Contact us anytime to know more — Kuldeep K., Founder & CEO CISIN
Start Your Incident Response Plan
Businesses generally discover breaches in one of four ways. Internal investigations revealed the breach; event logs or alerting systems discovered this.
Your bank then informed you that their reports of credit card fraud indicate you may have been compromised. Law enforcement officials discovered a breach when investigating the illegal sale of credit cards. Your company received a complaint from one of your customers who claimed that your company was the last place they used their card before it began accruing fraudulent charges.
When suspecting a data breach, take immediate steps. Your goal should be to stop information theft while fixing systems to avoid repeat breaches.
For best results, initiate your incident-response plan (IRP).
An effective incident response plan can minimize the consequences of data breaches, reduce fines and negative press coverage, and help your business recover faster.
You should develop and train employees to respond when data is breached.
We found that most businesses it investigated lacked an incident response plan during an intrusion attack, leaving employees to scramble without an organized plan and make errors without guidance - for instance, deleting an image before understanding what occurred and avoiding reinfection by mistake.
Keep Evidence
Organizations understandably want to address breaches quickly. Unfortunately, this could mean accidentally erasing important forensic data used by investigators to pinpoint when and how the breach happened and develop recommendations on how best to secure against similar attacks in the future.
Remember:
- Don't panic
- It would help if you did not act rashly because you are panicking.
- Do not wipe and reinstall your system (yet).
- Follow your incident response plan.
Limit the Breach
As soon as possible, isolate the system(s) to stop further damage and work closely with a forensic investigator on long-term containment strategies.
Pull the network cable from the firewall/router and unplug it from the Internet to stop data bleeding.
Document the entire incident. Record how and when you learned of a suspected breach, when and how you were notified, what information was contained in that notification, and actions taken between now and its resolution (disconnecting systems in card data environments from the internet, restricting remote access or changing passwords/credentials), any hardening/remediation measures taken, etc.
Disable wireless access points and remote access capabilities (but do not delete them), change passwords for all accounts, and temporarily suspend (but don't delete) non-critical ones (but make sure that documentation exists so they can be easily analyzed later).
Establish highly complex passwords consisting of uppercase and lowercase letters, numbers and special characters such as numbers or symbols.
Do not use passwords found in dictionaries when substituting special characters for letter characters.
Segregate all hardware involved with payment processing from other critical business devices. Move these devices to another network subnet and keep them powered so that no volatile data is lost.
Utilize your antivirus software to quarantine malware it detects for further examination and analysis.Keep an eye on firewall settings, firewall logging, system logging and security logging (taking screenshots as needed).
Restrict internet traffic only to business-critical servers and ports unrelated to payment processing environments.
If an investigator arrives before you can reconnect to the Internet, disconnect credit card processing devices that require Internet connectivity from all other devices before processing cards using dial-up terminals from your merchant bank. If you haven't done so already, notify your merchant processing bank of what has occurred and explain what transpired.
Hire an experienced law office when handling data breaches. While they won't come cheap, their expertise could save your brand from potentially devastating mistakes.
In some instances, your law firm can also recommend hiring a forensic company which will immediately investigate and contain the breach immediately; otherwise, if required by credit card companies, a PFI (PCI forensic investigator) is necessary, even if previously employed non-PFI firms were used.
Start Incident Response Management
Build Your Incident Response Team
Data breaches are crises that require teamwork to navigate effectively. Form an incident response team quickly; you should have already discussed your roles and formulated an incident response plan during crisis practice.
Your team should include a team lead, lead investigators, communications leaders, C-suite representatives, office administrators, human resources professionals, attorneys, IT and breach response specialists.
Each person brings different skill sets and has specific responsibilities when handling crises.
Consider Public Communications
Communication is of utmost importance when managing a data leak successfully, so the incident response team's primary responsibility should be deciding how and when to notify all those impacted.
Many states impose mandatory notification deadlines that merchants must abide by, so you should familiarize yourself with the laws applicable in your area and include instructions in your incident plan on how to make them.
Find a person responsible for notification in your company (perhaps an in-house legal counsel, breach management firm or C-level executive).
It will be their job to ensure messages are sent in a timely fashion that meets state requirements. Your response to data breaches will be judged heavily.
Stalling May Not Be In Your Best Interest
Customers will abandon you if you withhold information regarding a data breach. Media reports could label your brand untrustworthy if this information remains withheld from them; this could have more devastating results than any other consequence of the violation.
Many companies wait until they know all the details before issuing any statement; however, excessive delays could be seen as a cover-up by customers and could lose you customers. At least provide some information; your website can constantly be updated. In all situations involving public statements, always seek legal advice first.
Be Sure That Your Employees Don't Announce The Breach Before You Do
Employees who are poorly informed can spread misinformation, whether true or not. Create a media policy as a team that specifies who can speak to media on a breach situation and assign one spokesperson; ensure employees know that they cannot comment on it.
Before notifying employees about a data breach in your company, it may be prudent to wait until just before making public announcements.
Prepare Your Statements
Your incident response team must create statements for different audiences, such as press releases, customer statements, internal/employee messages and holding announcements.
They should be sent out to those affected, such as third-party contractors, stockholders and law enforcement authorities.
It would help if you addressed questions such as:
- What locations are affected?
- How was it discovered?
- Is there any other data that may be at risk?
- What will be the impact on customers and community?
- What kind of services and assistance will you offer your customers (if any)?
- What will you do to avoid this happening again, and when will you be able to run normally?
Explain to your client that you will do everything possible to resolve the problem and protect their information and interest.
You could, if you think it is appropriate, offer an apology or other assistance.
Investigate, Fix Your Systems, And Implement Your Breach Protection Services
Asserting that there has been a breach is only part of managing it; now comes the hard part - investigating and fixing everything that's gone wrong.
Don't go it alone, though: PFI will conduct most of their investigation while offering advice as to how your environment can be made safer.
Restore Affected Systems to Online
It would help if you ensured that all systems were hardened, tested, and patched after identifying and eliminating the source of the breach.
Ask yourself the following questions during this process:
- Are you sure that all the changes recommended have been implemented?
- All systems have been patched and hardened.
- What is the test?
- What tools/reparations can you use to protect you from similar attacks?
- How will you stop this from happening again in the future? Who will be responsible for responding to security notifications, monitoring security, Intrusion Detection System and firewall logs?
Prepare yourself for these costs
Financial impacts of data breaches can vary considerably, depending on factors like your organization's size, the stolen customer cards involved and how hackers gained entry to your system; whether or not hackers knew about vulnerabilities; whether or not breach protection services were used; and so forth.
Financial damages due to data breaches can be devastating.
Data Breach Policy & Procedures
Policy Statement
It is committed to fulfilling its obligations under regulatory frameworks and GDPR. To this end, we have implemented a structured and robust program to monitor compliance.
Risk and gap analyses are regularly performed to ensure our compliance functions, processes, and procedures meet their purpose; where necessary, mitigating measures may be implemented as appropriate.
We understand the risks cannot permanently be eliminated; therefore, we have implemented a systematic and robust system of measures, controls, and processes to safeguard data subjects, their personal information, and ourselves against inherent risks associated with data processing.
We are dedicated to protecting and safeguarding all the personal information collected or utilized.
Purpose
This policy aims to clearly outline our intentions, objectives and procedures concerning data breaches that involve personal information.
This policy only applies to violations that involve such personal data and comply with GDPR breach requirements.
Under GDPR, we have obligations and must ensure all relevant procedures, controls, and measures are in place and communicated to employees in case of a breach.
This policy outlines our methods for reporting, sharing, and investigating any violations that may have taken place.
Strives to prevent data breaches as much as possible; however, human error and risks in business cannot always be avoided, thus leaving room for breaches to occur.
As part of our responsibility in managing data breaches effectively for employees, supervisors, and any other bodies involved, we must create protocols for handling them so everyone knows how to respond when one arises.
Scope
This policy covers all employees within (permanent, temporary and fixed-term staff, subcontractors or representatives, agency workers, interns, volunteers and agents working in Denmark and internationally) who come under its jurisdiction.
It was devised to ensure staff abide by legal, regulatory and contractual expectations and requirements.
Data Security and Breach Requirements
Defines "breach of personal data" for this policy as any security breach, lack of controls, system failure, or error that leads to the destruction, loss, alteration, or unauthorized disclosure or access of personal information.
Our organization takes privacy very seriously and has legal and regulatory obligations to safeguard data. Our primary priority is protecting it when shared, disclosed or transferred; accordingly, our Information Security Policies & procedures and GDPR Policies & procedures contain detailed measures taken by us to secure personal information.
Our organization conducts information audits to ensure all data we hold, and processes are recorded and accounted for, along with risk analyses to assess the potential repercussions of data breaches on subjects.
