Sherri Davidoff - Data Breaches: Crisis and Opportunity

Its a nightmare: One day, your IT team discovers that youve been hacked. Data has been trickling out of your organizationbut for how long? Days? Weeks? Turns out its been years. All of your most sensitive data has been stolendatabases of personal information, terabytes of email, financial detailsand thats only the beginning.

What happens next? What do you do? The decisions you make in the first hours after you discover a data breach are never easy, but they may affect your organization for years to come.

Data has become the lifeblood of our modern society, as well as a huge liability. Big companies and small companies, governments and nonprofits collect and generate increasing amounts of sensitive informationoften simply as a by-product of everyday operations. For a while it seemed as though there was no down side to mass data collection, aside from the expense of storage and processing. The more data you had, the better. Why bother getting rid of it?

Over time, the true cost of data collection began to emerge. Stolen credit-card numbers embarrassed merchants and frustrated consumers. Hacked hospitals leaked medical records, frightening patients. Massive electronic data leaks exposed secret government programs and upended presidential campaigns. Questions about security practices caused CEOs to resign, destroyed reputations, and sparked years worth of litigation.

Entire industries have arisen to manage the fallout from data breaches: identity theft protection companies, digital forensics firms, data breach attorneys, credit monitoring services, and more. New regulations have emerged, like wildflowers after a rainstorm, creating new job responsibilities, reporting requirements, and liabilities. All over the globe, IT staff work through the night applying patches and worrying about vulnerabilities. Data breaches are on the minds and the agendas of boards, CEOs, auditors, legislators, constituents and consumers, in every kind of organization imaginable.

Why do some organizations emerge from a data breach unscathed while others are badly damaged or even go under? How can we all make smart choices to protect our organizations beforeand aftera data breach?

The purpose of this book is to shine a light on the unmapped world of data breaches and provide a practical foundation for managing and responding to them. Not only is data breaches a new field of study, the term itself did not even exist until 2005. Like scientists watching a volcano rise from the sea, we are challenged both to understand the new environment we are seeing and simultaneously manage the potentially devastating social consequences.

The good news is that there are effective ways of reducing the risk of data breaches. Looking back at landmark cases, we can clearly identify tactics that reduce the damage caused in the wake of a breach. We can also see common mistakes that can cause a data breach to spiral out of control. Our case studies will include published data breaches such as those affecting Equifax, Target, Google, Yahoo, and more, as well as stories and insight from private professionals who have spent years handling data breaches quietly, from the inside. Along the way, we will unveil a new framework for data breach response and use famous data breaches to illustrate critical turning points and lessons learned.

This book will be valuable to any of the following individuals who play a part in breach response:

• Managers, executives, and IT staff concerned about data breaches

• Employees of organizations that have suffered data breaches

• Digital forensic investigators and incident response team members involved in data breach preparation and response

• Information security professionals

• IT consultants involved in cybersecurity incident prevention and response