Cybersecurity

An organization's cybersecurity outlook may depend on whether you are sitting in the corporate legal department or at the IT desk. Legal staffing and e-discovery solutions provider Special Counsel released its Data Breach Response survey earlier this month in conjunction with Relativity, and responses indicate that attorneys and IT professionals may see their organization's cyber risk very differently.

For example, when asked how prepared their organization was to deal with a data breach, 87% of the 250 corporate IT decision makers surveyed said their companies were either "very prepared" or "extremely prepared." However, 78% of the 150 corporate attorneys surveyed said the same thing.

Aaron Duncan, vice president of discovery services at Special Counsel, believes that the disconnect likely comes down to a lack of collaboration between the legal and IT departments. While IT departments may have faith that people are deploying proper cyber hygiene, lawyers could have a more cynical view, perhaps having seen that many of their colleagues on the ground don't always observe the best security practices even if they claim to do so.

So who's right? "I think it's closer to the legal professionals in that they see more of the reality of the situation instead of just the numbers," Duncan said.

The time it takes to identify and recover from a breach, for instance, may be one area where IT departments are possibly being overly optimistic. Per the survey, 86% of IT respondents said it would take their organization less than three days to detect and respond to a data breach. Meanwhile, 63% of attorneys said it would take their organizations longer than a business week to do the same.

Duncan attributed the disparity to yet another case of expectation versus reality. IT professionals assume that the information governance plans they lay out are being followed, which would in turn lower the response time needed. However, the survey lists the average time to identify a breach in 2019 at 206 days, with the average containment rate at 73 days, which would suggest that many organizations could still be struggling with information governance.

"Until the corporations out there—companies small to large to giant—really get a handle on their information governance and make that a priority, we're not going to see a drop [in response times]," Duncan said.

Attorneys and IT professionals also differed when asked what they believed the cost per exposed record was following a data breach. Lawyers went big, with 75% of attorneys surveyed putting the cost at $50 per record, a big difference from the 74% of IT professionals who placed the expense between $.50 and $25 per record.

Attorneys may be closest in their estimate, at least based on Special Counsel data quoted in the report that lists the U.S. average at $242 per lost record. It's possible that IT professionals may not be taking into account some of the long-term legal fallout from a breach that are typically the domain of lawyers, such as forensic investigations or breach notification laws and procedures.

The key to bridging that knowledge gap between IT and legal may require more companies to take another look at staff, possibly adding a chief information security officer (CISO) to the roster who can be in charge of dispersing regular updates and reminders from the IT department to the rest of the office. "I think these regular type of awareness trainings, whether quarterly or even potentially monthly, is something that just takes 20 [or] 30 minutes but could be extremely valuable," Duncan said.