We open up our 2016 year interviewing Shawn Tuma on the show. Shawn is our legal eagle, and a regular contributor to the podcast. This episode ran a little bit long (OK a lot long) but I think you'll enjoy the show... 

In this episode...

• Most important cybersecurity-related legal developments of 2015
  • Tectonic Shift that occurred with “standing” in consumer data breach claims
    • Discussion of law prior to Neiman Marcus case, and post Neiman Marcus
    • Does this now apply to all consumer data breach cases?
    • Immediate impact? Companies now liable?
    • Lesson is in seeing the trend and how incrementalism works
• Regulatory Trends
  • FTC & SEC gave hints in 2014, post-emergence of Target details
  • Wyndham challenged authority – came to fruition in August 2015
  • SEC not far behind – significant case in September 2015
  • Aggressiveness of FTC is substantial – FTC v. LabMD … all over LimeWire
• Officer & Director Liability
  • 2014 – SEC Comm. fired the warning shot … pointed the finger
  • Shareholder derivative litigation
  • Individual liability of IT / Compliance / Privacy “officers”
• Major 2016 Legal Trends
  • Regulatory enforcement … which, by the way, is why NIST is becoming default
  • Shareholder Derivative – much more likely than consumer class actions at this time
  • Lessons from both of these: when you need to persuade the “money folks” that they need to act, mention D&O Liability (especially Caremark) and Regulatory focus on individuals … now they're in the cross-hairs
  • Realization that cybersecurity is more of a legal issue than anything else (IT or business) b/c it is the legal requirements and consequences that ultimately drive everything

In this episode...

Juniper has a backdoor problem

• 2 separate issues, auth bypass & VPN weakness
• backdoor discovered in Juniper devices
• lots of speculation on who put it there, but it was meant to be disguised as ‘debug code’
• enterprise implications - same as before (what's the bigger picture?)
• https://isc.sans.edu/forums/diary/Infocon+Yellow+Juniper+Backdoor+CVE20157755+and+CVE20157756/20521/

Iranians broke into New York dam in 2013 and “had a look around”

• no direct damage done
• US has largest number of ICS connected to Internet
• critical infrastructure is vulnerable, being probed
• this is not a ‘government problem’ - every company has some ICS on their network
• http://www.theregister.co.uk/2015/12/21/iranian_hackers_target_new_york_dam/

Facebook announced it’s dumping Adobe Flash

• is this a bigger deal than it sounds like
• HTML5 has its own vulnerabilities and issues though… right?
• *only* for videos, games still in Flash
• Facebook will work with Adobe (really?) to improve security of Flash
• http://www.scmagazine.com/facebook-ditches-flash-videos-to-boost-security/article/461040/

191 Million US voter records found ‘unprotected’ by a researcher

• guy from Texas found the data on an unprotected database
• “Vickery told Databreaches.net he was able to poke around the public-internet-facing database because it is poorly configured: no authentication or password is required to query all 300-plus gigabytes stored within.” ← What the hell?
• legailty and ethics … again … but that aside is this REALLY an issue?
• same person who discovered Hello Kitty leak.. interesting.
• http://www.csoonline.com/article/3017171/security/database-leak-exposes-3-3-million-hello-kitty-fans.html
• http://www.theregister.co.uk/2015/12/28/security_researcher_spots_191_millionrecord_us_voter_database_online/

PayPal rolls out the welcome mat for hackers

• even if you have an OTP key fob, attackers can get into your account
• apparently they use static identifier info, cannot be changed
• this should probably trouble you
• http://boingboing.net/2016/01/03/paypal-rolls-out-the-welcome-m.html

PCI Council extends encryption deadline

• good thing, bad thing, or something else?
• http://www.bankinfosecurity.com/interviews/pci-council-extends-encryption-deadline-i-3019