3 ms·

Quick bullet points on the steps a company should perform when a data breech comes to light?

by ian0 7y ago

wglb 7y ago
It can be a complex, painful process. It will involve looking at log files for just about anything, resetting some set of passwords, engaging outside counsel, engaging a forensic/IR firm. And it is often a race against various competing priorities. For example, if there is an attacker actively working into your system, one temptation is to totally turn that ingress off. However, if the attacker is sophisticated, then they know that they have been detected, and may well find yet another route into your systems that is harder for you to spot. This can be proactively addressed by having an IR plan, and occasional table-top exercises too address select scenarios. Executive buy-in is critical.
autoexec 7y ago
If you don't have internal IT folks and an incident response team already in place you're going to need to bring in some outside assistance. - Take all compromised or infected systems offline immediately and have them carefully examined to determine what data those systems contained (customer, internal, and employee) and what was exposed to attackers. - look for additional signs of compromise in other systems as well paying close attention to those connected with the ones that were compromised - log and record everything extensively throughout the process - consult with your lawyers to see what legal obligations you have to disclose the breach publicly - notify everyone directly impacted by the breach as soon as you've identified them so they can start taking steps to protect themselves. Don't wait until you have all the details, you can update them as more information is discovered. - Make sure you have professionals to perform the investigation and re-secure your impacted systems before they are put back online. This isn't the time to count on that one guy in the office who "knows computers real good" to fix it. - continue to keep extensive logs and keep a close eye on everything for a time after the attack to make sure you're not compromised again. If you can manage even that much you're doing better than most of the companies I've seen who were hacked. I've seen banks leave compromised systems connected to the network for months after being notified. I've seen some pretty large companies refuse to bring in outside help because they don't want the expense even after they get hacked over and over. Many small to midsize companies try to handle everything as quietly as possible and never tell anyone what happened.

Quick bullet points on the steps a company should perform when a data breech comes to light?

by ian0 7y ago

Quick bullet points on the steps a company should perform when a data breech comes to light?

wglb 7y ago

It can be a complex, painful process. It will involve looking at log files for just about anything, resetting some set of passwords, engaging outside counsel, engaging a forensic/IR firm. And it is often a race against various competing priorities. For example, if there is an attacker actively working into your system, one temptation is to totally turn that ingress off. However, if the attacker is sophisticated, then they know that they have been detected, and may well find yet another route into your systems that is harder for you to spot. This can be proactively addressed by having an IR plan, and occasional table-top exercises too address select scenarios. Executive buy-in is critical.

autoexec 7y ago

If you don't have internal IT folks and an incident response team already in place you're going to need to bring in some outside assistance. - Take all compromised or infected systems offline immediately and have them carefully examined to determine what data those systems contained (customer, internal, and employee) and what was exposed to attackers. - look for additional signs of compromise in other systems as well paying close attention to those connected with the ones that were compromised - log and record everything extensively throughout the process - consult with your lawyers to see what legal obligations you have to disclose the breach publicly - notify everyone directly impacted by the breach as soon as you've identified them so they can start taking steps to protect themselves. Don't wait until you have all the details, you can update them as more information is discovered. - Make sure you have professionals to perform the investigation and re-secure your impacted systems before they are put back online. This isn't the time to count on that one guy in the office who "knows computers real good" to fix it. - continue to keep extensive logs and keep a close eye on everything for a time after the attack to make sure you're not compromised again. If you can manage even that much you're doing better than most of the companies I've seen who were hacked. I've seen banks leave compromised systems connected to the network for months after being notified. I've seen some pretty large companies refuse to bring in outside help because they don't want the expense even after they get hacked over and over. Many small to midsize companies try to handle everything as quietly as possible and never tell anyone what happened.