{"id":3767,"date":"2024-05-28T09:00:00","date_gmt":"2024-05-28T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/secs-new-take-on-cybersecurity-risk-management"},"modified":"2024-05-28T09:00:00","modified_gmt":"2024-05-28T14:00:00","slug":"the-secs-new-take-on-cybersecurity-risk-management","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/05\/28\/the-secs-new-take-on-cybersecurity-risk-management\/","title":{"rendered":"The SEC’s New Take on Cybersecurity Risk Management"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

COMMENTARY<\/span><\/span><\/p>\n

The advent of generative <\/span>AI is surfacing new risks<\/a><\/span>, significantly raising the stakes for businesses around the globe and for marketplace stability. In reaction to the logarithmic growth of cybercrime, the <\/span>guidance<\/a><\/span> and <\/span>regulatory<\/a><\/span> landscape is changing rapidly. While historically, the United States preferred frameworks over regulation, in 2023 there was a significant regulatory development: the <\/span>introduction of new cybersecurity rules<\/a><\/span> by the Securities and Exchange Commission (SEC). <\/span>These rules for publicly traded companies<\/a><\/span> focus on cybersecurity risk management, governance, and incident disclosure. Designed to enhance investor protection and market transparency, the SEC seeks to ensure timely and effective communication of events that affect the financial health or stability of publicly traded companies.<\/span><\/p>\n

Under the new disclosure rules, registrants <\/span>must report within four days<\/a><\/span> any cybersecurity incident <\/span>they<\/span><\/span> have determined to have a “material impact,” meaning it could significantly affect the company’s operations or finances. Companies must therefore swiftly assess the nature and scope of the incident, including the type and volume of compromised data and the potential business, legal, or regulatory impacts.  <\/span><\/p>\n

As companies grapple with these new regulations, there are already important insights to be gleaned from the experiences of several major entities that have reported breaches and made disclosures. Here are three:<\/span><\/p>\n

Clorox<\/h2>\n

In August 2023, Clorox <\/span>experienced a severe cyberattack<\/a><\/span> affecting the company’s automated order processing. This incident caused widespread disruption, resulting in delays in processing orders and <\/span>significant product shortages<\/a><\/span>, which adversely affected sales and earnings. By the end of 2023, Clorox incurred <\/span>$49 million in costs<\/a><\/span> due to the cyberattack, including losses from operational disruptions and payments to third parties enlisted to assist with the investigation and remediation. Its chief information security officer (CISO) was also <\/span>no longer working for the company<\/a><\/span>. Recent reports suggest that security audits had <\/span>flagged issues for years<\/a><\/span>. Clorox <\/span>projected in its 8-K SEC filing<\/a><\/span> that the attack’s financial impact would continue into fiscal year 2024. The company anticipates incurring additional costs ranging from $50 million to $60 million, related to the ongoing effects of the incident.<\/span><\/p>\n

Prudential Financial<\/h2>\n

In February 2024, Prudential Financial <\/span>reported a breach<\/a><\/span>, though it came out largely intact. <\/span>Prudential also adhered to SEC rules in its disclosures<\/a><\/span>, but the company sought to get ahead by voluntarily reporting the incident <\/span>before a material impact was determined<\/a><\/span>. In its filings with the SEC, Prudential disclosed detecting unauthorized access to its infrastructure on Feb. 5. This breach involved “administrative and user data from certain IT systems” and impacted what the company said were a small percentage of employee and contractor accounts. The intrusion, which has since been attributed to the ALPHV ransomware gang, exposed the names, addresses, and personal identifiable information (PII) of <\/span>36,545 individuals<\/a><\/span>. Prudential’s decision to file proactively with the SEC may signal a new trend toward disclosure prior to ascertaining materiality, with <\/span>another filing after materiality is determined<\/a><\/span>.<\/span><\/p>\n

UnitedHealth<\/h2>\n

Most recently, UnitedHealth suffered a massive attack against its subsidiary Change Healthcare that breached millions of patients’ records and brought prescription fulfillment and claims processing to a standstill. UnitedHealth <\/span>disclosed the attack<\/a><\/span> <\/a><\/span>on Feb. 21, and initially attributed it to a nation state, without determining materiality or specifying how many people were affected. UnitedHealth reported it was focused on restoring operations. Theincident severely impacted doctors and healthcare facilities that serve millions of Americans, including an estimated 30 million disadvantaged and uninsured people. The company did not disclose if the attackers demanded a ransom. But a post in an online hacker forum <\/span>claimed UnitedHealth paid $22 million<\/a><\/span> to regain access to its systems. UnitedHealth <\/span>has since filed an amendment<\/a><\/span> to its initial 8-K. Today, the company <\/span>faces at least 24 lawsuits<\/a><\/span> and extensive financial repercussions. UnitedHealth announced recently that it anticipates the cyberattack on Change Healthcare could cost the company as much as $1.6 billion, which <\/span>some analysts argue is an understatement<\/a><\/span>. Since revealing the attack, UnitedHealth’s stock price has dropped nearly 15%.<\/span><\/p>\n

Lessons Learned<\/h2>\n

Each of the above cases offer guidance for further study. However, three early lessons are now on display for enterprise risk management:<\/span><\/p>\n

\n
    \n
  1. \n
    <\/span><\/p>\n
    \n

    You can’t disclose what you can\u2019t see.<\/span><\/span> Yet, willful blindness is not a working defense, as companies must now explain the details of breaches. That means companies should have continuous visibility into all their digital assets, prioritize handling misconfigurations, and address findings from security audits. Executives must have command over their digital estate and would benefit from using <\/span>adversarial and disclosure thinking<\/a><\/span>.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  2. \n
    <\/span><\/p>\n
    \n

    It’s critical to <\/span><\/span>maintain transparency and do the basics right<\/a><\/span>.<\/span><\/span> Companies are always concerned about making inaccurate assessments. However, adopting conservative and proactive policy and technological measures can help mitigate many concerns. In particular, companies should be ready to revise disclosures with greater detail as available.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  3. \n
    <\/span><\/p>\n
    \n

    Prioritize sharing.<\/span><\/span> Information sharing has proven its <\/span>value for all sectors<\/a><\/span>. The global marketplace benefits from exchanging insights on breaches and successful strategies. This exchange not only enhances security practices but also fosters a collaborative environment that accelerates the adoption of best practices, to the benefit of all in the fight against cybercrime.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    COMMENTARY The advent of generative AI is surfacing new risks, significantly<\/p>\n","protected":false},"author":12,"featured_media":3768,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-3767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=1814%2C1024&ssl=1",1814,1024,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=640%2C362&ssl=1",640,362,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=640%2C361&ssl=1",640,361,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=1536%2C867&ssl=1",1536,867,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=1814%2C1024&ssl=1",1814,1024,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=1024%2C578&ssl=1",1024,578,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/the-secs-new-take-on-cybersecurity-risk-management.jpg?fit=1814%2C1024&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=3767"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3767\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/3768"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=3767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=3767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=3767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}