Reasonable Cybersecurity: Oxymoron or Opportunity?
summary
Panelists argue that “reasonable” security is becoming a legal duty of care and must be made defensible by documenting decisions, not by perfect tech. They propose process-based reasonable security that maps NIST and CIS controls into artifacts used as an affirmative defense under Safe Harbor laws like Ohio’s Data Protection Act. Early adoption is voluntary and incentivized, consent decrees push specificity, insurers and state AGs already use these mappings to quantify settlements, but few court rulings exist yet.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:07Cybersecurity responsibility evolution
- 7:43CIS guidance role
- 17:19Judge’s cybersecurity perspective
- 24:50Ohio Data Protection Act
- 33:52State cybersecurity regulation
- 43:40Q&A
related talks
34mCan Open Source be Secure by Design?
51mThe State(s) of Cyber Incentives: Creative Laws Driving Better Security
12mSecurity is Everyone's Responsibility
52mCISOs and Legal Uniting in a Post Uber and Twitter World
36mCybersecurity, Privacy and Data Security from a Business Lawyer's Perspective
01h 09mKeynote: What Do We Owe One Another In Cybersecurity?
55mCybersecurity as Realpolitik
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices