CISO Legal Risks and Liabilities
summary
Case study: an extortion demand for $100,000 was handled as a stretched bug bounty with NDAs and false claims of destroyed data, ending in an obstruction charge not a breach liability. Practical takeaways: get a contract with clear indemnity and D&O coverage, include legal in executive tabletop crisis exercises, never guess numbers or call an event a “breach” without counsel, revise playbooks after drills, and treat AI risks (explainability, disparate impact, voice/facial spoofing, ChatGPT data leaks) and developer security as real, testable threats.
AI-written summary · about
chapters (10)
- 0:00Introduction and panel setup
- 5:49Uber case and CISO repercussions
- 12:22CISO role and shifting responsibilities
- 19:02Protecting yourself as a CISO
- 27:09Three key pieces of CISO advice
- 32:17Executive tabletops and crisis comms
- 37:00CISO community resources
- 39:51AI and legal risks for CISOs
- 47:26AI's legal and regulatory impact
- 51:43Q&A and closing remarks
related talks
01h 00mFrom the Fry Pan to the Fire—Personal Liability for CISOs and InfoSec Pros
50mCISOs Under Indictment: Case Studies, Lessons Learned, and What’s Next
01h 00mWhat Was I Thinking?: Bungled Breach Responses
36mCybersecurity, Privacy and Data Security from a Business Lawyer's Perspective
30mNavigating the New AI Security Landscape
50mAvoiding Legal Landmines: A Review of Recent Cyber Cases
28mBreaches Are Everywhere; What's a Good Security Leader to Do
02h 11mCISO Track Panel