Sherri Davidoff is a cybersecurity expert, author, speaker, and CEO of both LMG Security and BrightWise, Inc. She is a recognized expert in digital forensics and cybersecurity, and is coauthor of Network Forensics: Tracking Hackers Through Cyberspace (Prentice Hall, 2012). Sherri has consulted and/or conducted cybersecurity training for many distinguished organizations, including the Department of Defense, the American Bar Association, FFIEC/FDIC, and many more. She is a faculty member at the Pacific Coast Banking School, and is a frequent contributor of education articles and webinars. She is a GIAC-certified forensic examiner (GCFA) and penetration tester (GPEN), and holds a degree in computer science and electrical engineering from MIT.

Select Guide Rating

• Preface xviiAcknowledgments xxiiiAbout the Author xxv Chapter 1: Dark Matters 1 1.1 Dark Breaches 3 1.2 Skewed Statistics 13 1.3 Why Report? 18 1.4 What’s Left Unsaid 20 Chapter 2: Hazardous Material 23 2.1 Data Is the New Oil 30 2.2 The Five Data Breach Risk Factors 33 2.3 The Demand for Data 34 2.4 Anonymization and Renonymization 41 2.5 Follow the Data 44 2.6 Reducing Risk 51 2.7 Conclusion 54 Chapter 3: Crisis Management 55 3.1 Crisis and Opportunity 57 3.2 Crisis Communications, or Communications Crisis? 60 3.3 Equifax 70 3.4 Conclusion 75 Chapter 4: Managing DRAMA 77 4.1 The Birth of Data Breaches 79 4.2 A Smoldering Crisis 81 4.3 Prodromal Phase 85 4.4 Acute Phase 94 4.5 Reducing Harm 98 4.6 Chronic Phase 108 4.7 Resolution Phase 111 4.8 Before a Breach 114 4.9 Conclusion 117 Chapter 5: Stolen Data 119 5.1 Leveraging Breached Data 121 5.2 Fraud 121 5.3 Sale 123 5.4 The Goods 135 5.5 Conclusion 141 Chapter 6: Payment Card Breaches 143 6.1 The Greatest Payment Card Scam of All 144 6.2 Impact of a Breach 146 6.3 Placing Blame 150 6.4 Self-Regulation 153 6.5 TJX Breach 160 6.6 The Heartland Breach 167 6.7 PCI and Data Breach Investigations 171 6.8 Conclusion 174 Chapter 7: Retailgeddon 177 7.1 Accident Analysis 179 7.2 An Ounce of Prevention 191 7.3 Target’s Response 199 7.4 Ripple Effects 223 7.5 Chip and Scam 227 7.6 Legislation and Standards 236 7.7 Conclusion 237 Chapter 8: Supply Chain Risks 239 8.1 Service Provider Access 242 8.2 Technology Supply-Chain Risks 245 8.3 Cyber Arsenals 252 8.4 Conclusion 254 Chapter 9: Health Data Breaches 257 9.1 The Public vs. the Patient 258 9.2 Bulls-Eye on Healthcare 260 9.3 HIPAA: Momentous and Flawed 263 9.4 Escape from HIPAA 274 9.5 Health Breach Epidemic 279 9.6 After a Breach 295 9.7 Conclusion 300 Chapter 10: Exposure and Weaponization 303 10.1 Exposure Breaches 305 10.2 Response 310 10.3 MegaLeaks 323 10.4 Conclusion 336 Chapter 11: Extortion 337 11.1 Epidemic 339 11.2 Denial Extortion 340 11.3 Exposure Extortion 348 11.4 Faux Extortion 356 11.5 Conclusion 357 Chapter 12: Cyber Insurance 359 12.1 Growth of Cyber Insurance 361 12.2 Industry Challenges 361 12.3 Types of Coverage 362 12.4 Commercial Off-the-Shelf Breach Response 364 12.5 How to Pick the Right Cyber Insurance 367 12.6 Leverage Your Cyber Insurance 386 12.7 Conclusion 388 Chapter 13: Cloud Breaches 389 13.1 Risks of the Cloud 393 13.2 Visibility 400 13.3 Intercepted 409 13.4 Conclusion 413 Afterword 415 Index 417

