Magazine menu Close Magazine menu

Security Bytes

Senior security professionals share their most savvy advice in the Security Bytes series.

Latest stories

security bytes privacy reputation

How to build customer trust when a data breach happens

  • min read
    • Although common in all kinds of organizations and businesses, data breaches still make striking headlines. We all work hard to prevent them, but how should you communicate about data breaches when they happen? I asked several cybersecurity experts with incident response experience: Some chose to speak under a pseudonym, but all share sound advice that could help save your company's reputation when, despite your robust work to protect it, a cybercriminal succeeds in accessing your information. Hire the best PR firm Principal Security Consultant L0ra thinks a well-coordinated, experienced PR firm can best handle your company's reputation. She also believes the public responds well when companies admit their mistakes. "The biggest mistake companies make is glossing over their failures, but breaches happen every day. It isn't the first time. It won't be the last. "If the breach is large and public, immediately hire the best PR firm you can afford. "Sometimes, in response to a data breach, you get a raid. That's when a group of people comes at you on the internet. The number one rule for dealing with a raid is, log off and keep quiet. So you need a good PR firm to speak on your behalf." Communicate through the right people, and learn from mistakes Ray Hayes is Senior Software Engineer, Enterprise and Security at Microsoft. He highlights the importance of knowing who you're speaking with and learning from mistakes. "I don't speak about any incident off-the-cuff. I refer all inquiries to my leadership team. "If I'm asked informally about a major data breach or any other incident at my company, I make conversation, but keep it general, and make sure I know who I'm talking to. "Breach response is critical, but prevention is key. "Anyone starting a new job should think, "What could happen if the information I'm working on now was released?'" Involve everyone in planning – before it happens Security engineer Daniel says responding to data breaches must involve more than just the technical people. You need legal experts and business communicators too. "All companies should prepare for data breaches, especially those with data worth stealing. Small- and medium-sized businesses (SMBs) more often don't recognize the threat. "Before it happens, get everyone involved in making a crisis plan, not just IT. It's not only a technical problem. Involve legal, finance, safety and everyone else. They have valuable insight tech people often don't, and will have their own tasks to do when it happens." Tell customers affected, quickly and honestly James O, Director of Information Security, says informing your customers truthfully is a must. "Our insurance company gives us a Breach Coach to help our PR firm get the messages right. We also coordinate with internal communications to inform the families we serve, and start telling affected people as quickly as possible. We also report under our state data breach laws. "Companies could improve their data breach PR. When my data was accessed in a financial company's breach, I just got a form letter saying, here's your year of identity protection. "At least they included the root cause – leaving generic credentials on a public box – but that doesn't give me confidence that it won't happen again." Avoid the 'sophisticated attack' cliché Security Analyst http_error_418 says PR is vital, but companies must stop exaggerating cyberattackers' skills. "Companies often handle breaches with platitudes. They'll say the attacker was 'advanced' and 'sophisticated.' That's because, when it's later shown their app wasn't patched for eight years, investors are over the initial fright. "We also need to consider when transparency helps, and when it's overkill. "The public often don't fully understand what transparency reveals." Update regularly and learn from the best Cyber Threat Intel Analyst HackerPom points to an example of good practice. "When they know the facts, executives, PR and legal should give the media and customers regular updates. For a good example, look at Norsk Hydro's response to a bad data breach. Their communications were clear and straightforward." Better to overstate than understate the impact Joonatan Kauppi, Founder and CEO of Leijona Security, has several pieces of good advice. "If you're unsure of the impact, it's better to overstate than understate. If you downplay it, then word breaks that it's much more serious, you'll get worse press. "Bring the regulatory authorities into the loop straight away. "Inside the organization, start damage control, and don't skimp on costs. Gather the facts and inform your communicators. "Answer questions from security researchers and other InfoSec people. They ask the right stuff and are a good platform to communicate what happened. "Prepare for the flurry of questions you'll get from people or parties affected. Don't blame. Concentrate on reducing the impact of the breach." Make sure your plan fits all scenarios David Emm, Principal Security Researcher at Kaspersky, says to make sure you're planning for the full range of data that might be breached. "Balance technical and PR in responding to a breach. You can only do this well if you have a process for managing security incidents. Involve the right people across the organization – including IT, HR, legal and PR – and work out a plan before anything happens. The light of experience There are strong themes from these experts when it comes to how to communicate around data breaches. I'm hearing almost everyone say, plan for how you'll respond before it happens, involving people across the organization. Several say, to use the best PR available, and communicate with speed, honesty and regularity. By sharing the right information at the right time, in the right way, you'll get the right outcome: customers understanding how they're affected, and appreciating what you've learned. Article reflects the opinions of the author and speakers quoted. Published in 2019.
security bytes data breaches

