Incident Response as a Lawyers’ Service

Abstract

Thousands of incidents each year are now managed by external law firms. Victim firms call a hotline and delegate incident response to external counsel without a pre-existing relationship. We assemble preliminary evidence on how this model breaks from conventional incident response and outline questions for future research.

Bridging the cyber protection gap: An investigation into the efficacy of the German cyber insurance market

“…Due to the long existence of cyber insurance and a greater density of research, the US market is a suitable benchmark. The results from the paper of Romanosky et al (2019), Woods and Böhme (2021), and Wolff and Lehr (2018) are used as a reference for the US market. The comparison is intended to identify the major similarities and differences between the two cyber insurance markets,…”

A Turning Point for Cyber Insurance

“…Cyber insurance exerts considerable influence over how policyholders investigate incidents [7]. Insurers use their market power to drive down the cost of investigations leading to wider use of automated scripts [10]. This motivates research into automated forensics to prevent automation coming at the cost of quality.…”

“…This motivates research into automated forensics to prevent automation coming at the cost of quality. Further, insurers in the US appoint lawyers at the top of the incident response hierarchy in order to cloak the investigation in attorney-client privilege [10]. The associated legal strategies help prevent investigatory findings (e.g.…”

“…that the policyholder flaunted basic security procedures) being used by litigants in court cases, but the same strategies also function to distort the documentary record about the cause of security incidents. This may have made sense when the biggest driver of costs was data breach litigation, but not when "litigation rates are around 1% while ransomware payments grew 1000% yearon-year" [10]. Insurers should reflect on who leads incident response, and default to appointing technical leads unless litigation is a very realistic outcome.…”

The government behind insurance governance: Lessons for ransomware

“…Moreover, because of the threat of civil liability for violating privacy regulation, companies are cloaking details of cybercrimes, their responses, and the conditions that created the opportunity for the crime under attorney client privilege and work product immunity. This inhibits government and other efforts to aggregate information about and learn from cyberattacks (Woods & Böhme, 2021).…”