Cybersecurity Breach Response: Lessons From the Other Side
Cybersecurity Breach Response Starts Before the Attack
I spend most of my working life trying to keep businesses—particularly law firms, accounting firms and other professional services firms—from suffering a serious cybersecurity incident. But once a month, I get to look at cybersecurity breach response from the other side.
I belong to a Privacy and Data Security Roundtable with around eight to twelve professionals from up and down the East Coast. The expertise around the table includes digital forensics, cybersecurity incident response, privacy and data security law, cyber insurance, expert-witness work, corporate cyber-risk governance, cybersecurity consulting, and cybersecurity education and authorship.
1-Minute Summary
The professionals in my monthly roundtable are called after something has already gone seriously wrong. I’m usually working on the other side—trying to prevent that call from becoming necessary.
We compare experiences about how breaches happen, mistakes made during the response, data exfiltration and what it can take for a business to recover.
Three lessons stand out: prevent what you can, know how you’ll respond when prevention fails, and remember that your cybersecurity exposure extends to organizations that hold copies of your data.
What Happens After Prevention Fails?
Our conversations aren’t theoretical. Many of these professionals have sat with victims of serious cyberattacks, advised them, and guided them through what comes next.
I’ve also had the opportunity to work alongside some of them during actual incidents. What has always impressed me is their cool, calm professionalism.
That’s important when the questions start coming quickly:
Are the attackers still in our systems? What did they take? Can we operate? Who needs to know? How long is this going to take?
Experienced incident-response professionals methodically work the problem.
And that’s taught me an important lesson:
The middle of a cyberattack is a terrible time to start figuring out what you’re supposed to do.
Cybersecurity Breach Response Is More Than Calling IT
IT people like to fix things. Something breaks, and our instinct is to get it working again.
A serious cyberattack can require a different approach.
Evidence may need to be preserved. Cyber insurance requirements may come into play. Legal or privacy questions may need to be addressed. Forensic investigators may need to determine what happened and whether information was exfiltrated.
That’s why a cybersecurity breach response plan can’t simply say, “Call IT.”
A business should know in advance who has decision-making authority, who needs to be contacted, and how the technical, management, insurance, legal, and forensic aspects of a serious incident will come together.
You want to work that out before everyone is staring at a ransom note.
Your Cybersecurity Risk Doesn’t Stop at Your Network
There’s another lesson I’ve been thinking about recently: your data can be breached without anyone breaching your network.
Businesses routinely share sensitive information with accountants, attorneys, consultants, payroll companies and other vendors.
That means some of your cybersecurity exposure travels with your data.
For law firms and accounting firms in Salem and Beverly, this works in both directions. They have their own vendors to worry about, but they’re also holding sensitive information that belongs to their clients.
The recent Fairwinds Credit Union incident was a good example of why this matters. My takeaway when I wrote about it on LinkedIn was simple: your security exposure includes accountants, consultants and other vendors holding copies of your data.
It’s one more reason cybersecurity can’t be viewed solely as protecting the computers inside your own four walls.
The Question I Think Businesses Should Ask
My job is primarily on the prevention side.
We patch systems, protect accounts, secure email, monitor endpoints, maintain backups, train employees and watch for the small warning signs that can become much bigger problems.
But my conversations with people who work on the other side of a breach have given me a question I think every business owner should occasionally ask:
If we suffered a serious breach tomorrow, what would everyone looking back at it wish we’d done today?
Maybe it’s MFA on an overlooked account. Better employee training. A tested backup. Stronger monitoring. Better control over who has administrative access.
Or maybe the technology is reasonably well protected, but nobody has decided what happens when something gets through.
You can’t eliminate every cybersecurity risk.
You can make an attack harder to pull off, detect trouble sooner, limit the damage and be prepared to respond professionally when prevention fails.
That’s what cybersecurity readiness really means.
Frequently Asked Questions
What should a business do first after discovering a cyberattack?
Follow the organization’s incident-response process, contain the immediate threat appropriately and determine who needs to become involved. Depending on the incident, that may include management, IT or cybersecurity professionals, cyber insurance resources, legal counsel and forensic specialists.
Can my company’s data be exposed if one of our vendors is breached?
Yes. If an accounting firm, law firm, consultant or other provider holds copies of your information, a breach of that organization can potentially expose your data even if your own network wasn’t compromised.
Why do law firms and accounting firms need cybersecurity incident-response plans?
Professional firms routinely possess sensitive client information. An incident may therefore create technical, operational, privacy, insurance and legal issues. Knowing who will handle those responsibilities before an attack can make the response much more organized.
How Prepared Is Your Business?
You don’t need to experience a cybersecurity incident to find out where your weaknesses are.
Slingshot’s IT Risk Scorecard can help identify gaps in your technology and cybersecurity before they become part of a much more difficult conversation.
