Caught in the breach – what to do first

Breaches are a fact of life in a connected world. Experts at the MIT Sloan CIO Symposium talk about how to minimize the damage.

By Taylor Armerding
June 6, 2017

Hacked, unlocked, unsafe.

Security experts have been saying for more than a decade that it is "not if, but when" an organisation will be hacked. So, the more relevant question, posed in the title of a panel discussion at Wednesday's MIT Sloan CIO Symposium is: "You Were Hacked: Now What?"

Indeed, given that there is no sure way to prevent every intrusion by so-called, "determined adversaries," much of the defense playbook has shifted to incident response (IR). And that, said panelists, if done quickly and correctly, can mitigate the damage attackers can cause, even if they make it inside a network.

"Hacking is an action," said Andrew Stanley, CISO of Phillips. "A breach is the outcome. So we spend more time on the hack than the breach. We want to know how, why - what was the intent - when and where. That's what the C-suite wants to know more than the nature of the breach." Answering those questions is what helps make the response, and therefore containing the damage, more effective, he added.

James Lugabihl, director, execution assurance at ADP, agreed that the key to limiting the damage of a breach is, "how quickly can you respond and stop it." He said it is also crucial not to react without complete information. "It's almost like a disaster scenario you see on the news," he said. "It takes a lot of patience not to react too quickly. A lot of my information may be incomplete, and it's important to get everybody staged. It isn't a sprint, it's a marathon. You need time to recognise data so you're not reacting to information that's incomplete." With the right information, he said, it is possible to "track and eradicate" malicious intruders, plus see what their intentions were.

Both panelists said legal notification requirements can vary by country, or even by state, and if it is not a mandate, notifying law enforcement is something they will sometimes try to avoid. "Executives don't like it, because it becomes a matter of public record," Stanley said. "But it also can affect people's privacy, and you don't want to become an arm of the government."

Aside from who needs to know and who legally must know, Stanley said collecting information that can help with the response is the most important thing to do. "It's about intent," he said. "If all (phishing) emails are going to one location, that's an attack. So we need to ask: What do we do there? What's the target?"

Both also said they conduct tabletop exercises, pen testing and simulated crises to practice their IR for when the real thing happens. But, as Lugabihl noted, "it takes perfect practice to make a perfect response. Bad practice makes bad response."

1  2  Next Page