Jeff Moss on stage at Black Hat Europe 2023.Source: Dan Raywood at Black Hat Europe

BLACK HAT EUROPE 2023 — London — Expect governments to impose greater levels of cybersecurity regulation if businesses cannot defend against major attacks and stop breaches from happening.

That's a prediction from Black Hat founder Jeff Moss, speaking at Black Hat Europe in London this week. He believes that eventually, the world will come to a tipping point where too many highly impactful breaches and escalating infrastructure hits from nation state-sponsored attackers will spur governments to act.

"Self-regulation is not working," he noted from the keynote stage.

Moss also said that security could head towards a Sarbanes Oxley (SOX) moment, a US law implemented after the 2001 collapse of Enron that protects investors by auditing for fraudulent accounting and shady financial practices at publicly traded companies. Achieving SOX compliance requires financial reports to include an internal controls report to show that a company's financial data is accurate, and adequate controls are in place to safeguard financial data — and one can easily see how that could translate to cybersecurity auditing.

Regulation Needs to Be Nuanced

Meanwhile, Black Hat Europe keynote speaker and former Uber CISO Joe Sullivan (who himself has been convicted of and on probation for fraud for failing to alert regulators of a 2016 cybersecurity breach at the ride-share giant) stresses that regulators need to be level-headed in terms of who should be held accountable for keeping people safe, and consider the realities of how data breaches and their containment play out on the ground. Should someone face jailtime for succumbing to social engineering, for instance? Is the CFO who doesn't think two-factor authentication fits the company budget on the hook for fines when an account takeover leads to a ransomware attack? What about the security team who failed to appropriately make the case for it?

Speaking to Dark Reading, Sullivan uses the example of the SEC's newly implemented data-breach reporting rules; when the SEC put a request out for feedback on a draft set of the rules, it failed to incorporate insight from those working in the trenches, he alleges.

"I wish the security community would actually give them feedback, not just the [victims affected by breaches]," he says. "I think most of the people who have sat in those government seats have never sat in the CISO seat or the security engineer seat, and they're not going to have empathy."

Even so, a regulatory approach, if done correctly, could make security a whole-of-company focus, which could lead to positive outcomes in terms of preparedness and defenses, he says.

"[The] regulators' message is, 'if you're not going to keep people safe, there is going to be consequences,'" he notes. "We need that to be heard at the highest levels of the company, not just at the security level of the company, and then we'll get real change."