Sekhar-Bio

Data Breaches: Incident Response Planning – Part 1

Incident Response Planning – Part 1

The topic of cybersecurity has become part of the boardroom agendas in the last couple of years, and not surprisingly — these days, it’s almost impossible to read news headlines without noticing yet another story about a data breach. As cybersecurity shifts from being a strictly IT issue to being a mission-critical component, BODs are also becoming more interested in what their organizations are doing to plan their incident response.

Cybersecurity professionals are smart to use the philosophy of “assumed compromise” — knowing that no matter how robust the defenses, they will be breached. Just like disaster preparedness helps in the aftermath of a major earthquake, hurricane or another natural calamity, incident-response planning helps organizations prepare in advance for the aftermath of a data breach.

In its recently released “2016 Data Breach Investigations Report,” Verizon compared being part of a infosec team to being a soldier who’s tasked to guard a hill at all costs, but without knowing who the enemy is, what it looks like, where it’s coming from and when. And to make matters worse, that soldier only has an old rifle with a few ammunition rounds.

Incident Response Planning

That is certainly a fitting description of today’s cybersecurity threat landscape. Using this analogy, now imagine this soldier has extensively practiced a variety of scenarios on what an attack “may” look like, and the steps he needs to do when it does happen, regardless of how the attack plays out. This soldier still doesn’t have any more specific details about the enemy or the impending attack, but he is much better equipped for whatever unknown comes his way. That is exactly what an incident-response plan does.

You don’t have to look hard for statistics to know why you need this plan: Last year, the number of discovered zero-day vulnerabilities more than doubled from 2014, according to the 2016 Internet Security Risk Report, newly released from Symantec. In other words, a new zero-day vulnerability popped up every week, on average. At the same time, McAfee Labs whitepaper report predicts a significant shift in the next five yearstoward new threats that are more difficult to detect, including file-less attacks, exploits of remote shell and remote control protocols, encrypted infiltrations and credential theft.”

The size of the organization doesn’t matter, as bad actors don’t discriminate when they look for the lowest-hanging fruit. In its 2015 Internet Security Threat Report, Symantec found a 40 percent increase in the number of large companies targeted compared to the year before — with five of six companies becoming a target. But small businesses aren’t doing any better: In its 2015 Year-End Economic Report, the National Small Business Association found that 63 percent of the businesses fell victim of cyberattacks in the past year. Since almost 90 percent of attacks are driven by financial motivation or espionage (based on the 2016 Verizon study), if you collect and store any type of information — employee records, customer data, intellectual property etc. — you’re on the cybercriminals’ radar.

What Not To Do After an Incident

common_cyber_attacks

(Image Source: https://www.cert.gov.uk)

If you find yourself in the middle of a cyberattack without a plan, you’re going to scramble as fast as you can, and not just from a tactical IT standpoint to secure your information infrastructure as fast as you can. That’s just step one. If sensitive data was breached, you have a long road ahead — notifying multiple layers of stakeholders, being inundated by customer and media calls, responding to any government inquiries, offering mitigation such as credit monitoring and potentially bracing for lawsuits. When you are in crisis mode, it’s difficult to think strategically about all these phases — it’s unlikely you’ll even know all the ramifications if you’ve never gone through an incident like this before.

Incident Response 

That’s where incident-response planning comes in. You can give yourself ample time to consider potential scenarios and then train your employees — even taking them through actual drills and tabletop scenarios.

Look at some of the big companies’ responses to appreciate why a well-planned out response is necessary. In many of the breaches we’ve seen in the past two or three years, the post-breach actions didn’t play out as well as they should have, resulting in PR nightmares.

Target, for example, took a week to announce its data breach in 2013, in the middle of the peak shopping season, as news began to hit customers through media reports. A gridlocked customer service line and a negative social media outburst were just some of the consequences — to say nothing of the class-action suit that eventually followed, costing the company $10 million in customer settlements and another $6.75 million in legal costs. As Target struggled to contain the damage and set up an official breach-communication website, scammers acted quickly to take advantage of the chaos — sending out fake messages that claimed to be from the company.

