C CLE case studies

C CLE · Put your knowledge to work in context.

The Certified Cybersecurity Law Expert (C CLE) is a professional credential offered by EC-Council, a training and certification body founded in 2001 and accredited to ISO/IEC 17024. EC-Council reports a presence in over 170 countries and more than 400,000 certified professionals worldwide. The C CLE case studies are 5 cases and about 4,762 words.

Privilege, the Personal Laptop, and the Manager Who Already Asked

You are general counsel of a 900-employee payments company in Austin, Texas. On 4 March a data-loss-prevention alert showed that a senior backend engineer, R.T., copied 4,200 customer records - names, partial card numbers and bank routing data - to a personal Dropbox account six days before his resignation took effect.

935 words, about 5 min 2

The 72-Hour Clock at a New York-Licensed Mortgage Servicer

You are CISO of a New York-licensed mortgage servicer with $4.2 billion in servicing volume and 310 employees; it is a subsidiary of a Nasdaq-listed parent. On Friday 11 April at 15:40 the SOC spots SMB lateral movement; by 18:00 ransomware has encrypted 30 of 400 servers, including the escrow disbursement system.

891 words, about 4 min 3

One Missing Tape, Two Legal Regimes, 130 Controllers

MedAxis is a US healthcare analytics company with 1,200 employees in Boston and a wholly owned subsidiary in Berlin that employs 40 sales staff. MedAxis is a HIPAA business associate to 130 covered-entity hospital clients and acts as a GDPR processor for the Berlin subsidiary's EU customer accounts; it is also the controller of its own German employee HR records.

984 words, about 5 min 4

The $1.3 Million Wire and the Server in Hong Kong

On 14 August a $1.3 million wire left Corvane Logistics' account at a New York bank to a Hong Kong account after the accounts-payable clerk received an email that appeared to come from the CFO's address, instructing an urgent payment for a 'confidential acquisition.' The real CFO was on a plane. Corvane's IT team found no malware; the message came from a lookalike domain registered 11 days earlier, and the clerk had forwarded her own W-2 to the same address a week before.

1,010 words, about 5 min 5

Ransomware, a Designated Group, and the Agent Who Asked for a Delay

Lakeshore Regional Health operates 22 facilities in Ohio and Pennsylvania and is a HIPAA covered entity. On 2 February ransomware encrypted its electronic health record system; 41,000 patients' records were exfiltrated.

942 words, about 5 min