14

I need to make a real motivation for a security talk to a board of management.

I know that in case a company ships products ignoring (so knowing and on purpose not caring) then it is held liable. What I heard as well is that the CEO is the one made accountable.

Now, I am wondering if anyone had read or is aware of a real life example?

2
  • 4
    Not really an answer to your question, but for your talk you might be interested to browse (if you haven't already) lumension.com/… .
    – LSerni
    Feb 1, 2013 at 10:42
  • 1
    This also might not be an answer, but it's good to learn a lesson. There was an incident in Finland where an IT consulting company had to pay 160 000 euros to settle a case that included IT security negligence.
    – Adi
    Feb 1, 2013 at 16:38

2 Answers 2

14

Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for damages caused by actions or inactions of the company or its agents.

As such, you're probably not going to convince the executive team, or the board of directors, or even middle management that they would bear any general liability for a breach of security. To do this, you would have to prove specific intent to harm; that an executive saw a name on a list of customers, didn't like that person or company, and wanted to hurt them, which in turn led to their deliberate decision not to fix a known security flaw. This is next to impossible; you can show all the evidence you want, but even if you have a recording of the CEO saying they wanted to harm this person's interests, you cannot prove that a CEO's decision to fix or not fix a flaw was motivated by this; it's all circumstantial (though a recording would go a pretty long way towards "preponderance of evidence").

There are, however, some instances where specific people can be held liable independently from the company. My wife, for instance, works with healthcare records. If she ever told anyone, even me, any specifics of that data, and that became public, it's her tail on the line for the HIPAA violation, even if her boss told her it was OK or even ordered her to divulge the information. I work for an alarm monitoring company; our alarm center agents, if they make the wrong mistake (even in good faith), can be held liable independently from the company for damages and wrongful death. Unfortunately, it happens. But, this liability does not extend to anyone who was not aware of the events at the time, so you're going to have a very hard time proving that an action by an agent on the lowest rung of the corporate ladder implicates the CEO.

Where you can hurt an executive is where it matters most; their wallet. Executives typically own a significant stake in their own companies, which forms a relatively large chunk of their net worth. The company is their shield, but it's also their livelihood, and it will take a beating if a security flaw in their systems is found, exploited, and subsequently makes it into the press. Corporations cannot go to jail, but they can be fined and sued to "death", and the executives lose all the money they had in corporate stocks and options.

Want proof that companies have gone bankrupt over security breaches? DigiNotar, a Dutch company that was a globally-trusted SSL/TLS certificate authority, was hacked in July 2011 and apparently again in late August of that year. Several fraudulent certificates were created using DigiNotar's systems, identifying the certificate holder as being the valid domain of major sites like Google, Yahoo, Mozilla, WordPress and the TOR Project. Those certificates were subsequently used in MITM attacks and other hilarity. DigiNotar did not know how many certificates were issued (the tally quickly reached the hundreds; we now know that 531 fraudulent certificates were created in this attack) and so could not guarantee they had all been revoked. So, Microsoft and most of the major browser manufacturers responded by simply revoking trust in DigiNotar's own trusted root certificate in the Windows OS and major browsers. Apple's response was delayed, but it did also update OSX/Safari to revoke DigiNotar's root certificate.

In addition, DigiNotar was responsible for one of the intermediate CAs used in the security system of the Dutch Government. That certificate was also believed to be compromised and was revoked by many browser manufacturers, and in the ensuing hilarity of real government websites losing trust (imagine browsing to the IRS website and being told by your browser that the site may be fraudulent; THAT's a screenshot I'd pay money for, and it happened to the Dutch counterpart Tax and Customs Administration), the Dutch Government stepped in on September 3, took control of DigiNotar's certificate operations, transitioned all government websites off of DigiNotar-rooted certificates to ones signed by uncompromised CAs, and issued a statement saying that DigiNotar would no longer issue government SSL certificates. DigiNotar filed for bankruptcy the same day.

2
  • thanks! but this actually is almost stop the fairy tale that CEOs go to jail, it is rather they went bankrupted! So it is the company liable not the head of the company... So if the head don't prioritize correctly the company has to work double shift while not being paid double to develop securely -- life is unfair ;-)
    – user20259
    Feb 2, 2013 at 10:50
  • 3
    Unfortunately, yes. The CEO's job, even the CTO's, does not include knowing every last detail of the inner workings of his operation. The analogy is like driving a car; you don't have to know the exact specifications of any car you get behind the wheel of in order to drive it. By the same token, in the U.S. at least, if something breaks on a car that's been regularly maintained, you're not liable; if anyone is, it's your mechanic, who should know every detail and is responsible, provided you let him, for keeping the car in good order.
    – KeithS
    Feb 4, 2013 at 15:43
1

Almost there. The fallout from the News International "phone hacking" case is going to produce prosecutions. There is an interesting case where during the investigation; a lot of the evidence was rapidly deleted. Whether any of the convictions result in jail time, we don't know.

Watch this space.

2
  • While true, that situation is less about having a security flaw and more about using it. Having, knowing about and not fixing a security flaw that results in a theft is a civil liability. Using a security flaw to commit that theft yourself is a criminal offense. The NotW hackers didn't expose the security flaw; they exploited it.
    – KeithS
    Feb 1, 2013 at 17:25
  • I was more referring to the actions taken by staff during the investigation rather than the phone hacking itself. When staff realised they were being prosecuted they went on the rampage deleting evidence... not a perfect example but it's the closest I can think of. Feb 4, 2013 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .