Jake Olcott. (Courtesy photo)

The slow pace of federal legislative action on cybersecurity issues is motivating many current and former government officials to look to the private sector for help. Just ask Jake Olcott, former legal and cybersecurity adviser to the U.S. Senate Commerce Committee and the House of Representatives Homeland Security Committee.

Olcott, who worked in Congress for seven years, recently became vice president at Bitsight Technologies, a cybersecurity company creating cybersecurity ratings akin to consumer credit scores. To gather data on hundreds of thousands of organizations across dozens of industries, the company intercepts and analyzes messages malware programs send to their creators once they have successfully infiltrated a network.

Through its analysis, Bitsight found that law firms had a rating of around 690, the second highest of all the industries the company considered.

Much of this high score, Olcott noted, was due to the fact that law firms were the most likely to keep their technology up to date, regularly check to see if their systems were compromised, and use up-to-date operating systems which have less chance of being infiltrated. But legal did lag in one area: The industry was among the least likely to use web browser encryption.

For Olcott, this type of quantifiable rating is as valuable to promoting cybersecurity in the U.S. economy as was his work in Congress. Olcott spoke with Legaltech News to discuss the findings of his company's research, why he made the move over to the private sector, and what issues he handled while working in Congress.

LTN: According to Bitsight, law firms are the most highly protected businesses behind financial companies. But successful cyberattacks against legal continue. How do you account for this?

Olcott: We are looking at over 100,000 companies across 35 different sectors, and what we're seeing here is that the legal sector is actually the second-highest performer from a quantitative perspective, using all the different [security] measurements we can use. This is very surprising to people, because there is this perception that law firms have been doing so poorly for some time.

But the sector, as a whole, seems to have really gotten that message about needing to improve their security posture or run the risk of losing their customer base. So I think we are starting to see the fruition of cybersecurity initiatives and efforts that law firms are putting into place. But just because the sector as a whole is performing highly doesn't meant that all law firms are performing highly. Certainly, we see various levels of performance based on individual firms.

Why do you believe law firms are lagging behind in browser-level encryption?

I actually have to admit I'm uncertain of the answer. It could be attributed to the general lack of e-commerce that is conducted on law firms' web platforms. E-commerce is a reason why many organizations themselves feel the need to implement stronger [browser-level] encryption. But that's just pure speculation. The interesting thing is that we have no idea what the underlying reasons are for what we see. We just know that we see them, and it could be a variety of different issues at play here.

Why did you leave the public sector to become VP of Bitsight?

I think what I realized during my time in Congress is that the innovation, and really quite frankly the policy development that I spent so much time working on, was really taking place in the private sector. And if you care about cybersecurity and if you wanted to improve global cybersecurity, which is truly a mission I believe passionately about, the best way of doing that was in the private sector.

Over the years I started to develop some thoughts about what we really needed to see from a technology perspective in order to address some of the nation's cybersecurity issues. And I came to conclusions that the thing we really needed was a rating system. A rating system would really help allow the market and market participants judge each other based on cybersecurity as opposed to having the government put out new regulatory requirements and things like that.

What happened for me was that I learned that there was a company out there that was actually doing this cybersecurity rating, and I felt like I had to do everything I could to work with them to make that a reality.

What did you work on during your time as an adviser to Senate and House committees?

I was helping with bills, legislative negotiations, hearings, investigations, and then a lot of it was sort of maintaining awareness in the private sector. That meant having a lot of meetings with innovative companies, and helping companies secure their own networks.

It also meant meeting with other departments such as the Department of Homeland Security (DHS) and the broader intelligence community to understand the threats that were out there and to advise on national policy.

What was the most complex or challenging issue you faced?

I spent a lot of time working on electric grid cybersecurity issues, and that basically meant a review of current regulations and standards in that area and whether those regulations and standards were adequate to protect the electric grid from cyberattack.

I also ran an investigation with the [U.S.] Securities and Exchange Commission (SEC) on the adequacy of cybersecurity disclosures to investors and that resulted in issuing guidance in 2011 to advise companies about their disclosure obligations. That has of course become such a huge issue in recent years, including in recent leaks, when you think of the Equifax breach and how they notified, or some may perceive as failed to adequately notify, investors about their breach.

