Breach warden

The first and arguably most important step in dealing with a data breach is pre-emptive: nominate a “first respondent” to take command when a breach breaks.

“Appoint a team leader to manage and oversee the investigation,” computer forensics professional and founder of Inves-te-gate, Scott Mann, said. “The team leader will be responsible for keeping all risk owners and the business informed of the outcomes of the investigation.”

That respondent is the person in the hot seat when the breach happens.

Ducks in a row

The second step, also pre-emptive, is to ensure that you have access to the right technical information. Network access rights, logs, content filters, personal accounts, portable storage devices and content management systems are just a few of the many components that an investigator will seek information on.

If you have the correct information it’s possible to do a risk exposure assessment almost immediately once a breach has occurred.

“Accounting for all computer devices owned by the organisation is a good first test — if you can’t identify all the computers you own or that are connected to your network, there is a good chance that you don’t have good visibility of where data assets reside,” Mann said.

This information may be hard to come by if the IT shop is outsourced, according to Klien & Co director Nick Klien. “There may be a disconnect between the business and the outsourcer, and between the outsourcers themselves,” Klien said.

via Bracing for breaches: plan for the worst – Security – News.