Incident Response and the Attorney Client Privilege

Presented at ShmooCon XV (2019), Jan. 18, 2019, 3:30 p.m. (30 minutes).

Oh no, you’ve suffered a computer security incident. The DFIR team you hired wrote up a great report detailing exactly what happened and making suggestions for how to fix some of these issues. But now you’re being sued, and opposing counsel requests that report!

Many times, companies will seek to protect investigations under the cover of attorney-client privilege. But what is that, when and how does the privilege attach, and how helpful is it most of the time? What should your goal be, and just what are best practices for working with attorneys?

Presenters:

• Wendy Knox Everette
  Wendy (@wendyck) is a software developer who burned out and went to law school, where she completed a concentration in National Security Law and interned with the FTC, FCC, and some other three letter agencies (no, not the fun ones). After law school she completed a fellowship in privacy and information security law at ZwillGen. She currently lives in Seattle, where she is a Senior Security Advisor at Leviathan Security Group.

Links:

• https://infocon.org/cons/ShmooCon/ShmooCon 2019/Incident Response and the Attorney Client Privilege.mp4

Similar Presentations:

• Black Hat USA 2017 / White Hat Privilege: The Legal Landscape for a Cybersecurity Professional Seeking to Safeguard Sensitive Client Data