Data Breaches: Are You Ready (for the inevitable)? - McNees ...

Media Center
Data Breaches: Are You Ready (for the inevitable)?
“There are two types of companies: those that have been hacked, and those that don’t know they’ve been hacked.” ~ John Chambers, former CEO of Cisco
In 2015, identity theft occurred every two seconds, disrupting the lives of 13.1 million people, according to Javelin Strategy and Research. Year after year, U.S. data breaches have hit record highs, reports the Identity Theft Resource Center.
Responsibility for cyber security has risen to the “C” level, where executive officers and boards are now accountable for appropriate oversight and safeguarding of the personally identifiable information (PII) collected. Every company needs to be focused on preventing, detecting, and responding properly to a data breach. Your company needs to have a security plan and a response plan in place before a data breach occurs. Historically, companies have been concerned primarily with damage to their reputation resulting from a data breach incident. But the damage is worsened if it turns out the breach could have been prevented!
PII includes your name, address, birth date, account numbers, email addresses, passwords, and Social Security Number. It is virtually impossible to be in business today and not collect or store PII.
Preventing data breaches. Be Proactive.
Step one is using best practices to prevent data breaches and their resulting damage to your business’s finances, reputation, customer relationships, and image.
Breaches can occur in countless creative ways but, in general, fall under three main categories:
Theft or loss of physical equipment, such as laptops, smart phones, tablets and other mobile and storage devices.
Illegal entry to deliberately access PII through hacking, viruses or other methods.
Inadequate oversight caused by lax system security.
The common denominator in most breaches is a current or former employee or vendor. The data breach might be the intentional act of a disgruntled person, or an employee tricked into opening a message that appears to be genuine but is actually meant to break into your computer system by malicious scams such as “phishing”, fake credentials, phony applications, and other clever social engineering tricks.
The most important proactive step a company can take to prevent a data breach is to have a comprehensive written information security plan (WISP) in place that identifies what PII the company collects, how and where it is stored, and who has authorized access to it. The plan should be implemented on an enterprise-wide basis (throughout the company, not just in the IT department), and it should be tested periodically to identify and manage any security risks and to ensure that all employees and vendors are complying with the plan.
The key elements of an Incident Response Plan.
Step two is the creation of an Incident Response Plan, the go-to game plan with detailed action steps in case a data breach happens. Your response plan should be documented in writing and regularly updated and tested.
Your Incident Response Plan should address key questions:
Who’s on the team? Many people should be at the table, including in-house personnel and outside vendors (including some you may wish to have on retainer in case a data breach occurs). Legal counsel should provide guidance about legal requirements, including applicable notice requirements in your business’s home state and in the states and countries where your customers or clients reside. Public relations personnel, skilled in crisis management, should have draft notification letters (ready in advance of a breach) – that are honest but calm – explaining the breach and the remediation steps you are taking. IT experts must be engaged in advance, standing ready to investigate the cause of the breach and take immediate steps to contain the damage.
Who’s in charge? One person must serve as project manager or team leader – the primary decision maker. The team reports to this person, who in turn reports to executives (and the board). The leader must be capable of sharing technical and legal information clearly, consistently, and without jargon.
Who needs to be notified? Legal counsel will help you determine if notification is required and who needs to be notified. This will depend on whether you can determine what PII was accessed, whether it was strongly encrypted, and what was done with the PII that was exposed.
Should law enforcement be contacted? This is a delicate issue, since the information involved is often proprietary. Legal advice is needed to determine whether law enforcement must be contacted. Businesses should build relationships with law enforcement agencies in advance, so you are not calling the FBI, Secret Service, FTC, state attorneys’ general, or Homeland Security out of the blue. Law enforcement agencies can sometimes advise businesses on data security practices and even assist them with table-top exercises to look for problems and help plan a response to a data breach.
What recourse will be offered to victims? After breaches, most companies offer customers some form of remediation, often free credit monitoring. These steps will be determined once your response team determines what PII was accessed, what harm has been caused by the breach, and whether the data was just viewed or duplicated.
What’s the budget? Incident Response Plans often rely heavily on outside professionals and vendors to perform the legal analysis, technical and forensic investigations, external and internal communications, credit monitoring, and other steps the plan provides for – all of which is expensive. Increasingly, businesses are purchasing cyber insurance to cover the costs of data breaches.
Don’t wait for an emergency! Plan for the inevitable.
After a data breach occurs is not the time to be writing a plan and drafting letters.
The Incident Response Plan is essential to being ‘crisis-ready’. Bringing on an experienced firm that can help you plan for and implement practical solutions to privacy threats and breaches and advise your business on protecting data is critical. Solutions vary by industry, due to state and federal laws and regulations, but with diligent guidance, businesses can do their utmost to protect their reputations and their customers from data breaches.
RELATED PROFESSIONALS
Tel:
Email:
Related Practices
Attorney Email Disclaimer
If you are not a current client of McNees Wallace & Nurick LLC, before submitting any information, please read and accept the following terms:
Email addresses of our attorneys are not provided as a means for prospective clients to contact our firm or to submit information to us.
By clicking "I ACCEPT," you acknowledge that McNees Wallace & Nurick LLC has no obligation to maintain the confidentiality of any information
you submit to us unless we already have agreed to represent you or we later agree to do so. Thus, we can represent a party in a manner adverse
to you even if the information you submit to us could be used against you in that matter.
ALFA International
McNees Wallace & Nurick LLC is a member of the ALFA International legal network. The ALFA network is comprised of 125 law firms with nearly 300
offices throughout the United States and around the World. The 85 U.S. firms and 40 international members employ over 8,000 lawyers and 10,000 legal
support staff. As an ALFA member, McNees Wallace & Nurick LLC is able to draw upon the vast resources of the network’s membership to better serve
its clients. ALFA affiliation also facilitates and expedites the retention of outstanding counsel in unfamiliar jurisdictions, another significant
client benefit. More information about the ALFA legal network can be found at www.alfainternational.com.
Best Places to Work in PA
This survey, study and award program is intended to identify the best places of employment in Pennsylvania for the benefit of the Commonwealth, its workforce
and businesses. The "100 Best Places to Work in PA" program is made up of 50 medium-sized companies (50 to 250 employees) and 50 large-sized companies
(251+ employees). After a two-part assessment process designed to gather detailed data about each company, ModernThink, LLC, a workplace excellence consulting
firm, determines what companies make the final list. Best Companies coordinates the process and ModernThink evaluates all surveys submitted by companies.
McNees has been named to the list of Best Places to Work in PA since 2006.