Jake Olcott. (Courtesy photo)

The slow pace of federal legislative action on cybersecurity issues is motivating many current and former government officials to look to the private sector for help. Just ask Jake Olcott, former legal and cybersecurity adviser to the U.S. Senate Commerce Committee and the House of Representatives Homeland Security Committee.

Olcott, who worked in Congress for seven years, recently became vice president at Bitsight Technologies, a cybersecurity company creating cybersecurity ratings akin to consumer credit scores. To gather data on hundreds of thousands of organizations across dozens of industries, the company intercepts and analyzes messages malware programs send to their creators once they have successfully infiltrated a network.

Through its analysis, Bitsight found that law firms had a rating of around 690, the second highest of all the industries the company considered.

Much of this high score, Olcott noted, was due to the fact that law firms were the most likely to keep their technology up to date, regularly check to see if their systems were compromised, and use up-to-date operating systems which have less chance of being infiltrated. But legal did lag in one area: The industry was among the least likely to use web browser encryption.

For Olcott, this type of quantifiable rating is as valuable to promoting cybersecurity in the U.S. economy as was his work in Congress. Olcott spoke with Legaltech News to discuss the findings of his company's research, why he made the move over to the private sector, and what issues he handled while working in Congress.

LTN: According to Bitsight, law firms are the most highly protected businesses behind financial companies. But successful cyberattacks against legal continue. How do you account for this?

Olcott: We are looking at over 100,000 companies across 35 different sectors, and what we're seeing here is that the legal sector is actually the second-highest performer from a quantitative perspective, using all the different [security] measurements we can use. This is very surprising to people, because there is this perception that law firms have been doing so poorly for some time.

But the sector, as a whole, seems to have really gotten that message about needing to improve their security posture or run the risk of losing their customer base. So I think we are starting to see the fruition of cybersecurity initiatives and efforts that law firms are putting into place. But just because the sector as a whole is performing highly doesn't meant that all law firms are performing highly. Certainly, we see various levels of performance based on individual firms.

Why do you believe law firms are lagging behind in browser-level encryption?

I actually have to admit I'm uncertain of the answer. It could be attributed to the general lack of e-commerce that is conducted on law firms' web platforms. E-commerce is a reason why many organizations themselves feel the need to implement stronger [browser-level] encryption. But that's just pure speculation. The interesting thing is that we have no idea what the underlying reasons are for what we see. We just know that we see them, and it could be a variety of different issues at play here.

Why did you leave the public sector to become VP of Bitsight?

I think what I realized during my time in Congress is that the innovation, and really quite frankly the policy development that I spent so much time working on, was really taking place in the private sector. And if you care about cybersecurity and if you wanted to improve global cybersecurity, which is truly a mission I believe passionately about, the best way of doing that was in the private sector.

Over the years I started to develop some thoughts about what we really needed to see from a technology perspective in order to address some of the nation's cybersecurity issues. And I came to conclusions that the thing we really needed was a rating system. A rating system would really help allow the market and market participants judge each other based on cybersecurity as opposed to having the government put out new regulatory requirements and things like that.

What happened for me was that I learned that there was a company out there that was actually doing this cybersecurity rating, and I felt like I had to do everything I could to work with them to make that a reality.

What did you work on during your time as an adviser to Senate and House committees?

I was helping with bills, legislative negotiations, hearings, investigations, and then a lot of it was sort of maintaining awareness in the private sector. That meant having a lot of meetings with innovative companies, and helping companies secure their own networks.

It also meant meeting with other departments such as the Department of Homeland Security (DHS) and the broader intelligence community to understand the threats that were out there and to advise on national policy.

What was the most complex or challenging issue you faced?

I spent a lot of time working on electric grid cybersecurity issues, and that basically meant a review of current regulations and standards in that area and whether those regulations and standards were adequate to protect the electric grid from cyberattack.

I also ran an investigation with the [U.S.] Securities and Exchange Commission (SEC) on the adequacy of cybersecurity disclosures to investors and that resulted in issuing guidance in 2011 to advise companies about their disclosure obligations. That has of course become such a huge issue in recent years, including in recent leaks, when you think of the Equifax breach and how they notified, or some may perceive as failed to adequately notify, investors about their breach.