Furthermore, we have implemented appropriate technical and organizational safeguards that provide adequate protection - this may include (but is not limited to):
- Encryption personal data
- Restricted Access
- Review, auditing and improvement of plans to ensure the confidentiality, integrity, availability, and resilience of systems and services
- Disaster Recovery and Business Continuity Plan - to ensure that backups are up to date and secure and to restore availability and access to personal data quickly in case of a physical or technological incident.
- Regularly conduct audit procedures and stress tests to evaluate, test, and assess the effectiveness of the measures and compliance with data protection laws and codes of ethics.
- All staff should be trained regularly and continuously on the GDPR and its principles and how to apply these regulations in each job, duty, and company.
- Staff assessments to ensure high levels of competence, knowledge, and understanding of data protection regulations as well as the measures in place to protect your personal information
- Recheck processes and ensure that the Data Protection Officer is involved in all cases where personal data is being transferred, disclosed, or shared or when it is time to dispose of them.
Objectives
- Adherence to GDPR and Danish Data Protection Laws and robust procedures for detecting, investigating and reporting personal data breaches are crucial.
- Implement appropriate organizational and technical measures that guarantee high levels of security regarding personal information, using auditing and risk analysis tools such as data mapping to reduce breaches in personal information security.
- Have effective procedures for risk assessment to assess any risks posed by processing personal information and ensure all data breaches are reported within the specified timelines in their codes of conduct or manuals.
- Use breach logs and investigations to accurately understand what caused any incidents and conduct a thorough review to prevent future incidents, using the Compliance Breach Incident Form for all data breaches - regardless of severity - to identify patterns and correct them as soon as possible.
- Protecting clients, customers and employees - their data and identities
- When applicable, It is imperative that the Data Protection Officer be informed about any data breaches or risk issues within an organization.
- As soon as a data breach is identified, immediately notify the Supervisory Authority and try to do it within 72 hours of knowing about it.
Data Breach Procedures & Guidelines
Has implemented stringent controls and objectives to prevent data breaches and effectively respond when they occur.
Given our business nature of processing and storing sensitive personal information, we have implemented a structured breach incident program to minimize their effects and ensure all relevant notifications are sent out as quickly as possible.
At our processing activities, personal data storage, transfer and destruction operations, we perform regular risk analyses and audits with gap analysis reports to ensure all compliance processes, functions, and procedures meet their purpose and reduce risks where possible.
Breach Monitoring & Reporting
Has appointed a Data Protection officer responsible for reviewing and investigating any data breach involving personal information regardless of its severity, impact or containment.
When any breach occurs, they will be immediately informed regarding forms and procedures as detailed within this policy being immediately implemented.
Even when notifying and reporting is not required, we investigate all data breaches. In addition to keeping a complete record of such violations to perform gap and pattern analyses, when an error causes a data breach due to system or process failure, revision of any such process will be recorded within our Change Management and Document Control Records.
Also Read: Establishing An It Incident Response Plan
Breach Incident Procedures
Identification of an Incident
Data breaches must be reported promptly to the Data Protection Officer so that procedures can be implemented and followed.
Our compliance relies upon reporting incidents swiftly and fully; nothing should never be about assigning blame; instead, it protects employees, customers, clients, and third parties, as well as legal regulations.
As soon as a breach has been identified, immediate steps should be taken to mitigate its damage. Due to its wide array of violations and measures that may be taken for each one, this document cannot cover them all in detail; any actions taken must aim to reduce further risk or breach for the organization, customer/client, third-party system or data before initiating investigation and reporting processes.
Breach Recording
Utilizes the Breach Incident form as its official incident report form for all data breaches, regardless of severity.
Once completed, this form is stored in Our Breach Incident folder and reviewed to identify patterns or recurrences in data breaches. The Data Protection Officer is responsible for investigating data breaches, including assigning staff members who can contain them and then filling out the Breach Incident form after containment.
The Incident Form is used to document the results of an investigation and communicate them to upper management and all employees involved in any violation that has taken place.
Once completed, this form will be filed in the Audit & Records section for filing purposes.
Notification of Breach Notifications per GDPR requirements must include notifying any affected individuals. Ideally, one should abide by their Supervisory Authority protocol and submit their Security Breach Notification form; any individual whose data was compromised will also be informed accordingly and receive a full report with findings and actions taken as appropriate.
Breach Risk Assessment
Human Error
Suppose the breach was due to human error. In that case, a thorough investigation must be conducted in addition to interviewing employees in a formal setting.
