6 ms·

SEC now requires companies to disclose cyberattacks in 4 days

64 points by jdjdjdhhd 3y ago

CSMastermind 3y ago
I'm in favor of mandating disclosure. I wish they hadn't limited it to the vague 'has material impact' definition. Under that rule if a company is being DDOSed constantly but their network is successfully mitigated against it presumably they wouldn't need to disclose it. But it would be in the general good of the public to be able to track these events, what their source is, etc. At least this is a step in the right direction.
- clipsy 3y ago
  On some level I'm inclined to agree, but there is a point to be made here that sufficiently large targets are attacked virtually 24/7 and reporting all of those may result in burying legitimate threats in the noise.
  - seeknotfind 3y ago
    Even a silly blog I linked on HN a couple of times has gotten attacked 24/7 for a couple years. I still get requests with log4j injection attacks. Pretty sure any IPv4 address and any registered domain will get attacked regularly, especially if it's hosting something - anything. Heck, I pinged every IPv4 addresses in 2012.
    - atkailash 3y ago
      [dead]
- kjs3 3y ago
  Why would I need to disclose an attack that did nothing? I work at a financial, and someone, somewhere, is trying to DDoS us all the time. Should we be publishing "yup, same as yesterday, people are trying to put us off line" every single day? And I have worked in several other DDoS attracting industries (European sports betting? OMFG so much DDoS). What is the "general good of the public to be able to track" when it is literally happening all the time? Next you'll want us to provide reporting on port scanning.
  - nubinetwork 3y ago
    > Next you'll want us to provide reporting on port scanning. Yeah I'll get right on that. You can read the database yourself. ;-)
- jdjdjdhhd 3y ago
  Not sure why you would need to report DDoSs anyways...
- halJordan 3y ago
  Material impact is the same guidance for non-cyber incidents. So it seems well established. The alternative would be a govt list of incidents and you would be complaining that we need a less brittle way of disclosure because the list is always 5 yrs behind. It isnt the SECs job to track that data. Its the SECs job to ensure companies are not lying to the point they're defrauding their owners. Take the complaint to the correct agency and let this one do its job.
oxygen_crisis 3y ago
The cynic in me says this will incentivize execs to avoid starting the clock: SRE: It looks like someone might be exfiltrating data from our network. CISO: I doubt that. Look into it on Monday. SRE: Today is Tuesday... CISO: Look into it on Monday, we've got more important things to worry about. If you'll excuse me, I need to call some old frat-mates about their trading portfolios.
- toomuchtodo 3y ago
  This will be looked upon poorly during discovery in the eventual securities fraud litigation. And good god don't try to trade on this info, the SEC has a data team specifically looking for this signal. https://www.velaw.com/insights/2021-was-a-mixed-year-for-the-secs-division-of-enforcement-but-all-signs-point-to-increased-enforcement-activity-in-2022/ https://www.velaw.com/insights/2021-was-a-mixed-year-for-the... https://www.velaw.com/insights/utilizing-data-analytics-sec-harnesses-the-power-to-unveil-insider-trading-patterns-and-prioritizes-egregious-cases/ https://www.velaw.com/insights/utilizing-data-analytics-sec-...
nubinetwork 3y ago
See also https://news.ycombinator.com/item?id=36881061 https://news.ycombinator.com/item?id=36881061 https://news.ycombinator.com/item?id=36881188 https://news.ycombinator.com/item?id=36881188
_8j50 3y ago
This isn't as good of a thing as you think. Instead of focusing on finding out the scope of the compromise and making sure the threat actors are contained and can't easily compromise again, incident responders will ger pressures to focus on answering questions about who gets notified. They should be given enough time to thoroughly respond to it and then notify everyone that needs notifying. Having to dedicate resources to scour through compromised data for pii instead of for forensic evidence before you even contain/eradicate a threat only helps threat actors. The public does not benefit from bad or inefficient incident response. I am sure HN crowd will get that this isn't something you can just throw manpower/bodycount at either to get a faster response. It takes as long as it has to take.
- jkaplowitz 3y ago
  > This isn't as good of a thing as you think. Instead of focusing on finding out the scope of the compromise and making sure the threat actors are contained and can't easily compromise again, incident responders will ger pressures to focus on answering questions about who gets notified. Huh? These new SEC rules are about 100% public notifications in 100% public SEC filings, unlike many state data breach laws. If a bit of information falls within the new SEC rules, literally anyone in the world who wants to look at the company's SEC filings gets to see the notification. Nothing about this requires scouring through compromised data for pii before fixing the problem, because who gets notified under this rule does not depend on who was affected - the notification recipient is the whole world. > They should be given enough time to thoroughly respond to it [...] It takes as long as it has to take. Indeed, and the actual SEC rule is much more in line with what you're saying than the very misleading headline of this article. The actual rule requires them to notify (via public SEC filing) within four business days of determining that the cybersecurity incident is material, and that they must make the materiality determination without unreasonable delay after the incident. (There are other exceptions for e.g. delays warranted for national security reasons.) So, if somehow it takes 5 business days after incident discovery to realize it's material because initial investigations which were not unreasonably delayed genuinely make it appear to be a tiny incident, and then a much larger impact is eventually determined, notifying within 9 business days of discovering the incident complies with this rule. The article title is also misleading in other ways: aside from the difference between 4 business days and 4 calendar days, it's not true that the SEC "now requires" anything new. The rule won't have any effect before mid-December 2023, and some bits won't apply to smaller companies before mid-2024. A much more accurate press release from the SEC, previously discussed on HN yesterday: https://www.sec.gov/news/press-release/2023-139 https://www.sec.gov/news/press-release/2023-139
Stephenbrina 3y ago
[dead]
Dracophoenix 3y ago
It seems that "cyberattack" will eventually replace "hacking" as the go-to word for every computer problem faced by a C-Suite sexagenarian.

