Microsoft and FireEye push for corporate breach reporting rules

The two companies believe companies should be able to report breaches without legal retribution

Microsoft sign on a building

Microsoft and FireEye executives have urged Congress to create laws requiring firms to disclose security breaches in the wake of the SolarWinds hack.

According to The Hill, Microsoft president Brad Smith said in written testimony to the Senate Intelligence Committee there is a “need to impose a clear, consistent disclosure obligation on the private sector.” He added that “silence reigns” when companies are hacked.

“This is a recipe for making a formidable problem even worse, and it requires all of us to change,” he added. “We need to replace this silence with a clear, consistent obligation for private sector organizations to disclose when they’re impacted by confirmed significant incidents.”

FireEye CEO Kevin Mandia, whose company discovered the breach, said companies should be able to report breaches that could have national security ramifications without fear of retribution.

“The US government should consider a federal disclosure program for not only sharing threat indicators but for also providing notification of a breach or incident,” he said.

According to White House officials, the SolarWinds breach affected nine federal agencies and 100 private companies. Intelligence officials have said the attacks likely originated in Russia.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

Smith added that substantial evidence points to the Russian foreign intelligence agency’s involvement and nowhere else. He and Mandia said companies such as theirs had no legal obligation to disclose breaches, but a “duty nonetheless” to customers, the government, and the public.

“We will not secure this country without that kind of sharing,” said Smith.

Currently, breach notification occurs at the state level, and years of federal efforts to develop laws have netted no changes. This means the full extent of breaches remains unknown.

Mandia added that while the SolarWinds breach was stopped, another will happen, and this highlights the need for stronger breach notification requirements.

“This attacker, maybe their pencil is down for a few months, but the reality is they are going to come back,” Mandia said. “How they break in is always evolving, and all we can do is close the window and close the security gap better next time.”

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

How the right software can improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

Fedex teams with Microsoft for cross-platform logistics solution
digital transformation

Fedex teams with Microsoft for cross-platform logistics solution

25 Jan 2022
Microsoft tells IT admins to turn off legacy group policies to improve Windows performance
Microsoft Windows

Microsoft tells IT admins to turn off legacy group policies to improve Windows performance

21 Jan 2022
Microsoft buys game developer Activision Blizzard for $68.7 billion
mergers and acquisitions

Microsoft buys game developer Activision Blizzard for $68.7 billion

18 Jan 2022
Microsoft takes aim at critical RCE flaws with "massive" Patch Tuesday update
cyber security

Microsoft takes aim at critical RCE flaws with "massive" Patch Tuesday update

12 Jan 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022