Our existing risk evaluation procedures call for the comprehensive examination of any strategy linked to the breach and conducting a complete risk evaluation to address identified gaps that contributed to or caused it.
Any risks identified must also be assessed to avoid a repeat of its root cause.
System Error
When data breaches arise due to system failure or error, IT teams should coordinate with their Data Protection Officer in assessing risks and investigating root causes.
A Breach Incident Form should also be completed and updated with an analysis of the systems involved, a gap analysis report and a full review as soon as possible.
A review of gaps that contributed to or caused the breach must take place to assess risk, prevent a repeat of its cause and mitigate its impact.
It is crucial to assume a complete and detailed account of every incident and take corrective actions as soon as possible:
- Recovering lost personal information or equipment
- Shutting down a computer system
- Remove an employee from their tasks.
- Use of backups to restore information that has been lost, damaged or stolen
- Building security
- The staff must be informed, and the codes must be changed immediately if there are any codes or passwords involved.
Assessment of Risk and Investigation
The Data Protection Officer must identify what data was compromised and take measures to rectify and prevent further breaches.
A lead investigator should keep a comprehensive and transparent report covering every aspect of an incident and what steps were taken to preserve evidence, notes from interviews or statements conducted, assessment of risk/investigation undertaken, and recommendations/action plans for the future.
Breach Notifications
It is aware of its obligations to report certain data breaches. We have strict reporting guidelines to ensure data breaches that meet the criteria for notification are reported promptly.
Supervisory Authority Notification
Notify the Supervisory Authority immediately of any violation that threatens individual rights and freedoms; if left unpunished, consequences could be severe for that individual.
As soon as a breach is identified and investigated, we will notify the Supervisory Authority quickly and within any specified timeline. A detailed report with all results and mitigation actions will be delivered promptly at that time.
Suppose it is impracticable to notify the Supervisory Authority within 72 hours of an incident. In that case, notification will still be sent promptly, explaining any reasons for its delay.
In instances where breaches do not directly threaten individuals' rights or freedoms, our Data Protection Officer may choose instead to inform them under Article 33 of GDPR.
The notification sent to the Supervisory Authority contains: -
- Description of the breach of personal data
- The data categories and the approximate number of subjects affected
- The categories of data and the approximate number concerned
- Name and contact information of our Data Protection Officer and other relevant points of contact for further information
- The likely consequences of a breach of personal data
- The description of any measures that have been taken, or are being taken, to deal with the breach (including the mitigation of its potential adverse effects).
In the event of any breach, we always conduct an investigation and follow-up regardless of whether we must notify.
In addition, all reports will be stored so they can be made available upon request to our Supervisory Authority.
Will notify any controller of any breaches to personal data if acting as a processor. Written agreements have been in place with any external processors acting as controllers; should such instances arise, the external processor must immediately notify us should any breach in personal data occur.
Data Subject Notification
We will notify the data subject of a breach in personal data without delay and in an easily readable format.The notification shall include:
- What is the nature of a breach?
- Name and contact information of our Data Protection Officer and other relevant points of contact for further information
- The likely consequences of a breach of personal data
- The description of any measures that have been taken, or are being taken, to deal with the breach of personal data (including the mitigation measures)
We reserve the right not to notify data subjects of breaches where appropriate technical and organizational security measures have been put into place, making the data incomprehensible to those not authorized accessing it (i.e.
we reserve our right not to inform data subjects about breaches where sufficient measures have been put in place that make their data unintelligible) (i.e. we've taken steps that make their data unintelligible).
Record Keeping
The Data Protection Officer must sign and record all records and notes compiled during the identification, evaluation and investigation of a data breach incident.
They are then kept for seven years after their date. Monthly incident forms should also be reviewed to identify patterns of recurrence and to establish what actions must be taken to prevent future incidents.
Responsibilities
Ensures its staff have access to sufficient time, resources and support to understand, learn and implement procedures outlined within this document.
In addition, they will be informed about their responsibilities and reporting incidents. The Data Protection Officer performs regular compliance audits, monitoring gap analyses, reviewing results and implementing them into policy.
The Conclusion Of The Article Is
Make sure you have an incident response plan, practice it regularly, and conduct annual simulations or desktop runs to test its efficacy.
Otherwise, staff could become panicky in an emergency and act erratically. A data breach can be one of the most terrifying experiences for businesses or organizations. Yet, it doesn't need to mean disaster for your organization.
Develop and test an incident response plan ahead of time to protect your brand and prevent lasting brand damage.
