As the ongoing recent Yahoo hacks illustrate, digital threats are ever-present and can be very dangerous to the reputation of a company and the client data it houses.
But unfortunately, like death and taxes due to the sophistication and adaptability of cyber criminals, a cyber hack within the lifetime of your organization is nearly inevitable.
That’s why professionals like Terry Kurzynski, senior partner at HALOCK Security Labs, cautions fellow professionals to be realistic and consider both prevention and response when drafting their cyber preparation plans.
“The industry needs to invest more in incident response capabilities versus only on protection investments,” he says.
Hear from Kurzynski and other legal leaders on the essential topic of cybersecurity for in-house and general counsel in this complimentary industry report from Modern Counsel.
And get started with these six proactive steps on the management of an effective cybersecurity plan and then turn your attention to these response tactics.
Here are six simple ways to respond to a data breach efficiently and effectively from the pages of Modern Counsel’s report, The General Counsel’s Guide to Digital Defense.
A key component is creating a complete Incident Response Plan that focuses on procedures that serve to reduce time in-between compromise and remediation. This should be a matter of minutes or hours rather than days or weeks.
- Survey: This includes conducting an overall survey that assesses the damage, discovering and remedying the source(s) of the vulnerability, and identifying the attacker(s).
- Limit: This step and the survey step work hand-in-hand as pivotal elements to limit the potential damage and reduce the company’s chance of liability. This step includes limiting any additional damage, isolating any compromised systems, and filtering traffic away from the breach.
- Record: In every industry, but especially in legal when much sensitive data is protected by attorney-client privilege, documentation is essential. Following any hack, your organization needs to record the extent of the damage including any effects for the firm or its clients and identify any potential disruptions of service offerings.
- Engage: It’s important to involve several parties following a hack. Organizations and individuals who should be notified include law enforcement (including local police and the FBI) and the district attorney. The earlier this is done, the less chance for public lawsuits and PR mishaps.
- Notify: Not only do you need to notify the legal authorities, there are several additional groups, including clients, vendors, and any other parties who were affected and need to be told. This is also a good opportunity to contract legal counsel who specializes in cybersecurity matters, if you don’t currently have one on staff.
- Learn: With a cyber hack all but guaranteed in today’s digital first world, it’s critical for organizations and their clients to document the circumstances before, during, and after a hack. But documentation is just the first step and has to be followed up with proactive company-wide training.
To learn more, like how much money your organization could lose per hack without proper training, download our legal industry white paper, The General Counsel’s Guide to Digital Defense. The Legal Side of Cybersecurity.
