New York, N.Y. (November 4, 2022) - Throughout October, our Data Privacy & Cybersecurity Team vice chairs helped raise awareness of cybersecurity issues with a series of posts defining key terms in their practice. Philadelphia Partner Richard Goldberg defined "phishing," Dallas Partner Lindsay Nickle defined "ransomware," New York Partner Sarah Rugnetta defined "incident response planning," New York Partner Allen Sattler defined "cyber insurance," and Denver Partner Alyssa Watzman defined "multi-factor authentication." You can see these posts below, and share them on LinkedIn.


Share this definition on LinkedIn.

"At its simplest, phishing is a crook's attempt to scam you out of information for the purpose of stealing from you and your business. The crook sends you a message, which appears to be from someone you know, or on a topic that interests you, in the hope that you will provide your account credentials or download malware. Examples are emails appearing to be from your IT department, or from someone who wants to share a document that requires you to click on a link. Once the crook has your creds, they're exploring your system to see how you move money and where you keep confidential information. The resulting harm may include grabbing incoming or outgoing payments and exposing sensitive company information.

While a lot of phishing is amateurish, some is very sophisticated. Phishing varieties include: Spear phishing (targeting particular people); Whaling (targeting organization leaders); Smishing (sending text or SMS messages); HTTP phishing (sending fragment messages with a link that sends recipients to a malicious website to investigate); and website spoofing (offers that send recipients to fake websites).

Lewis Brisbois' Data Privacy & Cybersecurity Practice assists clients with developing policies and procedures to protect their networks from phishing attacks. We work with companies to create and deliver employee training on preventing malicious actors from gaining access to their email. In the unfortunate event that a client's network is compromised, we lead all aspects of the incident response, including forensic investigations and remediation, as well as consumer and regulatory notifications."


Share this definition on LinkedIn.

"Ransomware is a form of malware used by malicious actors to encrypt files and systems in a network to render the victim's computer network unusable and shut down business operations. In connection with a ransomware attack, the malicious actor typically demands a ransom in exchange for a decryption tool or key that will let a business recover encrypted files. Many ransomware groups also conduct reconnaissance in the victim's information system prior to the attack and exfiltrate data that they then threaten to publish on the dark web as a secondary means of extortion. The malicious actor offers not to publish and delete the exfiltrated data in exchange for a ransom payment.

Ransomware is one of the major cyber threats businesses face today, and these attacks are becoming increasingly sophisticated. Because of the threat that ransomware threat actors will steal data as well as encrypt a victim's digital environment, it is important to understand that a ransomware attack presents not only severe monetary consequences, but also serious legal and compliance ramifications.

We assist clients every day with responding to ransomware attacks by facilitating investigations into attacks and assisting with the restoration and recovery of impacted digital environments. We also assist our clients with determining legal and compliance requirements as a result of an attack, including the assessment of potential legal, regulatory, and contractual notification obligations. Our team also specializes in helping our clients protect their systems from potential attacks by ensuring they have the necessary best practices in place to remediate potential damage in the event of an attack. We create policies and procedures for our clients' businesses, facilitate necessary updates to their systems, and designing and delivering employee awareness training."


Share this definition on LinkedIn.

"Incident response planning" refers to the process of designing procedures to be executed in the event of a cyber incident. First and foremost, incident response planning involves creating a written playbook that outlines how an organization will respond in the event of a data breach or security incident. The purpose of incident response planning is to minimize losses, reduce recovery time, restore systems, reduce negative publicity, mitigate risk, and comply with legal obligations. Maintaining and testing an incident response plan is critical, particularly for organizations that collect or process sensitive data, including biometrics, personally identifiable information, and protected health information. Often, organizations prepare different playbooks to account for various attack scenarios.

The attorneys in Lewis Brisbois' Data Privacy & Cybersecurity Practice work closely with clients on all aspects of incident response planning. Before designing a plan, it is important to assess applicable laws, existing procedures, and cyber preparedness. From there, we help clients address vulnerabilities and design procedures that work for them. We also conduct training sessions and facilitate tabletop exercises to test the plans in the context of a simulated incident. Moreover, our team has helped clients respond to thousands of incidents and we're prepared to assist clients the moment they learn they may be impacted by another cyber incident. We manage all aspects of the response, including facilitating forensics services, notifying consumers and the appropriate regulatory authorities, and handling any resulting litigation."


Share this definition on LinkedIn.

"Cyber insurance" can help protect organizations from losses associated with any data security or data privacy incident, such as a ransomware attack, business email compromise, social engineering attack, or litigation arising out of alleged violations of privacy laws. Cyber insurance policies vary in terms of what they cover and can be customized to fit a particular organization's needs. For example, cyber insurance may cover costs associated with notifying customers that a breach has occurred, costs associated with credit monitoring offered to notified customers, recovering compromised data, or repairing computer networks. In addition, some policies cover litigation costs, business interruption expenses, and regulatory fines.

Because the losses associated with a ransomware attack or other event can be potentially devastating for a company, maintaining adequate cyber insurance coverage is imperative. Cyber insurance not only provides financial peace of mind, but also increases the efficiency and efficacy of any response to an incident. The insurance carrier can connect the organization to the appropriate resources, including leading cybersecurity attorneys (also called "breach coaches"), digital forensic firms, PR firms, and other professionals.

Lewis Brisbois' Data Privacy & Cybersecurity Team manages all aspects of breach responses, and we work closely with our insurance partners to help navigate our clients through a breach response, ensuring the costs incurred in a breach are pre-approved by the carrier, if those costs fall within the scope of coverage afforded by the policy. However, the more our clients do prior to a breach, the better prepared they are when they experience that breach. To that end, Lewis Brisbois' attorneys provide a suite of proactive services for clients, such as advising on the type of cyber insurance that will best protect their businesses and connecting clients to professionals in the marketplace to procure that insurance."


Share this definition on LinkedIn.

"Multi-factor authentication," or MFA, is a layered approach to protecting a network's data. The process requires a user to provide two or more credentials to verify their identity and access their organization's network. For example, MFA may require an authorized user, such as a company employee, to provide both something they "know," such as a user name and password, with something they "have," such as a unique code sent to the employee's smart phone, or something they "are," such as a fingerprint or other biometric measurement, in order to gain access to accounts or databases.

Implementing MFA is one of the most effective ways to defend information systems. The secondary level of protection that MFA provides helps prevent malicious actors from hijacking accounts and data and using them for malicious purposes. That is, even if one user credential is compromised, malicious actors will still be unable to satisfy the second authentication requirement. Thus, they ultimately will not be able to access the network they are attempting to breach.

Members of Lewis Brisbois' Data Privacy and Cybersecurity Team advise clients each day as to how they may secure their networks and protect themselves from malicious actors. Working with clients to implement MFA is often part of this process. We believe that MFA is essential and should be deployed as part of an overall cybersecurity plan."

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.