CIO - It used to be that the rules of the game made suing a vendor for a security breach a losing proposition. It was easier to settle a dispute for less, or to take an insurance payout and move on.
No more. Because of changes in the insurance business and some recent court decisions, it looks like this is going to be the year to watch for computer security lawsuits.
The tipping point came in October 2001. That was when, looking at huge payouts post-9/11 and no end to the super-viruses (such as I Love You and Nimda), the Hartford Insurance Co. removed computer damages from its commercial general liability plans. Other insurers followed suit. In 2002, as computer damages from major viruses intensified, agencies such as the National Institute of Standards and Technology were establishing rules and standards for software security -- and security breach victims started to view the problem as one of negligence instead of liability.
"This is really a wave-of-the-future-type trend," notes Bill Cook, a partner at law firm Wildman, Harrold, Allen & Dixon in Chicago.
The decisions in this new wave of cases are sure to create new legal precedents that will go a long way to directing the security and quality of software for the future. In an essay on the topic, Cook highlights several recent cases he expects to shape future software security rulings. Here are three big ones:
No. 1: Worm attacks and similar misdeeds are predictable when it comes to computer systems attacks. That's the reading from the Maine Public Utilities Commission v. Verizon case.
After the Slammer virus a year ago, Verizon Communications Inc. asked for a refund from the money it pays Maine's utility commission for using its infrastructure. The refund would cover the time Verizon was unexpectedly down due to Slammer, and hence not using the network. Maine pushed back, saying that since Verizon hadn't implemented the Slammer patch, the company didn't deserve a waiver. (Maine also noted AT&T Corp. and WorldCom Inc. had no problems with Slammer.)
In April 2003, the judge sided with Maine, saying that sophisticated worm attacks are foreseeable even if you can't control them. Verizon didn't get its refund.
No. 2: The courts can step in to determine security procedures. That's what a government agency learned in Cobell v. Norton. In this case against the U.S. Department of the Interior over unpaid benefits to American Indians, the department's computer security (and resulting Web site outage) became a major issue (see story).
The judge in the case was so miffed at the Interior Department's
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!