Dealing with a Data Breach

It’s the call no-one wants to get: your client has experienced a data breach, and is worried that customer data may have leaked from the business. It is your job to fix the problem as best you can, and give the client peace of mind. There are four key steps in incident management.

Contain and assess
The first step in coping with a breach is to stem the flood of data, and understand how bad the problem is. A client can only find out which information has been compromised if they understand exactly what has happened to their systems. This is why log files are so important. Ensure that you stay informed after the event by maintaining system logs, and by making them easily searchable. Splunk, an IT log search engine, enables you to search through your customers’ logs for suspicious activity that can help you to recreate the sequence of events leading to the breach.

Evaluate the risks
Once you have an understanding of what data was compromised and how, map this information to business risks. You must understand which individuals were affected by the breach, and how sensitive the compromised data was.

Notify the relevant parties
Strictly speaking, your client could avoid notifying victims of a breach, given that there is no law in the UK currently requiring them to do so. But is this a good business move? Better to help your client manage customer relations in a more honest and constructive manner. Notify the affected parties as soon as possible, and tell them as much as you can about the incident, in non-technical terms, without revealing sensitive personal information. Also, notify the Information Commissioner’s Office in the event of particularly serious breaches, in which large numbers of people are affected.

Seal the leaky holes
Now for the clean-up process. Having identified how the breach occurred, you must mitigate the problem with measures that will stop it happening again. This may be as simple as configuring a new firewall rule, or as complex as introducing role-based access control to prevent insider breaches.