standards Council (SSC), the organization that oversees the Payment Card Industry Data Security Standard (PCI DSS), this week announced the release...

Security Infrastructure

XDR's fully loaded value to threat detection, investigation and response will only be realized when it is viewed as an architecture