All Articles

 Welcome to today’s webinar on the CESA platform. We're exploring the legal and professional implications of the SEC's enforcement action against SolarWinds and its CISO, Timothy Brown. This discussion has ignited significant debate within the cybersecurity community, splitting professionals into opposing camps. Our expert speakers, Matthew Rosenquist, Jim Ralph, and Michael Rees, will provide insights into the complexities of this case and its broader impact on the industry.

Here is the verbatim discussion:

Question though qu or clarification on that because you said something that that that kind of raised the hair on on the back of my neck here you said it goes through legal and they're responsible now every law every lawyer corporate lawyer I've talked to has said no we advise we don't take responsibility the content is still yours you're still making the Declaration we will advise you but we don't own it are you saying for the companies you worked for the attorneys were the responsible parties or were they simply a pass through to advise um and and maybe you know make recommendations prior to it being released what I'm saying is that the corporate policies clearly defined the responsibility for when to uh uh offer information to a regulator and uh and to vet that information that goes to a regulator uh so the legal departments control the process and were accountable now look they were accountable for the process not necessarily for the content so they weren't the ones signing off on the accuracy and legitimacy of the content they were overseeing process getting it from the company to the regulator correct they're also determining when to share information with the regulator like the notification so a ciso independently can't say I'm going to notify law enforcement I'm going to notify a regulator of a particular security incident that is not in the that's you know in at least in my experience that's not uh what the ciso has is accountable for the ciso is accountable for bringing that information to the legal uh organization and there were very frequent times where I aiso said I think we need to tell a regulator and this is what I think we need to tell them but that was always vetted and edited by the legal department the legal department SEC for those who don't know is an independent federal administrative agency with the mission of protecting investers and their rights and that includes making sure there is not unfair Market manipulations this is part of their role in Mission and we're going to be talking about the complaint that the SEC has published now the full 68 page complaint is available on their website and it provides details on all the different claims especially going to be a new president um you know Jim mentioned the whole Uber case with Joe Sullivan that was a a fact that they said hey we're going to hit you with a three-year probation and there's their statement that were made is we're going to go after and we're going to do harsher penalties in the future and so I think this is a chance for the sec to step up and say now we're going to implement those harsher punishments and we're really going after solar winds and and Timothy Brown on this um I I think we need to be careful and not just what I'm going to call check the boxes when we're doing our security um questionnaires that Sig that we always have to fill out everybody just kind of goes through the motions and says yeah we're doing this we're doing this if you start looking at what the SEC filing is out it it really looks like hey people were just checking boxes and saying hey we're doing this and they're really not doing it so it we're going to have to start really walking the the walk and you know saying what we're doing and showing that we're really doing and it's no longer just a verbal yeah we did that we checked the Box um it it's more than that it's really coming down to that GC governance risk and compliance questionnaire and being really truthful about it because you're going to be liable and it's nothing new it just you know this one kind of went a little wild and the SEC is trying to make an example out of him and I think we're gonna have to be careful because it could could go either way and it could really hurt us as Tios or it can give us a better foothold and really be able to go and say we need these extra tools we need this extra money and really get it.