EBay topped Target by not only taking three months to realize a breach (which is not that uncommon) but also waiting for two weeks after that to notify customers. What followed, however, was awkward for such a big player: The first announcement was posted on ebayinc.com, a little-known corporate website and when it finally made its way to the eBay ecommerce site, it only went as far as telling users to change passwords, without any explanation. Meanwhile, PayPal customers were confused because a banner posted on that website didn’t clarify whether PayPal accounts were compromised as well.

While eBay was nonchalant in social media — simply responding to a storm of complaints with a tweet saying it would take a while for all customers to receive the password-resetting email — it worked really hard to downplay the magnitude of the breach. Even going so far as refusing to give an estimate, based on its best knowledge, on the number of records potentially affected.

Anthem was also seemingly overwhelmed by the magnitude of the impact from its data breach. It took the company five days to announce a breach (which took two months to discover) and quite some time to assess the scale and communicate with stakeholders. Its original disclosure, in February 2014, put the number of records potentially stolen by hackers at 37.5 million, but then it more than doubled that estimate, 20 days later, to 78.8 million.

As an estimated 50 million consumers were yet to be informed more than a month after the breach discovery, a Senate health committee had to intervene. But that wasn’t the end of Anthem’s missteps — it took customer's days after calling a dedicated phone line to receive a call back…

What Post-Breach Response ‘Should’ Have Looked Like…

Read Part 2

By Sekhar Sarukkai

Sekhar Sarukkai

Sekhar Sarukkai is a Co-founder and the Chief Scientist at Skyhigh Networks, driving the future of innovation and technology. He has more than 20 years of experience in enterprise networking, security, and cloud services development.

View Website
cloud challenges

Cloud Computing Predicted to Drive $554 Billion by 2021

Cloud Computing $554 Billion by 2021 It’s common to read news stories and research about certain segments of cloud computing ...
Is Your Data Safe In The Cloud?

Is Your Data Safe In The Cloud?

Cloud Data Safety This year has certainly been troublesome for businesses when it comes to data security. Numerous cyber attacks ...
4 Tech Cleanups For National Cyber Security Awareness

4 Tech Cleanups For National Cyber Security Awareness

National Cyber Security Awareness October is Cyber Security Awareness Month, and President Obama recently called upon the American people to ...
A Ray of Digital Sunshine During a Hurricane Portends Big Changes in One of the World’s Largest Industries

A Ray of Digital Sunshine During a Hurricane Portends Big Changes in One of the World’s Largest Industries

A Ray of Digital Sunshine Here’s something that will bring a smile: As hurricane Irma was about to slam into ...
R.I.C.E: Reducing Cost, Improving Compliance, Controlling Data, Enhancing Experience

R.I.C.E: Reducing Cost, Improving Compliance, Controlling Data, Enhancing Experience

R.I.C.E Therapy for Next Generation Customer Experience As industries worldwide adapt to the digital transformation that is modernizing many business ...
For AI to Change Business, It Needs to Be Fueled with Quality Data

For AI to Change Business, It Needs to Be Fueled with Quality Data

Quality Data and AI There’s no doubt that AI has usurped big data as the enterprise technology industry’s favorite new ...
Zero-Rating and Data Consumption

Zero-Rating and Data Consumption

Zero-Rating The ordinary mobile user often feels the need to backup their personal files only after they’ve lost it. It’s ...
How to protect your data with the 3-2-1 strategy

How to protect your data with the 3-2-1 strategy

How To Protect Your Data Every once in a while we all find ourselves in a situation where our data ...
What is the Benefit of Modern Data Warehousing?

What is the Benefit of Modern Data Warehousing?

Modern Data Warehousing Access to relevant customer and industry information is the primary competitive advantage businesses have over their direct ...
What Is Two-Factor Authorization?

What Exactly Is Two-Factor Authorization?

What Is Two-Factor Authorization? Two-factor authorization. Most of us think we know what it is, but a recent news event ...