Sherri Davidoff is a cybersecurity expert, author, speaker, and CEO of both LMG Security and BrightWise, Inc. She is a recognized expert in digital forensics and cybersecurity, and is coauthor of Network Forensics: Tracking Hackers Through Cyberspace (Prentice Hall, 2012). Sherri has consulted and/or conducted cybersecurity training for many distinguished organizations, including the Department of Defense, the American Bar Association, FFIEC/FDIC, and many more. She is a faculty member at the Pacific Coast Banking School, and is a frequent contributor of education articles and webinars. She is a GIAC-certified forensic examiner (GCFA) and penetration tester (GPEN), and holds a degree in computer science and electrical engineering from MIT.

Select Guide Rating

• Preface xviiAcknowledgments xxiiiAbout the Author xxv Chapter 1: Dark Matters 1 1.1 Dark Breaches 3 1.2 Skewed Statistics 13 1.3 Why Report? 18 1.4 What’s Left Unsaid 20 Chapter 2: Hazardous Material 23 2.1 Data Is the New Oil 30 2.2 The Five Data Breach Risk Factors 33 2.3 The Demand for Data 34 2.4 Anonymization and Renonymization 41 2.5 Follow the Data 44 2.6 Reducing Risk 51 2.7 Conclusion 54 Chapter 3: Crisis Management 55 3.1 Crisis and Opportunity 57 3.2 Crisis Communications, or Communications Crisis? 60 3.3 Equifax 70 3.4 Conclusion 75 Chapter 4: Managing DRAMA 77 4.1 The Birth of Data Breaches 79 4.2 A Smoldering Crisis 81 4.3 Prodromal Phase 85 4.4 Acute Phase 94 4.5 Reducing Harm 98 4.6 Chronic Phase 108 4.7 Resolution Phase 111 4.8 Before a Breach 114 4.9 Conclusion 117 Chapter 5: Stolen Data 119 5.1 Leveraging Breached Data 121 5.2 Fraud 121 5.3 Sale 123 5.4 The Goods 135 5.5 Conclusion 141 Chapter 6: Payment Card Breaches 143 6.1 The Greatest Payment Card Scam of All 144 6.2 Impact of a Breach 146 6.3 Placing Blame 150 6.4 Self-Regulation 153 6.5 TJX Breach 160 6.6 The Heartland Breach 167 6.7 PCI and Data Breach Investigations 171 6.8 Conclusion 174 Chapter 7: Retailgeddon 177 7.1 Accident Analysis 179 7.2 An Ounce of Prevention 191 7.3 Target’s Response 199 7.4 Ripple Effects 223 7.5 Chip and Scam 227 7.6 Legislation and Standards 236 7.7 Conclusion 237 Chapter 8: Supply Chain Risks 239 8.1 Service Provider Access 242 8.2 Technology Supply-Chain Risks 245 8.3 Cyber Arsenals 252 8.4 Conclusion 254 Chapter 9: Health Data Breaches 257 9.1 The Public vs. the Patient 258 9.2 Bulls-Eye on Healthcare 260 9.3 HIPAA: Momentous and Flawed 263 9.4 Escape from HIPAA 274 9.5 Health Breach Epidemic 279 9.6 After a Breach 295 9.7 Conclusion 300 Chapter 10: Exposure and Weaponization 303 10.1 Exposure Breaches 305 10.2 Response 310 10.3 MegaLeaks 323 10.4 Conclusion 336 Chapter 11: Extortion 337 11.1 Epidemic 339 11.2 Denial Extortion 340 11.3 Exposure Extortion 348 11.4 Faux Extortion 356 11.5 Conclusion 357 Chapter 12: Cyber Insurance 359 12.1 Growth of Cyber Insurance 361 12.2 Industry Challenges 361 12.3 Types of Coverage 362 12.4 Commercial Off-the-Shelf Breach Response 364 12.5 How to Pick the Right Cyber Insurance 367 12.6 Leverage Your Cyber Insurance 386 12.7 Conclusion 388 Chapter 13: Cloud Breaches 389 13.1 Risks of the Cloud 393 13.2 Visibility 400 13.3 Intercepted 409 13.4 Conclusion 413 Afterword 415 Index 417