How prepared are you for cyber-attacks and data breaches?

1. The first step in your response strategy should be to invest in the first defence – your people. The weak link in security planning is staff, whose behaviour can’t be accounted for in plans or documents. A test done by security firm Positive Technologies [2] found that, on average, a quarter of staff were likely to click on phishing email links. Training and cultural awareness are crucial first steps in fostering a more prepared workforce. However, organisations need to go further and extend that due diligence to both up and downstream vendors, who represent key parts of the supply chain and a key access point for system infiltration.

2. When a breach occurs, your business needs to respond. The majority of response planning needs to be done in advance in the form of soft (and hard) copy business continuity plans (BCP) and disaster recovery (DR) plans. These need to be tested iteratively in different scenarios and include details of which systems are most important to the business so you can prioritise your recovery efforts. Make your plans a reality, just as you would a fire drill.

3. Finally, communicate effectively. Knowing how to engage with your clients, authorities and the wider media requires an understanding of your obligations and your situation. One potential pitfall for your business is simply not knowing what data you possess – In the current business environment systems interact with consumers and other stakeholders at such volumes that businesses can lose track of the information they may be collecting. In this case, simple steps to understand system architecture can be taken early to avoid damages down the track.