Magazine menu Close Magazine menu

incident response

Latest stories

cyber incidence communication response

Why now is the right time to plan your incident response communication

  • min read
    • There's a good chance cybercriminals could soon access your data. According to 2020 Thales Data Threat Report conducted by IDC, breaches are increasing worldwide. 1 in 2 US companies have experienced a data breach, and 1 in 4 in the last year. This change of focus involves classic strategies, like buying extra security solutions that detect attacks early, hiring new incident responders and training an existing team to react more effectively. It also brings new faces to the activity most prone to falling through the cracks: post-breach crisis communication. Applying a reputation rebuild Consumers are now much more concerned about data privacy. In the US, 83 percent, and Britain, 44 percent of consumers say they stop spending with companies after data breaches for several months. Many say they'll never go back. The need to rebuild their reputation sees companies spending on average $161,000 US dollars on PR after a breach. What is good crisis communication during cybersecurity incidents? Cybersecurity professionals agree that data breach response should happen across the business, not just in IT Security. Despite this, many companies struggle to respond fast enough, with enough information to quell the rumors. But preparing in advance for IT security incident crisis communication can fast restore a good reputation when it happens. I speak from experience. We discovered an advanced nation-sponsored attack on Kaspersky's internal network in 2015. With coordinated and cooperative work across different departments, we could control incident communications, building our reputation as transparent and responsible. We based our response around five understandings. 1.    Involve everyone in crisis management planning Companies should plan for how they'll communicate about any situation they might face. A cybersecurity incident should be one of these. Your crisis management plan should include people from all departments, That means IT Security, IT, legal, customer support and corporate communications for a start. 2.    Educate non-IT employees on IT security basics Building a cyber-aware culture at work has benefits beyond incident response. 3.    Have different plans for different types of incidents You'll probably need separate plans for different kinds of issues. The reputation impact of an advanced persistent threat (APT) that lets cybercriminals spy on business activities will be changed to that of business-halting ransomware. Use the company's threat model to identify the most likely scenarios you'll need crisis communication plans for. 4.    Prepare alternative internal communication If hackers have compromised email, IP-telephony, direct messages and phone or video calls, you'll need secure channels to use to keep employees updated and plan your response. In this situation, involved employees should use encrypted channels. Prepare non-technical staff in advance by explaining the need for encrypted messaging, how to install it and how to use it. 5.    When you disclose, be specific When they're not given enough detail, people tend to speculate. When disclosing an incident, say exactly what happened, how it affects customers and partners, and what you're doing about it. Every task is urgent when responding to a security incident, but only IT Security can give corporate communications the details that will let them write an accurate and informative statement. IT Security should prioritize conveying this information, alongside their most urgent post-breach tasks. The success of Kaspersky's and others' crisis communication in response to major incidents shows that even when cybercriminals succeed, good communication can still win the day. And like many things in business, it's all about the planning.
security bytes privacy reputation

How to build customer trust when a data breach happens

  • min read
    • Although common in all kinds of organizations and businesses, data breaches still make striking headlines. We all work hard to prevent them, but how should you communicate about data breaches when they happen? In the Security Bytes series, senior InfoSec professionals give their most savvy advice. This time, I asked several cybersecurity experts with incident response experience: Some chose to speak under a pseudonym, but all share sound advice that could help save your company's reputation when, despite your robust work to protect it, a cybercriminal succeeds in accessing your information. Hire the best PR firm Principal Security Consultant L0ra thinks a well-coordinated, experienced PR firm can best handle your company's reputation. She also believes the public responds well when companies admit their mistakes. "The biggest mistake companies make is glossing over their failures, but breaches happen every day. It isn't the first time. It won't be the last. "If the breach is large and public, immediately hire the best PR firm you can afford. "Sometimes, in response to a data breach, you get a raid. That's when a group of people comes at you on the internet. The number one rule for dealing with a raid is, log off and keep quiet. So you need a good PR firm to speak on your behalf." Communicate through the right people, and learn from mistakes Ray Hayes is Senior Software Engineer, Enterprise and Security at Microsoft. He highlights the importance of knowing who you're speaking with and learning from mistakes. "I don't speak about any incident off-the-cuff. I refer all inquiries to my leadership team. "If I'm asked informally about a major data breach or any other incident at my company, I make conversation, but keep it general, and make sure I know who I'm talking to. "Breach response is critical, but prevention is key. "Anyone starting a new job should think, "What could happen if the information I'm working on now was released?'" Involve everyone in planning – before it happens Security engineer Daniel says responding to data breaches must involve more than just the technical people. You need legal experts and business communicators too. "All companies should prepare for data breaches, especially those with data worth stealing. Small- and medium-sized businesses (SMBs) more often don't recognize the threat. "Before it happens, get everyone involved in making a crisis plan, not just IT. It's not only a technical problem. Involve legal, finance, safety and everyone else. They have valuable insight tech people often don't, and will have their own tasks to do when it happens." Tell customers affected, quickly and honestly James O, Director of Information Security, says informing your customers truthfully is a must. "Our insurance company gives us a Breach Coach to help our PR firm get the messages right. We also coordinate with internal communications to inform the families we serve, and start telling affected people as quickly as possible. We also report under our state data breach laws. "Companies could improve their data breach PR. When my data was accessed in a financial company's breach, I just got a form letter saying, here's your year of identity protection. "At least they included the root cause – leaving generic credentials on a public box – but that doesn't give me confidence that it won't happen again." Avoid the 'sophisticated attack' cliché Security Analyst http_error_418 says PR is vital, but companies must stop exaggerating cyberattackers' skills. "Companies often handle breaches with platitudes. They'll say the attacker was 'advanced' and 'sophisticated.' That's because, when it's later shown their app wasn't patched for eight years, investors are over the initial fright. "We also need to consider when transparency helps, and when it's overkill. "The public often don't fully understand what transparency reveals." Update regularly and learn from the best Cyber Threat Intel Analyst HackerPom points to an example of good practice. "When they know the facts, executives, PR and legal should give the media and customers regular updates. For a good example, look at Norsk Hydro's response to a bad data breach. Their communications were clear and straightforward." Better to overstate than understate the impact Joonatan Kauppi, Founder and CEO of Leijona Security, has several pieces of good advice. "If you're unsure of the impact, it's better to overstate than understate. If you downplay it, then word breaks that it's much more serious, you'll get worse press. "Bring the regulatory authorities into the loop straight away. "Inside the organization, start damage control, and don't skimp on costs. Gather the facts and inform your communicators. "Answer questions from security researchers and other InfoSec people. They ask the right stuff and are a good platform to communicate what happened. "Prepare for the flurry of questions you'll get from people or parties affected. Don't blame. Concentrate on reducing the impact of the breach." Make sure your plan fits all scenarios David Emm, Principal Security Researcher at Kaspersky, says to make sure you're planning for the full range of data that might be breached. "Balance technical and PR in responding to a breach. You can only do this well if you have a process for managing security incidents. Involve the right people across the organization – including IT, HR, legal and PR – and work out a plan before anything happens. The light of experience There are strong themes from these experts when it comes to how to communicate around data breaches. I'm hearing almost everyone say, plan for how you'll respond before it happens, involving people across the organization. Several say, to use the best PR available, and communicate with speed, honesty and regularity. By sharing the right information at the right time, in the right way, you'll get the right outcome: customers understanding how they're affected, and appreciating what you've learned. Article reflects the opinions of the author and speakers quoted. Published in 2019.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries