You Survived a Data Security & Privacy Breach. Now What?

The call comes in at night, waking you from a deep sleep. Sometime overnight, your network was infiltrated, and the private information — both proprietary and customer data — was compromised. Your network experienced a confirmed data privacy breach.

While it rightfully may seem like a time to panic, keeping a cool head and being focused is paramount. Your next actions in the first few hours — and coming months — play the most significant role in the recovery process.

Failure to adequately respond could not only result in financial losses but also discredit your company for years to come. 

Your company, investors, and customers will look to you to mount the proper response to both reduce the damage and move forward confidently with security solutions that leave no room for doubt.

 

Data Privacy Breach Survival & Recovery

The best data privacy breach examples of successful recovery share one common trait — the affected organization started work immediately.  

After a data privacy or a security breach, do not wait to let the dust settle. The damage should be contained as quickly as possible, with new controls in place to prevent a second attack.

Your work to survive and recover from a breach will likely take the better part of a year.

Responding to a breach requires developing and sticking to a carefully thought out and thorough response plan, completing recovery and re-security activities within:

 

• 24 hours
• 1 week 
• 1 month
• 1 year 

 

Within 24 Hours

The first few hours are the most critical time for a response — it is not a time to sit back and hope for the best.

During the first 24 hours, your organization should: 

• Establish a security operations center & team (if you do not already have one). During the first 24 hours after a data breach and the days that follow, they will be the driving force behind your recovery. Your security operations center will keep you informed on the latest breach details, direct your response actions, monitor changes to the threat environment, and respond to any new incidents that arise.
• Re-secure your network and its assets by ceasing all network activity immediately. Depending on the size of your network and its connected assets, this may be a big task, and should include:
  • Locking down the different components of the network, including servers, workstations, mobile devices, routers, switches, and hubs. 
  • Disabling all remote access for all users. 
  • Isolating external connections to prevent a second attack. 
  • Disconnecting all known compromised machines by shutting them down and unplugging them from Internet cables. 
  • Turning off all NFC and Bluetooth capabilities. 
  • Unplugging any USB drives, SD cards, or other peripherals that are in the machine.
• Determine exactly what information was compromised and how. Once the network is secure, figure out which files are missing. Understanding what was obtained by the hackers and how they were able to get it is critical. These two crucial pieces of information will determine how you proceed in choosing and implementing security solutions.
• Call in reinforcements. Part of your initial recovery work is to determine if it is time to call in outside help (a third-party cybersecurity provider). An outside cybersecurity company may have more expertise than your internal team and will know how to appropriately respond to your situation. An external cybersecurity team may also spot small, but nuanced inconsistencies in your network that your internal team may not. The more available incident response experience, the better.
• Work the phones. You should also be working the phones immediately, calling your organization’s:
  • Insurance provider — to discuss what coverage options you have for a breach. The insurance provider will have previously set any coverage amounts for your business based on previous examples of cybersecurity breaches and their cost to a business.
  • Legal counsel — to discuss which compliance violations have occurred
  • and formulate a response plan. The legal department can help guide your choices to provide a layer of protection when addressing potential media and agency inquiries.
  • Marketing/Communication team — to talk about the need not only to notify your internal team of what happened and what the next steps are, but to tell those externally affected what happened and to communicate your plan for mitigation and recovery. Depending on the scope and reach of the intrusion, you may need to consider crafting a media response.

 

During the First Week

Throughout the next 7 days, your team’s efforts should be focused on recovery and getting back up and running. Their work should include implementing data backups to get information back where it should be and determining the need for replacing hardware & software.

 

By 1 Month

By this point, your organization is through the worst of it. Your systems should be back up and running securely.

You and your team have a small window to breathe. Now it is time to do a deep dive into what exactly happened, how, and why. During this part of the process, you will identify the root cause. Think of it as a postmortem examination of lessons learned, of sorts.

The more information about the attack, the better. The findings from this deep examination are vital for increasing security posture and minimizing vulnerabilities moving forward.

 

One Year Out

A data privacy breach will never truly be in your rearview mirror. But by one year out from the initial security incident, your organization’s day-to-day should be much different than it was 366 days earlier.

By now, you should have implemented new:

• Cybersecurity protocols
• Staff procedures
• A regular schedule of security checks

 

Data Privacy Breach Prevention: No Time Like the Present

Attempted data privacy breaches are inevitable.

If there is a network with intellectual property, trade secrets, personally identifiable information, hackers want it.

The best time to prevent data privacy breaches is to plan for them now. Implement the most robust security protocols you can and create a strategy to deal with the anticipated cyber attack.

Part of this strategy involves:

• Knowing who to call when/if another breach happens
• Having the proper cyber insurance 
• Having data backups and knowing where they are

 

Adding a third-party cybersecurity and data privacy company is also a good addition to your data breach preparation. As an extra set of hands tending to your cyber defenses, your new partner can take on the heavy lifting of protecting your digital assets. What’s more, a third-party provider frees your internal IT team to focus on other important work within your organization.

The more layers of security you have, the more time you buy during an attempted attack. 

 

Moving Forward from a Data Privacy Breach

A data privacy breach is one of the last things any organization wants to deal with. 

While one of the most disruptive and damaging events possible, having a recovery plan in place saves you from experiencing the full cost of a data privacy breach and allows you to seamlessly move forward with a more secure IT infrastructure.

Bolster Your Cyber Defenses Against a Data Privacy Breach

Schedule a consultation with our team to learn about how we can help you prevent or recover from a data privacy breach.