How To Survive Your First Data Breach And Laugh
Posted by aonenetworks On May 2, 2015
Most experts in the data security field agree that a data breach is more likely than not to happen to almost every company. Far from being a death knell to the business that experiences it, a loss or compromise of data is quite survivable. The way you and your IT and other departments react to a data breach can pave the way to a deeper understanding of the workings of your company and set the stage for a better set of security protocols to guard your data in the future.
Prepare For The Breach
Get ready for the inevitable breach by ensuring that all departments in your company work on building and solidifying relationships with each other. Pay particular attention to encouraging your IT staff to learn about the dynamics of other areas of the business, especially identifying the key personnel with whom your technology heads need to be able to collaborate should an actual breach occur. Discussion of how IT and the departments will move forward together, during, and after a security issue will permit all to assume their roles quickly during any crisis.
Avoid Blaming
Emotions can run high during this type of organizational challenge and everyone involved may feel tempted to spin the situation or point fingers to avoid blame. Even if members of your management or IT team were warning about possible exposure prior to a breach it is essential that the entire company pull together after something from the outside does reveal your security weaknesses. The most important thing that management and technology specialists can do is to have a plan to recover from a breach as it will be nearly impossible to predict if or when a breach will happen.
Improve Your Systems From The Inside Out
It can be very tempting to rely upon external standards to structure your security framework. Merely complying with governmental or industry standards regarding security protocols and data logs may not be enough to keep your systems safe or to help you identify where your weaknesses are. Any internal intrusion detection system you have within your system needs active monitoring and will provide important information along with the logs when you review the information.
Devise A Need To Know Communication System
A data breach is not the time to determine who needs to know about the crisis nor the level of detail that should be shared. Take the time now to create a hierarchy regarding communications and then use it during any times your company experiences a data scare. Be honest but succinct when sharing information about the incident, avoiding the need to repeat explanations of the scenario or to over- or under- share information with key personnel and shareholders.
Structure A List Of Things To Investigate And Confirm
Work with your team to make a list of questions to answer and details to confirm before a breach happens. Use this list as a framework during your investigation of a real breach to make sure you have covered all contingencies. Remember always that the breach is not as devastating as not having a plan in case of a breach.
Run Practice Drills
Test out all of your preparations by having an occasional breach drill. Just like an old fashioned fire drill, practicing your business’s response to a data breach before it happens will smooth the process if you ever need to react to a real security crisis.
