In the face of rapid technology changes, the Department of Justice usually has to play catch up.  When cryptocurrency and blockchain entered the United States economy, the Justice Department played catch up.  Fraudsters and other criminals innovate and embrace new technologies to prey on victims.  The Justice Department usually catches up but there is often a lag as “innovative” criminals gain certain market advantages.  DOJ...

A Top 5 list should be viewed with suspicion — it is often just a headline grabbing posting with the clear purpose to gain readers’ attention.  In defense, however, it is interesting to compare articles on risk rankings.  To start with the obvious, corporate boards face growing risks — the economy, the regulatory environment, cybersecurity threats, technology developments  and stakeholder interests are all colliding and...

The U.S. Securities and Exchange Commission has a message for publicly-traded companies that suffer a data breach: own up. On Monday, the SEC sued Texas-based SolarWinds––and its Chief Information Security Officer (“CISO”)––for defrauding investors by allegedly failing to disclose known security risks in public filings. This marks the SEC’s first ever enforcement action against an individual corporate officer over their mishandling of a data breach––but...

The New York Department of Financial Services (“DFS”) has proposed rule changes to increase cyber compliance requirements. DFS has been the leading regulatory force in the cybersecurity industry.  DFS first issued comprehensive cybersecurity rules in March 2017.  Many other regulators and international organizations have adopted many of these regulations as best practices for cybersecurity requirements. The proposed rules would impose some significant requirements, including: Expansion...

Sometimes it takes a public event to remind corporate risk managers about the importance of effective risk management.  While corporate risk management functions have become yet another “hot” topic or new-fangled response to corporate failures to prevent obvious risk, most organizations continue to wander in the world of reactive business planning rather than proactive prevention.  It has been fairly obvious for years that most corporate...

Corporate boards face exponentially escalating risks – at the heart of this development is the rapid escalation of board member accountability.  Board members are no longer operating in a sinecure, free from legal risks.  The walls are changing. A perfect example of the changing landscape of risk is the importance of cybersecurity oversight and protections.  The criminal cyberattack against the Colonial pipeline and the acknowledge...

The SolarWinds cyber-attack was devastating in scope and impact. If any lesson can be learned from this event, the SolarWinds case presents all the pitfalls, enforcement and reputational damage, rolled into one tragic series of events. In a recent 10-K disclosure, SolarWinds announced that it is the subject of ongoing investigations conducted by the Department of Justice, the Securities and Exchange Commission, and various state...