64 points by jdjdjdhhd 3y ago

I'm in favor of mandating disclosure. I wish they hadn't limited it to the vague 'has material impact' definition. Under that rule if a company is being DDOSed constantly but their network is successfully mitigated against it presumably they wouldn't need to disclose it. But it would be in the general good of the public to be able to track these events, what their source is, etc. At least this is a step in the right direction.

clipsy 3y ago
On some level I'm inclined to agree, but there is a point to be made here that sufficiently large targets are attacked virtually 24/7 and reporting all of those may result in burying legitimate threats in the noise.
- seeknotfind 3y ago
  Even a silly blog I linked on HN a couple of times has gotten attacked 24/7 for a couple years. I still get requests with log4j injection attacks. Pretty sure any IPv4 address and any registered domain will get attacked regularly, especially if it's hosting something - anything. Heck, I pinged every IPv4 addresses in 2012.
  - atkailash 3y ago
    [dead]
kjs3 3y ago
Why would I need to disclose an attack that did nothing? I work at a financial, and someone, somewhere, is trying to DDoS us all the time. Should we be publishing "yup, same as yesterday, people are trying to put us off line" every single day? And I have worked in several other DDoS attracting industries (European sports betting? OMFG so much DDoS). What is the "general good of the public to be able to track" when it is literally happening all the time? Next you'll want us to provide reporting on port scanning.
- nubinetwork 3y ago
  > Next you'll want us to provide reporting on port scanning. Yeah I'll get right on that. You can read the database yourself. ;-)
jdjdjdhhd 3y ago
Not sure why you would need to report DDoSs anyways...
halJordan 3y ago
Material impact is the same guidance for non-cyber incidents. So it seems well established. The alternative would be a govt list of incidents and you would be complaining that we need a less brittle way of disclosure because the list is always 5 yrs behind. It isnt the SECs job to track that data. Its the SECs job to ensure companies are not lying to the point they're defrauding their owners. Take the complaint to the correct agency and let this one do its job.

