According to Forrester, business and technology leaders often dismiss lawyers as obstacles to productivity. Many security teams fail to fully engage legal with incident response planning because:

  • Lawyers are often seen as risk-averse, disengaged advisors.
  • It’s difficult to know whether you’re talking to the right lawyer.
  • There is a widespread belief that incident response is the result of failure and inadequate controls.

By training, lawyers are best equipped to understand regulatory and legal risk, which makes them a critical part of your incident response team.

The Value of Attorney-Client Privilege in Incident Response

No company can accurately predict whether a security incident or breach investigation will end up as a lawsuit or regulatory fine. After working closely with legal advisors on numerous security incident and breach investigations, I can attest to the value of asserting the attorney-client privilege. Unfortunately, there seems to be a general lack of awareness and understanding around this valuable approach. Incident response teams need to understand the implications of their communications with others and how these communications can impact incident handling.

The attorney-client privilege can protect confidential communications between a lawyer and an incident response team. When asserted, it can prevent the disclosure of these privileged communications. The purpose of the attorney-client privilege is to encourage open communication while minimizing the risk of disclosing these communications to opposing parties.

Four Basic Types of Attorney-Client Privilege

Communications, both written and oral, may have to be disclosed in an investigation if the parties do not maintain the attorney-client privilege. Such communications, including inaccurate ones, can then be used as evidence against your company.

There are four basic types of communications to which the attorney-client privilege applies.

  1. Written, oral or electronic communications: It is recommended that written or electronic communications be marked “Attorney-Client Communication — Privileged and Confidential.” This provides the intent of the communication.
  2. Communications made between privileged persons: This may include the incident response team and the attorney designated to handle the issue, or a paralegal or assistant working on behalf of the attorney.
  3. Communications made in confidence: This means it should be made with the intent that the communication remain confidential. There should be no communication regarding the issue at hand except with persons who have a need to know. Any communication should be stored in a separate, secure location with limited access to assure it remains confidential.
  4. Communications for the purpose of seeking, obtaining or providing legal assistance: The communications should be for the purpose of obtaining or providing legal advice and counsel, which is imperative whenever a breach or regulatory investigation is involved.

Failure to follow these guidelines may result in a waiver of the privilege itself, which could result in communications that have to be revealed in a lawsuit or regulatory investigation. If a court concludes that privilege has been waived, then all confidential attorney-client communications in the matter may have to be revealed as well.

Keep Your Communications Confidential

How and with whom you communicate can make an enormous difference in the outcome of a lawsuit or regulatory investigation. The attorney-client privilege is well-established as a legal doctrine that protects confidential communications. However, its application is not a 100 percent guarantee that communications will remain confidential.

By taking the time to gain a basic understanding of the attorney-client privilege, your company can potentially obtain legal advice while protecting your communications, instead of inadvertently creating evidence for the opposing party.

More from Incident Response

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Alert fatigue: A 911 cyber call center that never sleeps

4 min read - Imagine running a 911 call center where the switchboard is constantly lit up with incoming calls. The initial question, “What’s your emergency, please?” aims to funnel the event to the right responder for triage and assessment. Over the course of your shift, requests could range from soft-spoken “I’m having a heart attack” pleas to “Where’s my pizza?” freak-outs eating up important resources. Now add into the mix a volume of calls that burnout kicks in and important threats are missed.…

SIEM and SOAR in 2023: Key trends and new changes

4 min read - Security information and event management (SIEM) systems remain a key component of security operations centers (SOCs). Security orchestration, automation, and response (SOAR) frameworks, meanwhile, have emerged to fill the gap in these capabilities left by many SIEM systems. But as many companies have begun reaching the limits of SIEM and SOAR systems over the last few years, they have started turning to other solutions such as extended detection and response (XDR). But does this shift spell the end of SIEM…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…