how to manage a data breach

How to manage a data security incident - Ten tips from a breach practitioner

Dan MichalukSeptember 24, 2015

How to manage a data security incident

1INITATE RESPONSE ASAP


Initiate response ASAP

• Time is one of your two most important assets• You will start in a hole if the incident is not

identified and escalated immediately• Have a policy with a clear duty• Train to the duty


2DON'T REST ON ASSUMPTIONS


Don't rest on assumptions

• Information is your other important asset• Probe in areas of discomfort*• Find the facts and the evidence• Ask, "What data elements are we dealing with?"• Ask, "Who is affected?"• Ask, "What is the risk to the affected?"

*vendor breaches raise special considerations


3KEEP THE BALL MOVING


Keep the ball moving

• Incidents can be complicated• You deserve reasonable time to understand • Your timeliness, however, may be judged• So strive for progress and constant movement


4DON'T RUSH


Don’t rush

• Once you put information on the public record you are stuck with it

• Once you put information on the record you suffer a loss of control

• Never go to the regulator for advice before you know what you are dealing with

• Strive for a confidence level of 90%• If you need to, send a "placeholder" notice


5OBTAIN OBJECTIVE INPUT


Obtain objective input

• You are human correct?• You may be influenced by a feeling of guilt• You may suffer a temptation to downplay a

problem• Enlisting an outside lawyer and/or crises

communication professional may help


6OBTAIN TECHNICAL INPUT


Obtain technical input

• IT investigating IT can be a problem, especially in smaller organizations

• If "who" and "how" need to be determined, you may need technical (forensic) help


7TAKE A BROAD VIEW OF NOTIFICATION


Take a broad view of notification

• Consider statutory and professional obligations• Consider the forseeability of harm• Consider whether people are going to find out• Yes, there are cases in which notification is not

appropriate


8PUT YOURSELF IN THEIR SHOES


Put your self in their shoes

• And ask, "What would I want to know about this?"• Describe all data elements clearly• Include all of the basic facts that shed light on the

risk


9DEMONSTRATE COMMITMENT TO DOING BETTER


Demonstrate commitment to doing better

• Please avoid platitudes like "we value your privacy"

• Demonstrate your commitment by saying what you are going to do

• Draw on a strong root cause analysis and make a genuine commitment to things that will be effective


10APOLOGIZE


Apologize

• Beware of your jurisdictional exposure when considering statutory privileges

• Good information supports a good apology• Acknowledge, accept responsibility, express

regret• By a senior spokesperson who can demonstrate

empathy

How to manage a data security incident - Ten tips from a breach practitioner

Dan MichalukSeptember 24, 2015

how to manage a data breach

Law