What’s your plan for when that inevitable network event or, worse, that data breach occurs? Is it to figure things out as you go or is it to plan things out in advance to the best of your abilities before the going gets rough?

As management consultant Peter Drucker once said, the only thing that’s inevitable in the life of the leader is the crisis. Once a security incident or confirmed breach unfolds, you’re in the spotlight. It’s your testing time to see what you’re really made of. Why not start working on making yourself look good today?

Early on in my career, I learned a highly valuable lesson for IT and security problem-solving from René Descartes, the French philosopher. He said, “Divide each difficulty into as many parts as is feasible and necessary to resolve it.” The mark of a true leader, including those responsible for day-to-day information security oversight, is not to place blame but instead to ask good questions — many of which are hardly ever thought about.

Approaching the Data Breach Problem

Applying this to security incidents and data breaches, you can step back and take a look at the bigger picture of what’s going on and what it’s going to take to resolve the challenge by asking the following questions:

  • What has actually happened?
  • How did it happen?
  • What was impacted?
  • Who/what information was involved?
  • Who else needs to be on the response team?
  • What are the next steps?

The reality is no one really cares about how great your security program is (or was); they only care about the breach that just occurred. This is why you have to focus on fast and effective response. Treat data breaches as you would any other important business project. It’s not going to be resolved immediately. Rather, it will have an ongoing life cycle.

Answering the Key Questions

I suspect that in many, if not most, data breach situations, these questions have gone unanswered or the information is not made available when it needs to be (e.g., during and immediately after the event). Then the very things that led up to the event create the same breach scenario again down the road.

Remember the universal law that says you cannot change facts, but you can change problems. You cannot change the breach that occurred, but you can change the factors that led to it and the problems that are currently in the way of you reaching a successful resolution.

Bad things happen less often to people who are prepared. You don’t have to accept this core security challenge as the new normal. Get ready. That’s the secret to success.

Figure out what the worst thing is that could happen, do everything within reason to make sure that it doesn’t happen and then have a plan to minimize the impact of any residual risks. It’s really as simple as that.

More from Risk Management

Detecting Insider Threats: Leverage User Behavior Analytics

3 min read - Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey conducted by SANS Institute, 35% of respondents said they lack visibility into insider threats, while 30% said the inability to audit user access is a security blind spot in their organizations. In addition, the 2023 X-Force Threat Intelligence Index reported that…

3 min read

Increasingly Sophisticated Cyberattacks Target Healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

4 min read

Machine Learning Applications in the Cybersecurity Space

3 min read - Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information from vast amounts of data and transform it into valuable business knowledge. While most industries use these techniques, they are especially prominent in the finance, marketing, healthcare, retail and cybersecurity sectors. Machine learning can also address new cyber threats. There…

3 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read