Cybersecurity has been a mainstay of quarterly board agendas for years. Massive cyberattacks on several federal agencies, reported earlier this month, will trigger granular questions about companies' reliance on network management software made by SolarWinds Corp. — the suspected Trojan horse for the attacks.¹

This news follows a seemingly endless parade of reports of hacks of consumer, patient and employee data — as well as of advice about shoring up cybersecurity defenses in-house and across supply chains, responding to ransomware demands, handling disclosures of such hacks with customers and employees, and complying with various regulatory changes concerning data management around the globe.

Directors must seek and consider all of that advice in exercising their fiduciary duties. But, inspired by the current documentary "The Perfect Weapon," corporate directors also should ask more fundamental, conceptual cybersecurity questions in boardrooms this coming quarter.

"The Perfect Weapon" started as a December 2016 article in the New York Times about the notorious hack of Democratic National Committee server,² and became a 2018 book with the same title written by the Times' national security correspondent David Sanger.³ The documentary, based on Sanger's book, focuses on various cyberattacks, including one in 2014 targeting Las Vegas Sands Corp., an integrated resort company.

In the documentary, two former employees of Las Vegas Sands, dramatically silhouetted and with voices distorted, describe their perspective on perhaps one of the first nation-state cyberattack on a U.S. business. Once the attack had been discovered, neither actually knew what had happened or how.

Sands met the attack with a decisive, unconventional response. Sands was able to rebuild its infrastructure without losing all of its critical employee or customer data because of a bold decision to actually pull the plug. That's right: Sands disconnected its information technology infrastructure not only from the web but from the power grid, interrupting the attempted exfiltration and parallel data destruction.

Player data — oxygen to gaming regulators and casino customers — was not at risk because it also resided in a separate analog system, impervious to digital Trojan horses. That analog system allowed Sands to consider a response that cut off the intruders from the digital system and allowed a complete and clean rebuild. That experience may not be an option for most firms but it provides a conceptual basis for inquiry.

We appreciate the supreme convenience of the digital economy and the interdependence of businesses' information technology systems, both in complex networks with external business partners as well as sprawling integration among internal business functions. The digital economy compels many businesses to continue operating significant parts of their work online.

And many companies have continued to work productively during the pandemic because of the sophistication and breadth of their online resources. But our dependence on digital databases and interconnectivity demands consideration of all strategic defense options.⁴

We thus recommend that this quarter's cybersecurity agenda return to a fundamental question: Should U.S. corporations disaggregate data — preserving some data online, segmenting other data in more restricted, less restricted, less integrated sources — not only to comply with more aggressive privacy regimes, but to reduce the risk of a cyberattack?

Consider the following, common areas of corporate conduct in which aggregated information creates privacy and cyberhack risk.

Human Resources

In most large companies, the human resources department aggregates data through automated hiring, onboarding, training and benefits programs. But does your company's HR function really need online access to all personally identifiable information? After onboarding, an individual employee's disclosures are usually relevant only concerning potential misrepresentations about credentials or employment history.

Compliance certifications — e.g., participation in online training, onboarding and policy updates — and disciplinary records also could be separate from omnibus employee files. Boards and senior management can discuss salary parity and insurance utilization with sufficient data about job functions, productivity and compensation but without PII. Tailored segregation of employee PII, moreover, could also assist multinational companies in complying with increasingly complex privacy regimes around the world.

Customer Data

Upon collecting and safeguarding customers' most sensitive PII — credit card numbers, passports, etc. — who within the company actually needs to access that data? In many companies, marketing personnel conceive of how to sell customers more or how they might sell information about those customers to other business to pitch their products and services.

Customer data is an important resource to inform these strategies. But what is the necessary minimum of customer data that must be online and who really needs access to it? Should some or all of customers' most sensitive data be part of a separate, closed-loop, password-protected system that could, for instance, ensure legal review of any marketing effort to monetize that data in potential violation of privacy regimes abroad and, increasingly, in the U.S.?

Research and Development

Any business that invents and develops valuable know-how — virtually every large business — has policies to protect various forms of intellectual property; allocates rights of ownership; and typically uses technological keys to protect the intellectual property itself and those rights. 

Research and development is, moreover, a collaborative process that requires some measure of connectivity. But that connectivity should be narrow. Any system storing that information linked to the web poses inordinate risk of data exfiltration. How does your firm balance the need for connectivity and collaboration with minimizing that risk? What R&D department work stations must be online — and can any be offline?

The C-Suite

Some cyberattacks seek competitive intelligence, which can put the C-suite in hackers' crosshairs. Yet there are other, more practical reasons to consider whether C-suite personnel should be integrated seamlessly into a corporations' online networks.

As editors David Shipley and Will Schwalbe warned in their email etiquette book "Send," email is spreadable, searchable and savable. Email is also informal, often imprecise, and sometimes exchanged impulsively. Connecting C-suite personnel to a companywide system can increase the likelihood of miscommunication reaching a much larger audience than intended, both internally and externally.

No matter the level of communications training given about the care and time all of us should invest in drafting communications and in deciding whether to click "send," it is worth asking whether the C-suite should be connected to a corporate wide system at all. In closed-loop communications among core executive functions, the C-suite can develop policy and then access a second system for broader communications. The strategic property developed at the top stays at the top until ready for dissemination.

Unplugging is the most blunt option to avert a hack. It is an option that many companies, in this overwhelmingly digital age, could apply only selectively and with increased costs and complexity. 

But as the costs of online operations mount — defending class action claims for data hacks and leaks, complying with intricate privacy regulations, investing in software patches and expert advice — it may be worth asking questions about segmenting and shrinking a firm's networks and creating or preserving strategic data redundancies. Such cyberattack defenses and investments may be as critical as conventional approaches that firms must continue to apply to thwart the next, inevitable, cyberattack.

This article was first published on Law360 on January 6, 2021.

_{1 See, e.g., David E. Sanger, "Russian Hackers Broke Into Federal Agencies, U.S. Officials Suspect," N.Y. Times(Dec.13, 2020; updated Dec. 18, 2020), https://www.nytimes.com/2020/12/13/us/politics/russian-hackers-us-government-treasury-commerce.html.
2 Eric Lipton, David E. Sanger, & Scott Shane, "The Perfect Weapon: How Russian Cyberpower Invaded the U.S.,"N.Y. Times (Dec. 13, 2016), https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html.
3 David E. Sanger, The Perfect Weapon: War, Sabotage and Fear in the Cyber Age (2018).
4 See, e.g. https://www.whitecase.com/publications/insight/cybersecurity-legal-implications-and-risk-management}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2021 White & Case LLP}