Advice from the pros: How to deal with a data breach

  • min read
    • I've a confession to make: I hate writing about data breaches. They're so frequent these days that I'm sure we've all been harmed by multiple breaches per person, whether we're aware of it or not. I've a feeling that for every data breach that's reported in the media, there are hundreds that people never hear about or the company isn't even aware of. The data breach phenomenon will escalate over time. So the more infosec professionals can help educate the businesses they work for and implement best practices, the more we can protect them from the worst effects of a breach. In the Security Bytes series, I share senior security professionals' most savvy advice. This time I spoke with cybersecurity professionals who were courageous enough to share their data breach stories with me. Each professional had to deal with a data breach incident firsthand. I've kept some details anonymous given the sensitive topic. But the insight here can help you respond to data breaches more effectively. The question: Daniel Ruf, Developer and Security Consultant First responses are critical to contain a data breach. Daniel Ruf was contracted to work for one anonymous project owner. Ruf described the first thing that happened that led to the discovery of a data breach. His quick and careful actions are a great example of how to handle a breach. "One evening, through a system monitoring alert, I became aware of a 99 percent CPU usage of our root server which impacted the availability of other websites using the same server. I informed the project owner of the hacked website, then started my first analysis. Next, I blacklisted the IP address of the attacker, blocked system access, then killed the suspicious processes. I archived as many files as I could from the project owner's web server for further analysis and conducted a system integrity check, then informed the project owner. "The culprit? A hacked CMS instance. I wasn't informed about the creation of this instance, which then used different webshells to start attacks, including cryptojacking (illegal cryptomining) which used up all our available computing resources." The major factors that led to the breach were the use of weak and reused passwords and an overall lack of robust security measures. Don't let this happen to you! Teagan M, Security Practitioner, Founder Green Duck Consulting, LLC Teagan described the data breach she dealt with. This is a common way that people can have their data compromised at work. Smaller companies and start-ups must be careful to be more thorough about their security, and realize that it's not just a problem that can be resolved with technology alone. "An authorized source had access to an email environment that was unauthorized and lasted, the first time, for four weeks. This company was very disorganized and treated security as a compliance issue instead of an actual business function. "The credentials to the user account were most likely captured by a phishing attack, and the attackers set up an email forward rule to send all emails to a Gmail account controlled by the attacker. The second time it happened, it was the same thing but I caught it much sooner. It was after the second event the company finally followed my recommendation to implement 2FA (two-factor authentication). That event still resulted in an exposure which required the company to report the incident under state data breach laws. "This was a small company that was growing fast. They didn't have the leadership in place they needed, nor did they want to properly compensate the necessary security talent. They burned through many security analysts due to weak and inexperienced security C-level management and a desire to appease audit requirements instead of securing the business. "They considered security to be a technology problem and continued buying services and equipment with no clear plan about how to integrate or manage any of it. They took their strategy from sales reps instead of properly planning their own path. "I worked closely with the C-level leadership to try to improve their program and was met with resistance the entire time. They'd give security 'lip service' but no action or empowerment. Things started to change slightly towards the end of my tenure there, but by that point I'd been burned out and needed to leave to preserve my own mental state." This naivety Teagan dealt with is one of the reasons why data breaches are so alarmingly frequent. 'BM', Former Infosec Analyst It's important to remember that large companies need to improve their data security too. BM shares a useful lesson to help anyone who secures data in any industry. 'BM' previously worked as an analyst, security engineer and later a consultant, for multiple companies. They've dealt with post-breach data forensics, incident response and triage work. 