When you think of IT security, you likely think about usernames and passwords, firewalls, intrusion prevention, antivirus programs, and other common technical measures designed to prevent unauthorized access and misuse of resources with minimal human intervention. These are the sort of “set it and forget it” controls that are fairly ubiquitous. If your organization is more mature, you may also think about logging, auditing, alerting, monitoring, and vulnerability assessments where employees personally check on the effectiveness of the “set it and forget it” controls, and periodically make adjustments. This stage is, unfortunately, still not as common as it should be.
But do you also think about the proper steps to take when (not if) you suffer a breach? Even the best of preventive measures are known to fail. Without sufficient detection and monitoring, you may not learn quickly when it happens, which is why most breaches are discovered by third parties and reported to the victims weeks or months after the fact. Without a pre-prepared response plan, it may take months to recover instead of days or weeks. That extra time could be fatal to a small business.
It’s important to have a plan in place about what you will do in response to a breach—what steps will you take to contain and mitigate the breach? Who will you contact to get assistance? How will you inform customers, and what will you tell them? How will you cover expenses? EarthLink’s PCI Compliance Validation product, with Data Breach Protection, includes a pre-defined set of steps to follow in the event of a breach of customer credit card data. It also covers some of the known expenses that businesses incur from a credit card breach, such as a forensic audit, card replacement fees, and fines. It isn’t a complete incident response framework, but it is a secure and simple way for your business to start planning ahead.
We have an OnDemand Webinar I suggest checking out on this topic: PCI Compliance: Protect Your Business from Data Breach