Canadian Lawyer InHouse

MAY 2016 32 INHOUSE their iPhone. It's really employee error that is the weakest link in the chain." PREVENTIVE MEASURES Although employee error is the most com- mon reason for a breach in all global regions except for Asia Pacifi c, fewer than half of in-house counsel reported that mandatory training exists at their companies, accord- ing to the ACC study, and even fewer say that their corporations track or test employ- ee knowledge. Justine Laurier, an associate at BLG with a focus on labour and employment law, says in-house counsel must do more than draft a cybersecurity policy and have a response plan in place. Employees must be made to understand the potential consequences should the business be a victim of a cyberat- tack, as well as the potential negative effect to their livelihoods. "The management team should be aware of policies, how they are im- plemented, and what their role is as manag- ers with respect to privacy issues," she says. The ACC study did fi nd that 56 per cent of GCs and CLOs stated that their compa- nies are allocating more money to promote cybersecurity prevention than one year ago, while one-third of GCs and CLOs say they have retained outside counsel to help should a cyberbreach occur. In-house counsel should also look to other companies in their industry to share best practices, Sarwal says, as well as intel- ligence when there are breaches. While tra- ditionally there has been reluctance to share with others for fear of liability, high-profi le data breaches suffered by retailers prompted the Retail Industry Leaders Association to launch the Retail Cyber Intelligence Sharing Center so brands and government could col- laborate on strengthening defences against cyberattacks and better protect customers. CYBERSECURITY AS THE CULTURAL NORM Sarwal sees cybersecurity as social engi- neering issue, not just a technology issue. "It's really hard to design around these is- sues." He says organizations need to look at their own business model and understand what role information plays in it. "A lot of companies are extremely reactive." Cybersecurity is a complex area for in- house counsel, not just from a technology perspective, says Sarwal, and it's not for the meek. They are in a position where they need to create a culture of compliance with- in their organization by marshalling every division and bringing them together. "It's a people issue. In-house lawyers can't fi re their clients." Sarwal believes that training of employees around basic cybersecurity best practices will have to become the norm so they treat it as something they have to do and realize it's at the heart of the business. "Cybersecurity knowledge is going to become a requirement." IH Case law has shown that failure to notify can open up an organization to a successful lawsuit. RALPH KROMAN, WeirFoulds LLP CONNECT WITH IN-HOUSE COUNSEL COLLEAGUES AT LEXPERT.CA/CCCA Check out in-house counsel's best networking tool! The 2015/16 Lexpert CCCA/ACCJE Directory & Yearbook online edition is a user-friendly, outstanding key resource for all in-house counsel. Along with immediate access to more than 4,000 listees at more than 1,900 organizations, you'll also find fresh editorial content, information on deals and links to important resources. Directory listees and CCCA members can also receive log-in credentials for access to detailed contact information to be able to connect with colleagues or research the in-house bar. ANYWHERE. ANYTIME. ANY DEVICE. Untitled-6 1 2016-04-05 2:37 PM

• Cover