Navigating the Murkiness: Strategies for Addressing Ambiguity in New Cyber Regulations

Regulatory Ambiguity and Cybersecurity Compliance: Navigating the Challenges

The Issue of Ambiguous Language in Cyber Regulations

In recent times, regulatory bodies at various levels of government have been increasing privacy and disclosure requirements, coupled with strict penalties. However, the ambiguous and vague language employed in these regulations has caused confusion and challenges for cybersecurity teams striving for compliance. The newly released guidelines by the Security and Exchange Commission (SEC) on cyber incident disclosure serve as a prime example of this problem.

Cybersecurity expert Adam Shostack, in an interview with Dark Reading, highlights how these rules are being widely misinterpreted. He underscores an important distinction, noting that the requirement for transparency is not within four days of discovering a breach, but within four days of determining it as a material breach. Shostack believes that the pursuit of transparency is crucial, but it is necessary to clarify and differentiate specific terms to avoid misunderstandings.

Vague Language and Demands for Flexibility

Shostack acknowledges the necessity for some degree of vagueness in cyber regulations, citing industry demands for flexibility as a contributing factor. However, he suggests that if the standards prove to be exceedingly open-ended and problematic, it is essential for the cybersecurity community to engage with industry groups and lobbyists to address these concerns.

Leslie R. Katz, an attorney and former tech executive, concurs with Shostack, emphasizing the role of the cybersecurity community in shaping rulemaking discussions. She highlights that without adequate technical guidance, regulatory bodies like the SEC are left with limited influence beyond punitive measures. Katz believes that the SEC’s recent criminal action against individual SolarWinds executives for the company’s 2020 breach stems partly from a lack of cybersecurity expertise within the agency. This enforcement action, in her view, signals a warning to the industry, stressing the importance of vigilance and rapid responses to cyber incidents.

Addressing Regulatory Uncertainty: Collaboration and Technical Standards

To address the continuing challenges posed by regulatory uncertainty, close collaboration between cybersecurity professionals and legal compliance experts is crucial. This collaboration should begin during the preparation stage and extend into the response to actual cyber incidents. Adam Shostack advises cybersecurity teams to start by referring to technical standards provided by trusted sources such as the National Institute of Standards and Technology (NIST). He specifically highlights the importance of the Cybersecurity Framework and the Secure Software Development Framework as valuable resources for guiding compliance efforts.

Expert Guidance at Black Hat USA

To aid professionals grappling with the complexities of new cyber regulations, an esteemed panel of experts, including Adam Shostack, Mike Hintze, Daniel P. Cooper, and Leslie R. Katz, will be hosting a presentation titled “Hot Topics in Cyber and Privacy Regulation” at the Black Hat USA conference. The panel plans to provide guidance on navigating a broad range of regulatory topics. These areas of focus include US privacy law, European Union regulations on artificial intelligence, the EU-US Data Protection framework, and the most effective ways for security professionals to engage with the compliance and rulemaking process.

In conclusion, the challenges faced by cybersecurity teams due to ambiguous regulatory language and ever-increasing compliance requirements necessitate proactive collaboration between industry experts and legal compliance professionals. As regulatory bodies navigate the complexities of cybersecurity regulations, it becomes essential to strike a balance between flexible standards and clear guidelines to avoid misinterpretation. Cybersecurity professionals should remain committed to their role as educators, actively contributing to shaping rulemaking discussions to ensure that regulations effectively address evolving cyber threats while facilitating compliance efforts.