Data Breach Handling Best Practices
Published: June 24, 2016
Introduction
A data breach could happen to anyone. Data managed by your company is valuable to someone, no matter what the data is. Everything has a price tag on the dark web. It is especially true when it is customer data, such as personal and payment card details.
When your customers’ data turns up somewhere unexpected on the Internet, you may feel the world is collapsing around you. People start tweeting about the hack, angry customers phone in, and Brian Krebs publishes his first article. Your organization switches to an emergency mode to handle the situation. It is the time when your incident response team takes control to put the genie back in the bottle.
More Attention on Data Breaches
The risk of data breaches should concern all decision makers by now. According to the latest report from Identity Theft Resource Center (ITRC), the total number of data breaches has increased this year compared to the figures from 2014. As the chances of having a breach increase, preparedness becomes more important than ever.
Furthermore, data breaches receive more media coverage, and customers become more concerned about the security of their personal data than ever. Target upset its shoppers with forcing them to replace their credit cards and to keep an eye on their credit reports. Customers of VTech were worried what happens with their kids’ photos and personal details. TalkTalk subscribers wanted to abandon their contracts and called the CEO to step down.
Keeping the Customer Happy
When the unthinkable happens, your customers will demand answers. They all want to know how the breach would affect them, and what the company is going to do to prevent it from happening again.
If your organization can provide these answers and communicates things, chances your customers regain confidence in your brand is high. It never leaves a sour taste in your customers’ mouth if the company demonstrates competence while handling the breach. Therefore, being prepared is good for the business.
Types of Data Breaches
The reason behind data breaches varies. According to Verizon and Mandiant, the top data breach reasons are human error, crimeware (or malware), insider misuse, physical theft and web attacks.
The majority of the media-covered breaches can be narrowed down to two variants, however: malware and web attacks.
Hackers got into Ashley Madison, Sony Pictures, and OPM through well-crafted malware such as backdoor software. On the other hand, customer data from VTech and TalkTalk was accessed by the notorious web attack named SQL injection.
Responding to the Breach
The different types of data breaches require different response strategies. The good news is, however, your incident response team can handle the same type of breach in a somewhat formalized manner.
For instance, your incident response team would probably respond to malware associated data breaches as the following:
- Identify the source (i.e. information system) of the data leak
- Investigate how the information system was compromised
- Generate indicators of compromise (IoC) from the malware
- Find other infected systems on your network with the IoCs
- Clean-up each identified system from the malware
- Monitor for potential new infections using the IoCs
The incident response team also queries internal tools (SIEM), external services (Threat Intelligence feeds), and engages internal staff such as IT to collect information for the investigation. Having the necessities in order, along with playbooks and automation could all make the overall response process smooth and consistent.
Legal and PR Matters
In parallel, the incident response team would determine the scope of the data breach. There are two questions need to be answered: how long the data breach has been going on and what data was affected.
The answers typically serve as an input for your legal and PR teams:
- Legal team: Your company may have legal obligations to do certain things, such as reporting the data breach to the privacy officer or notifying your customers. These obligations depend on the nature of the data that is involved.
- PR team: Press releases, interviews, and responses to customer queries on social media are things the PR team handles during a breach. To make sure crisis communication is right, they also need input from the incident response team.
Central Hub of Information
Because the incident response team coordinates the remediation efforts across the organization, they also serve as a central hub for information. Firstly, the team collects information that sets the general direction of the remediation process. Secondly, the incident response team shares information with others such as your legal and PR teams.
As the incident response team collects, processes, and shares a large amount of information, it is a wise decision to invest in an information sharing platform. It eases the information flow between all parties during the investigation process. Besides, the accumulated data could be invaluable for handling future breaches.
Summary
The total number of data breaches and the records affected is still on the rise. At the same time, the media provides a wider coverage of these events. As a consequence, customers are more concerned with the security of their private data than ever.
Your organization should respond to this challenge by preparing for the inevitable. The solution is well-prepared incident response team, which could manage the situation in a competent manner.
Playbooks should be prepared and practiced that covers the most frequent types of data breach scenarios. Good incident coordination depends on information gathering, processing, and sharing. Well-informed PR and legal teams could build an effective crisis communication strategy to regain customer trust.
Need help getting started? Click here to view our sample playbooks.
Download our whitepaper to learn how you can improve SOC efficiencies and bridge the security skills gap. Already have a playbook? Automate it today!
