What Was I Thinking?: Bungled Breach Responses
summary
Session gives concrete takeaways: company Slack and texts routinely surface in discovery, incident response reports are usually discoverable unless carefully drafted, and courts reject broad privilege claims when reports look operational. Recommended fixes are specific: keep a factual IR record, separate factual report from remediation recommendations, have counsel review drafts, run annual tabletop exercises, register law enforcement contacts, and avoid illicit “hack back.” Treasury/OFAC guidance means ransom payments can trigger sanctions.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:10Anne Marie Mortimer
- 1:57Brian Levine
- 3:29Johnhauser
- 4:13Logistics
- 5:01Breach Communications
- 6:34OffChannel Communications
- 8:51Communication Hygiene
- 10:01Toxic Tone
- 12:57Best Practices
- 15:12Incident Response Reports
- 17:01Are the plaintiffs successful
- 19:47The anticipation of litigation
- 28:23What Companies Are Doing Right
- 34:15How Many Companies Dont Do The Basics
- 35:03Legal Defenses
- 41:16Bungled Breach Responses
- 43:34Uber Imprisonment
- 52:53Hackback
- 57:31Closing Comments
related talks
49mIR: Optimizing Communications and Action Between Legal and Tech Leaders
51mSurvive the Breach-Protecting People & the Company When the Worst Happens
52mCISO Legal Risks and Liabilities
51mLife after the Breach: A Survivor's Guide
36mFrom Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response
51mReal World Stories of Incident Response and Threat Intelligence
41mHow to Keep Your Cool and Write Powerful Incident Response Reports
49mTraining for Incident Response: The Red, the Blue, and the Ugly