Introduction
According to a UK Government survey, “half of businesses and a third of charities report having experienced some form of cyber security breach or attack in the last 12 months.”
Cyberattacks are almost inevitable for many businesses, and even if you invest a lot of resources in cybersecurity, thanks to human error, no business can ever be completely impenetrable.
Knowing how to respond effectively is critical to minimising damage and protecting your organisation. Here’s a step-by-step guide to help you navigate a data breach response.
Step 1: Identify the Breach
If you have a half-decent incident response plan, you’ll know that the first step in any incident response is to confirm whether a breach has occurred.
If you can confirm that the breach has occurred and identify its cause, you will immediately be better able to deal with the threat.
Once you’ve identified the breach, you must assess the nature and extent of it. Ask yourself these questions:
- What data was accessed or stolen?
- When did the breach occur?
- Who may be responsible?
If the breach occurred by accident, all this may be relatively simple. If the breach was not an accident, then this may be time-consuming and costly—especially if you need to hire a third-party cyber forensics expert to assist.
Step 2: Contain the Breach
Once you’ve identified the breach, it’s important to contain it as quickly as possible to prevent further damage. This involves isolating affected systems, networks, or devices to prevent the attacker from continuing to access or exfiltrate data.
Be mindful of inadvertently destroying or modifying data that could be useful later in a forensic investigation into the true nature of the breach.
Step 3: Notify Your Incident Response Team
If you have one, you will likely do this before step one; however, if you don’t have an internal specialist team beyond your in-house IT professionals, now would be a good time to contact third-party IR providers.
This step isn’t necessary, but it is always something to consider. The larger the scale of the breach, the more likely a professional IR team will be required.
If this is the case, clearly communicate the situation and designate roles and responsibilities for immediate action. In most cases, it will be best to give the IR team complete control of the situation and facilitate as much as you can—there’s a reason they command the prices they do.
It’s also worth mentioning that if you have data backups that haven’t been compromised, once you are 100% certain that the breach has been contained, switch to your data backups to prevent prolonged downtime.
Remember, only do this if you are absolutely sure that it is safe to do so.
Step 4: Assess the Impact
Understanding the impact of the breach will certainly help you determine the next steps. Here are three things to look at.
- Data Sensitivity—determine if personally identifiable information (PII), financial records or intellectual property (IP) were compromised.
- Compliance—check whether the breach violates regulations like GDPR, the Data Protection Act or HIPAA.
- Potential Risks—assess the likelihood of identity theft, financial fraud, or reputational harm. If data has been stolen, the thieves may expect a ransom to be paid.
Step 5: Notify Stakeholders
Transparency is important when responding to a data breach and can often reduce the wider impact of the attack.
Explain to customers what has happened, how it affects them, and what steps they should take to prevent any further issues.
Depending on the compliance regulations you must follow, you may be legally required to report the breach within a specific timeframe. In the UK, you should report any data breach to the Information Commissioner’s Office (ICO) within 72 hours.
While doing this, depending on the scale of the breach, it may be helpful to inform local law enforcement, as they may be able to assist.
If you have any third-party affiliates or partners, you should inform them immediately so they can ensure that their systems are not compromised.
Step 6: Take Preventative Measures
Once the breach has been addressed, backups have been restored, stakeholders have been notified,, and the business is up and running again, take steps to prevent this from happening again.
You can use the information you have collected about the nature of the breach to begin patching vulnerabilities and improving your business’s security posture.
Hire a third-party penetration testing provider to carry out in-depth cyber security assessments, and use their remediation advice to reduce your attack surface and safeguard your assets.
If you have the resources, you may hire a third-party red team assessment to see how your business security would fare if you were targeted again.
Finally, invest in employee training, especially if the breach was a result of human error, and get regular vulnerability assessments. While these are not as in-depth as penetration tests or as realistic as red team engagements, this continuous monitoring can still be highly beneficial.
Conclusion
Thanks to human error, no business is entirely immune to data breaches, but a well-prepared response can make the difference between minor damage and business collapse.
By following this step-by-step guide, you can navigate any potential data breach, comply with legal requirements and restore trust with your stakeholders.
It’s also worth remembering that prevention is the best strategy. To reduce your risk, invest in robust cybersecurity measures and employee training.