oxygen_crisis 3y ago

The cynic in me says this will incentivize execs to avoid starting the clock: SRE: It looks like someone might be exfiltrating data from our network. CISO: I doubt that. Look into it on Monday. SRE: Today is Tuesday... CISO: Look into it on Monday, we've got more important things to worry about. If you'll excuse me, I need to call some old frat-mates about their trading portfolios.

toomuchtodo 3y ago
This will be looked upon poorly during discovery in the eventual securities fraud litigation. And good god don't try to trade on this info, the SEC has a data team specifically looking for this signal. https://www.velaw.com/insights/2021-was-a-mixed-year-for-the-secs-division-of-enforcement-but-all-signs-point-to-increased-enforcement-activity-in-2022/ https://www.velaw.com/insights/2021-was-a-mixed-year-for-the... https://www.velaw.com/insights/utilizing-data-analytics-sec-harnesses-the-power-to-unveil-insider-trading-patterns-and-prioritizes-egregious-cases/ https://www.velaw.com/insights/utilizing-data-analytics-sec-...

nubinetwork 3y ago

See also https://news.ycombinator.com/item?id=36881061 https://news.ycombinator.com/item?id=36881061 https://news.ycombinator.com/item?id=36881188 https://news.ycombinator.com/item?id=36881188

_8j50 3y ago

This isn't as good of a thing as you think. Instead of focusing on finding out the scope of the compromise and making sure the threat actors are contained and can't easily compromise again, incident responders will ger pressures to focus on answering questions about who gets notified. They should be given enough time to thoroughly respond to it and then notify everyone that needs notifying. Having to dedicate resources to scour through compromised data for pii instead of for forensic evidence before you even contain/eradicate a threat only helps threat actors. The public does not benefit from bad or inefficient incident response. I am sure HN crowd will get that this isn't something you can just throw manpower/bodycount at either to get a faster response. It takes as long as it has to take.

jkaplowitz 3y ago
> This isn't as good of a thing as you think. Instead of focusing on finding out the scope of the compromise and making sure the threat actors are contained and can't easily compromise again, incident responders will ger pressures to focus on answering questions about who gets notified. Huh? These new SEC rules are about 100% public notifications in 100% public SEC filings, unlike many state data breach laws. If a bit of information falls within the new SEC rules, literally anyone in the world who wants to look at the company's SEC filings gets to see the notification. Nothing about this requires scouring through compromised data for pii before fixing the problem, because who gets notified under this rule does not depend on who was affected - the notification recipient is the whole world. > They should be given enough time to thoroughly respond to it [...] It takes as long as it has to take. Indeed, and the actual SEC rule is much more in line with what you're saying than the very misleading headline of this article. The actual rule requires them to notify (via public SEC filing) within four business days of determining that the cybersecurity incident is material, and that they must make the materiality determination without unreasonable delay after the incident. (There are other exceptions for e.g. delays warranted for national security reasons.) So, if somehow it takes 5 business days after incident discovery to realize it's material because initial investigations which were not unreasonably delayed genuinely make it appear to be a tiny incident, and then a much larger impact is eventually determined, notifying within 9 business days of discovering the incident complies with this rule. The article title is also misleading in other ways: aside from the difference between 4 business days and 4 calendar days, it's not true that the SEC "now requires" anything new. The rule won't have any effect before mid-December 2023, and some bits won't apply to smaller companies before mid-2024. A much more accurate press release from the SEC, previously discussed on HN yesterday: https://www.sec.gov/news/press-release/2023-139 https://www.sec.gov/news/press-release/2023-139

Stephenbrina 3y ago

[dead]

Dracophoenix 3y ago

It seems that "cyberattack" will eventually replace "hacking" as the go-to word for every computer problem faced by a C-Suite sexagenarian.