In a recent blog by Chris Pogue (a digital forensic expert), he highlighted a handful of considerations for firms both pre and post data breach. After all, the issue is not really whether you will suffer a breach, but when and how bad will it be.
Those considerations bear repeating, and include the following:
- Retention of counsel to navigate the firm through the legal issues that arise from a breach.
- Retention of external forensic experts to triage when a breach takes place.
- Notification of relevant law enforcement, such as the FBI regarding the breach.
- Designate one person in the company who will communicate in response to media inquiries; ensure the accuracy of whatever is said because you cannot take it back.
- Fully inform executives, investors, the board of directors and customers regarding the breach; i.e., what happened, why and what is being done to remediate.
- Should you pursue the hackers criminally/civilly, or focus on the remediation and prevention of future breaches.
Taken together, these considerations have one focus. You want to able to demonstrate to your constituents that you took immediate action to understand what happened, correct why it happened, and put yourself in the best position to avoid it from happening again.
In light of the highly sophisticated nature of the hackers, it may be impossible to prevent a breach of some kind. It is not impossible, however, to have an action plan to deploy in the event of the breach so that you can protect your company in your constituents’ minds. Prepare now or pay for it later.