Last year, 83% of organisations suffered from more than one data breach.
If you suffer from a data breach, it’s important to act quickly to contain the breach and determine the cause and extent of the damage.
In this blog, we’ll guide you through the steps you need to take when it comes to investigating a data breach, and how to discover the extent of the damage.
Step One: Deploy Your Incident Response Plan
As soon as a data breach has been detected, you will need to activate your incident response plan. This plan should have been created prior to the incident and detail the steps your organisation needs to take in the event of a security incident.
You can find out more about Incident Response Planning here >>
Step Two: Identify the Source
Next, you’ll need to identify how the data breach occurred, so you can determine how to resolve the incident and prevent it from happening again in the future. There are many ways a breach can occur, including a cyber attack, human error, unpatched vulnerability, or third-party breach.
In order to identify the source of the breach, you may need to perform a digital forensic investigation. This investigation involves analysing system logs, network traffic and other artefacts to detect the source of the breach.
If you don’t have the skills in-house to conduct a digital forensic investigation, you may need to use a third-party company that specialises in these investigations.
Learn more about 3B Data Security’s Digital Forensic Investigation Services >>
Step Three: Assess the Extent of the Breach
Once the source of the breach has been determined, you’ll then need to assess the extent of the damage. To do this, you’ll need to look at what data was accessed, and who was affected.
To obtain this information, you may need to carry out a data inventory.
A data inventory is a comprehensive list of all the data your organisation stores, where it’s stored and who has access to it. Once you have this information, you can compare it to findings from the digital forensic investigation to determine which data was accessed.
Step Four: Disclose the Breach
If personal data has been breached, under the General Data Protection Regulation (GDPR), you are legally required to notify the Information Commissioners Office (ICO) and the affected parties. You must report a notifiable breach to the ICO no later than 72 hours after becoming aware of the breach.
The ICO has put together a self-assessment to help determine whether your organisation needs to report the breach. Take a look >>
When reporting a breach to the ICO, you should detail when the breach occurred, how it occurred, what data was accessed, and what actions your organisation is taking to contain and mitigate the damage.
Failure to report a data breach to the ICO can result in fines of up to £17.5 million or 4% of your annual global turnover.
When notifying the affected parties, you should disclose what data was compromised, and reassure them that you are taking all the necessary measures to remedy the incident and prevent any future breaches from occurring.
Step Five: Review Your Security Procedures
Following the breach, you should identify where your current security procedures and policies need to be updated to ensure a similar incident doesn’t occur in the future. This could include carrying out staff awareness training, encrypting sensitive data or deploying more security testing.
Security testing such as penetration tests and vulnerability scans can identify weaknesses in your systems and network, giving you the opportunity to patch them before they can be exploited by cyber criminals.
Find out more about Security Testing >>
Data Breach Management From the Experts
If your organisation falls victim to a data breach, how you respond can have a massive impact on your business, so it’s vital you have the skills and resources to handle the incident effectively and efficiently.
If you don’t have the skills in-house to effectively respond to and recover from an incident, we recommend getting an expert consultancy service on board to handle the breach for you.
At 3B Data Security, our team of specialist consultants have helped countless organisations of all sizes across various industries handle a data breach.
We offer a range of Cyber Incident Response and Data Breach Management Services to suit your organisation’s needs and budget.
Your organisation will be appointed a dedicated Cyber Incident Manager to work with you whilst our specialist team follow best practice incident response methodology to:
– Identify and analyse any threats and compromises.
– Contain the attack and cause of the compromise.
– Eradicate any threats.
– Recover your data and systems.
– Work to get you back to business as usual as soon as possible.
– Make recommendations on how to prevent future attacks.
Find out more about our Incident Response services, and how the team at 3B Data Security can help your organisation prevent, detect and respond to a data breach.
