Is Your Organization’s New Years Resolution to Be More Secure?

Is Your Organization’s New Years Resolution to Be More Secure? If not, it should be!

However, that is too easy to say, and very hard to accomplish. The current threat environment is expanding far faster than the controls can hope to keep up with. A CISOs / CSOs job has never been harder; a trend that will continue this year and on into the future. If you don’t believe that call up organization’s like SONY, ebay (one of the least talked-about giant data breaches of the year), Target, JPMorgan Chase, Home Depot, Community Health Systems, or the 321 other healthcare organizations reporting breaches affecting over 83 million individuals! In fact, healthcare breaches accounted for a whopping 42.3% of data breaches included in the just-published Identity Theft Resource Center 2014 Data Breach Report(1).

Threat vectors include all of the usual suspects that we have been talking about for years. But the massive proliferation of data, accelerating migration to remote and teleworkers, and huge increase in activity of nation-states, organized crime, and hacktivists all make the CISOs / CSOs job next to impossible. It’s not a matter of whether an incident will happen to a modern connected company, but when.

Data breach incident handling must be a part of your data privacy and information security program. Balancing the need for speed of response, especially prompted by state-level data breach rules, with accuracy and responsible forensic activities is a tough challenge. It becomes tougher when interested parties such as the CEO, who suddenly realized that information security is important, compliance, legal, IT Management, public relations, the cyber security insurance carrier and their forensic experts, and the press all want constant feedback and a complete understanding of what happened, who did it, and how much is this going to cost us? from the word, “Go!”

Hopefully all of these parties were interested when the CISO / CSO asked to run a data breach incident drill last year in order to test the capabilities, response time, and training of all relevant parties to respond to such an incident. From our experience performing risk assessments, they were not, and a drill has never been completed.

Don’t let a real incident be the first time you test your data privacy and information security incident response plan. Remember a successful program is built on statements of policy, supporting procedures, tools, checklists, logs, forms, and training. If a real incident is your first test, chances are you are looking at a poor result, and a poor result is more likely to lead to fines and firings.

Since an incident is a matter of When Not If, testing your incident response plan should not be seen as optional or subject to perpetual procrastination!

Lastly, remember that while Information Technology (I.T.) is the system owner and the primary source of information in the event of an incident or breach, the problem is a business issue, not an I.T. issue! Consider addressing requirements and response in your Business Continuity Plan (BCP). BCP procrastination is a topic for another article!

Happy New Year and we’ll secure you in 2015

The team at RISC Management

(1) http://www.idtheftcenter.org/images/breach/DataBreachReports_2014.pdf