Blog | Security Law

Did Crowdstrike cause GDPR personal data breaches?

Stewart Room

Jul 289 min read

Did Crowdstrike cause GDPR personal data breaches?

As the dust starts to settle on the Crowdstrike incident, the focus of concern naturally moves on from the immediate incident response...

SEC Cybersecurity Rule 2023 - new transparency rules for corporate governance and incident response

Stewart Room

Nov 21, 20233 min read

SEC

SEC Cybersecurity Rule 2023 - new transparency rules for corporate governance and incident response

The SEC regulates the securities markets in the US, the biggest and most powerful economy on Earth. Surely, therefore, the SEC is one of...

Ransoms and CISOs - charting the best course through treacherous waters

Stewart Room

Nov 19, 20235 min read

Ransomware

Ransoms and CISOs - charting the best course through treacherous waters

If you pick up any analyst report about cyber risks, you will be told about the increasing and evolving nature of ransom attacks. A while...

NCSC Annual Review - maintaining resilience in an evolving threat landscape

Stewart Room

Nov 15, 20232 min read

Government

NCSC Annual Review - maintaining resilience in an evolving threat landscape

The UK National Cyber Security Centre published its latest annual review earlier this week. If you're ever looking for an organisation...

Important new case alert! A security breach doesn’t require a circumvention of security controls

Stewart Room

Nov 8, 20232 min read

ICO

Important new case alert! A security breach doesn’t require a circumvention of security controls

If someone says "security breach", what do you think? Is this a situation where a rogue actor (say a cybercriminal) or a rogue thing (say...

Bad tech design increases the digital divide. D&I implications for cybersecurity

Stewart Room

Nov 7, 20232 min read

Human factors

Bad tech design increases the digital divide. D&I implications for cybersecurity

Touch screen devices are great. From a design perspective they get rid of the mechanical buttons that are riddled with wear-and-tear...

Is Cybersecurity a line or a circle? The shape impacts the quality of incident incident response

Stewart Room

Nov 6, 20231 min read

Incident response

Is Cybersecurity a line or a circle? The shape impacts the quality of incident incident response

The operational shape of cybersecurity in an organisation is critical to its success and legal health. In light of recent developments such

SolarWinds is a cybersecurity game changer

Stewart Room

Nov 2, 20231 min read

Fines and penalties

SolarWinds is a cybersecurity game changer

SEC sure SolarWinds and CISO for cybersecurity fraud and controls failings

Biden's AI agenda and the cybersecurity issues and risks

Stewart Room

Oct 31, 20236 min read

Biden's AI agenda and the cybersecurity issues and risks

President Biden’s expansive Executive Order on AI is the latest act in the global jockeying for the leadership position in this area. It...

Stewart Room

Oct 31, 20234 min read

Legislation

Key legislation. The Communications Act

The security duties for providers of public electronic communications networks and services

Okta breach raises critical concerns about due diligence and accountability

Stewart Room

Oct 27, 20235 min read

Cybersecurity breach

Okta breach raises critical concerns about due diligence and accountability

Otka breach impacts authentication in cyberspace, raising due diligence and accountability concerns.

The cybersecurity ecosystem's raggedy regulatory blanket

Stewart Room

Oct 26, 20233 min read

Philosophy

The cybersecurity ecosystem's raggedy regulatory blanket

The regulatory system for the cybersecurity ecosystem

Where do we find the detail of security law? Part 4.

Stewart Room

Oct 25, 20234 min read

Philosophy

Where do we find the detail of security law? Part 4.

Operational security builds upon the CIA triad and accidental hazards need controlling as well as malicious and negligent threats.

Key legislation. The Computer Misuse Act

Stewart Room

Oct 24, 20234 min read

Legislation

Key legislation. The Computer Misuse Act

The Computer Misuse Act is the UK's principal "anti-hacking" legislation. Learn more about cyber-dependent and cyber-enabled computer crimes

Cryptography is the cyberspace’s Higgs Boson. Part 2., Hashes.

Stewart Room

Oct 21, 20233 min read

Cryptography

Cryptography is the cyberspace’s Higgs Boson. Part 2., Hashes.

We've explored how cryptography can be used to achieve confidentiality through encryption, so let's turn to data integrity. Integrity is...

Where do we find the detail of security law? Part 3.

Stewart Room

Oct 20, 20233 min read

Philosophy

Where do we find the detail of security law? Part 3.

The detail of security law is found within operational security itself, due to the twinning of the subjects, as explained in Part 1 and...

Cryptography is the cyberspace's Higgs Boson. Part 1., Encryption.

Stewart Room

Oct 19, 20234 min read

Cryptography

Cryptography is the cyberspace's Higgs Boson. Part 1., Encryption.

Symmetric and Public Key encryption for data confidentiality

Equifax fine highlights supply chain and incident response risks

Stewart Room

Oct 18, 20236 min read

Supply chain

Equifax fine highlights supply chain and incident response risks

Supply chain risks and incident response priorities exposed by Equifax cybersecurity data breach fine.

Is multi factor authentication compulsory in law?

Stewart Room

Oct 17, 20233 min read

Controls

Is multi factor authentication compulsory in law?

Two factor and multi factor authentication needed for added security and legal compliance

Key legislation. The General Data Protection Regulation

Stewart Room

Oct 17, 20235 min read

Legislation

Key legislation. The General Data Protection Regulation

The GDPR is a critical piece of security law requiring end to end security over the full personal data processing lifecycle

Data breach claims are successful in the US, so what's this GDPR "gold standard" all about then?

Stewart Room

Oct 13, 20234 min read

Philosophy

Data breach claims are successful in the US, so what's this GDPR "gold standard" all about then?

The GDPR is meant to be a global gold standard for data protection but compensation is unlikely after a security breach.

Incident response priorities need multiple lenses and trade-offs

Stewart Room

Oct 13, 20233 min read

Incident response

Incident response priorities need multiple lenses and trade-offs

When a cybersecurity breach occurs, operational security law will require an appropriate incident response and the priorities can be...

Cybercrime growth is unstoppable and these are the reasons why ...

Stewart Room

Oct 12, 20235 min read

Philosophy

Cybercrime growth is unstoppable and these are the reasons why ...

Cybercrime is constantly growing and evolving and the advantage is with the attacker. Better security hygiene reduces the risk of being hit.

Stewart Room

Oct 10, 20236 min read

Litigation

Litigation risk after a cyber-attack

If an organisation falls victim to a cyber-attack where the cybercriminal manages to impact information that the organisation holds on...