With the average cost of a data breach now climbed to around $4 million, there's not a business model around built to withstand throwing away that kind of money. If you're not prepared for what to do if you get hacked, your problem could end up worse than you imagined. A data breach response plan starts with the right kind of preparation and training for everyone on your team.
Here are 4 steps to take to get your data breach plan started.
1. Set Up Alerts
In order to be prepared for a data breach, you need to do plenty of pre-planning. One of the most important elements when it comes to a breach is timing. If you don't know you're being breached, you're going to risk a bigger problem with each passing moment.
Data breaches are time-based. The longer a nefarious actor is in your system, the more information they can get from you. As they dig for more data, they put more and more of your customers, staff, or resources at risk.
You need to set up alerts so that everyone who needs to know about the breach is ready to act. Notifications can be set up to go out via email, via text, or via your company's own app or interface. However you set them up, they need to be fool-proof and immediate.
There should be tiers of alerts. The people who need to take a look and confirm that there's a serious data breach at hand also need to be the ones to alert the second tier. That tier, usually executives and management, should have tools at their disposal to alert the rest of the company.
2. Keep Off-Site Backups
If you want to protect your data from breaches, you need to have duplicates of it somewhere. While keeping backups close at hand might give you some amount of security, they should ideally be kept off-site. When you have off-site backups, they can remain secure and under the control of a third-party.
When you have off-site backups that are updated on a daily basis, then you won't lose very much work if you have to get rid of everything. If you suspect a data breach is in progress, ideally you'd be able to isolate that one nefarious user. However, that's not always possible.
When you can't isolate the user you don't want on your machine, you might need to flush your whole system. This isn't easy if you have too many balls in the air and too many projects in progress. However, if you were working on a project that was being backed up on a daily basis, all you'll lose is one day of work, if that.
Keeping off-site backups allows you to go back and revert to a previous version of a project that's going off the rails. It also allows you to pull the trap door when you need to get rid of an intruder.
3. Keep Individual Machines Secure
If you want to ensure you can approach a data breach responsibly, you need to have a plan that keeps all of your company machines secure. While it's tough to train all of your employees on the basics of cyber-security, a few small changes can go a long way.
Start by running a password clinic for your staff. It's important that your staff learn about why they shouldn't reuse passwords or use them for multiple sites or logins. You can teach them how to create words that hold importance to them, even if they don't appear in a dictionary.
Next, show them how to back up their own data in a secure way. You can use your own off-site backup or encourage them to have their own tools ready. Then you can ensure that they can keep their data secure at all times without having to look over their shoulder.
Teach your team about network security if they use corporate devices when out in the world. If they're relying on public WiFi, teach them how to encrypt their date. Show them some common phishing scams so they can be safe.
If a data breach occurs, teach them how to reset all of their passwords.
4. Maintain Physical Security
If you want to ensure that you have a plan for a data breach, you have to have some data on hand to trace back any breaches. If you don't have your office locked down, you need to ensure that you've got manual security records.
Any guests should be recorded and checked in. If you have an on-site data center, you need to maintain special access privileges for it. If anyone gets in unauthorized, someone on your team should be notified immediately.
Did you know your complimentary WiFi for guests could be getting you into trouble? If you're offering free WiFi or an open network anywhere around your office, that allows anyone to get in and start digging around in your data.
Your staff is going to have old credentials, unsecured equipment, and lots of ways for a clever hacker to tap into your system. Most software companies and hardware tools come with some default users attached to them. If a hacker can find out what tools you run and figure out what the likely default user credentials are, they could get in and start digging into your data in no time.
Secure your site as well as your networks to keep the wrong people out.
A Data Breach Response Plan Keeps You Aware
If you have the right data breach response plan in place, it's going to start by allowing you the chance to act instead of merely reacting. When you're in a defensive mode, you could even make a problem worse than it was when you started.
If you want to make sure your staff is secure when they're working remotely, teach them all about VPNs with our guide.