'BM' described a breach they dealt with. "When I was a consultant, I was sent to a Fortune 500 company for an incident response event. Their system was completely compromised and the attacker was threatening the CEO of the company to expose the breach. We immediately jumped on a flight. "For a full week, my manager and I reviewed the security logs and developed a remediation plan for the company. Although the company was very valuable, they had a relatively small IT staff. Much of our work was educating the team about exactly what happened, reviewing their logs, and working with them to upgrade their infrastructure. For example, they were running older versions of Windows on their entire network. "Fortunately, the incident was determined to be minor. It was pretty much a 'script kiddie' using easily available software to exploit unpatched versions of Windows. This turned into a full week of over twenty-hour days and numerous conversations to determine what could've been done better." Over twenty-hour days? That's ridiculous! It's important to educate all of your employees about security awareness. And also to make more effective use of your security staff – don't let it become a crisis management situation for external consultants to resolve. Sameep Agarwal, Information Security Consultant and Penetration Tester I've spoken with Sameep before about his data breach experiences – he's experienced several in his career. This story illustrates how personal conflicts can interfere with incident response and why it should be overcome. "A server was provided by the vendor for hosting a specific web application in a test zone. One day, flags were raised by the security team over an untested and unverified application. It was decided that since the hosting was being set up in a hurry, server hardening activity, which requires at least five working days, couldn't be completed. So internet access to the test zone server was never allowed in the initialization. "Since the vendor representative wasn't present at the client's location, server access was requested for remote administration. This was also raised as a security concern, but was overridden by the federal agency. "Operations on the targeted server started. After three days, a few updates from Microsoft were installed without verification of the update bundle. The virtual server was residing on obsolete out-of-life hardware taken from a previous government project which had many critical flaws. Since the physical server was out of life, it was not recorded in the federal agency's inventory. This meant intrusion prevention and anti-malware clients were not installed but it was accessible on their network infrastructure. "The attacker installed Telegram's desktop application, and joined the Iranian hacker group on Telegram. They started downloading applications for anonymity like proxy tools, VPN and bots. Later, the attacker added many dictionaries and combo lists containing common passwords for applications for cracking social media accounts like Instagram and gaming accounts like Fortnite. "The affected server traffic wasn't directed through the firewall because of exceptions made by the federal agency override. And because of the exception, the data breach couldn't be easily detected. "The intelligence agency investigation concluded that the blue team (defensive security specialists) made many exceptions based on personal relations to please the federal agency head. The key security findings of the red team (security testing specialists) were ignored time and again. The investigator suggested a deep probe on the intentions of insiders, and the psychology which allowed the attacks to happen, even after prior threat intelligence was available a month in advance." People are often the weakest link in security. It's important to have IT staff who have integrity and the right level of security awareness training. How to protect your business from data breaches Data breaches aren't purely technological in nature, they're also problems caused by people. The dangers posed by cyber-attackers is significant, from 'script kiddies' to advanced persistent threats (APTs). None of this surprises me. What did surprise me was how the businesses my interview subjects worked with worsened the data breach problems through a lack of personal integrity, or sometimes just through carelessness. Businesses need to start taking security more seriously by spending money, time and effort to better protect their, and by virtue their customers', data. I'm hopeful that by sharing these stories with you, cybersecurity professionals will be better prepared for the (not so) good, the bad and the ugly of data breach incident response.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries