Hacked Opinions: The legalities of hacking – Pritesh Parekh
Hacked Opinions is an ongoing series of Q&As with industry leaders and experts on a number of topics that impact the security community. The first set of discussions focused on disclosure and how pending regulation could impact it. Now, this second set of discussions will examine security research, security legislation, and the difficult decision of taking researchers to court.
CSO encourages everyone to take part in the Hacked Opinions series. If you would like to participate, email Steve Ragan with your answers to the questions presented in this Q&A. The deadline is October 31, 2015. In addition, feel free to suggest topics for future consideration.
What do you think is the biggest misconception lawmakers have when it comes to cybersecurity
Pritesh Parekh, CISO, Zuora (PP): One misconception lawmakers have is they believe that they do not need to understand the technologies used by private industry to set the cybersecurity laws and policies. They enact laws without understanding how companies use various technologies. One example is the Cybersecurity Legislative Proposal initiated by the White House.
The proposed changes could make accessing public documents related to hacks and hacker tools illegal, limiting security researchers’ ability to analyze, protect and determine the extent of attacks. These types of laws may make hacking more difficult, but they tie the hands of security researchers.
What advice would you give to lawmakers considering legislation that would impact security research or development
PP: Lawmakers need to involve industry security experts at the ground level during the proposal drafting phase.
This allows lawmakers to gain an understanding of how it impacts organizations, how to focus the intent of the law and avoid impacting unintended targets; how to implement efficient and effective enforcement of the law; and how to ensure the law solves the problem it set out to solve while minimizing collateral damage. There needs to be open and transparent two-way communication between the government and the public.
If you could add one line to existing or pending legislation, with a focus on research, hacking, or other related security topic, what would it be
PP: Any legislation should make sure not to hinder the messenger. In this case, the messenger is security researchers who are attempting to make systems more secure by pointing out security flaws. The motives and methods are critical elements of consideration, and should be incorporated into the legislation.
Now, given what you've said, why is this one line so important to you
PP: Without allowing research, analysis and and an open discussion about security issues, the industry is "flying blind" while hackers continue to have access to this information. Without public access to the information, it will become much more difficult to protect critical assets while making it easier for hackers to compromise these assets.
Do you think a company should resort to legal threats or intimidation to prevent a researcher from giving a talk or publishing their work Why, or why not
PP: No, there should not be a legal threat against security professionals to present, publish or do security research as long as (1) security researchers give full disclosure to the organization that is impacted; (2) they work with them to minimize the damage; and (3) they allow the organization time to adequately address the issues.
The goal is to share the research and encourage security researchers to make our connected world a safer place.
What types of data (attack data, threat intelligence, etc.) should organizations be sharing with the government What should the government be sharing with the rest of us
PP: As long as government agencies act in the interest of the private industry and do not violate the confidentiality obligations of the agency, they should work with the private sector to share threat intelligence.
Such information should be shared in a fashion that does not pose a threat to the government agency, national security and does not have adverse business impacts for the organization. This allows all parties involved to understand the attack characteristics (sources, payload, etc.), threat patterns and risk profile, and be better prepared to respond in the future.