Microsoft and FireEye push for corporate breach reporting rules

The two companies believe companies should be able to report breaches without legal retribution

Microsoft sign on a building

Microsoft and FireEye executives have urged Congress to create laws requiring firms to disclose security breaches in the wake of the SolarWinds hack.

According to The Hill, Microsoft president Brad Smith said in written testimony to the Senate Intelligence Committee there is a “need to impose a clear, consistent disclosure obligation on the private sector.” He added that “silence reigns” when companies are hacked.

“This is a recipe for making a formidable problem even worse, and it requires all of us to change,” he added. “We need to replace this silence with a clear, consistent obligation for private sector organizations to disclose when they’re impacted by confirmed significant incidents.”

FireEye CEO Kevin Mandia, whose company discovered the breach, said companies should be able to report breaches that could have national security ramifications without fear of retribution.

“The US government should consider a federal disclosure program for not only sharing threat indicators but for also providing notification of a breach or incident,” he said.

According to White House officials, the SolarWinds breach affected nine federal agencies and 100 private companies. Intelligence officials have said the attacks likely originated in Russia.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

Smith added that substantial evidence points to the Russian foreign intelligence agency’s involvement and nowhere else. He and Mandia said companies such as theirs had no legal obligation to disclose breaches, but a “duty nonetheless” to customers, the government, and the public.

“We will not secure this country without that kind of sharing,” said Smith.

Currently, breach notification occurs at the state level, and years of federal efforts to develop laws have netted no changes. This means the full extent of breaches remains unknown.

Mandia added that while the SolarWinds breach was stopped, another will happen, and this highlights the need for stronger breach notification requirements.

“This attacker, maybe their pencil is down for a few months, but the reality is they are going to come back,” Mandia said. “How they break in is always evolving, and all we can do is close the window and close the security gap better next time.”

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

New FamousSparrow hacking group caught targeting hotels
vulnerability

New FamousSparrow hacking group caught targeting hotels

24 Sep 2021
Microsoft unveils new Surface Pro, Go, Duo and Studio devices
Laptops

Microsoft unveils new Surface Pro, Go, Duo and Studio devices

22 Sep 2021
Bug fixes and app updates arrive with latest Windows 11 preview build
Microsoft Windows

Bug fixes and app updates arrive with latest Windows 11 preview build

17 Sep 2021
Podcast transcript: Are foldable phones more than a fad?
Mobile

Podcast transcript: Are foldable phones more than a fad?

17 Sep 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021