Speed Is Key in Tackling Data Breach Fallout
Total Page:16
File Type:pdf, Size:1020Kb
INDEPENDENT PUBLICATION BY RACONTEUR.NET #0570 24/02/2019 Distributed in CYBERSECURITY Published in association with ARTIFICIAL CYBER-RESILIENCE FINANCIAL Contributors 02 INTELLIGENCE 06 BY DESIGN 09 IMPACT How should IT experts respond Building a cyber-secure Five ways cyberattacks Davey Winder when AI falls into the wrong hands? business from the ground up can destroy company value Award-winning journalist and author, he specialises in cybersecurity, contributing to Infosecurity magazine. Kate O’Flaherty INCIDENT RESPONSE Freelance tech writer specialising in cybersecurity, her work has appeared in The Guardian, The Times, The Economist, Forbes, and Wired UK. Speed is key in tackling Matthew Staff Former editorial director, he is now applying his multi-sector B2B experience across numerous data breach fallout industry titles. Nafeez Ahmed Investigative journalist and editor In the age of social media and public relations crises of Insurge Intelligence, he has contributed to The Guardian, snowballing out of control, the ensuing hours after a Independent, VICE and The Atlantic. data breach can make or break a company’s reputation Nick Easen Award-winning journalist and broadcaster, he writes on science, technology, economics and business, producing content for BBC World News, CNN and Time magazine. Nick Easen Nick Ismail assive cyberattacks appear to go responding to breaches, will become Content editor of Information Age, he M in waves and we’re probably due even more crucial to business success in writes for technology leaders, helping one soon. Marriott, British Air- the future,” says Tim Rawlins, director at them manage business-critical issues ways, Facebook, Dixons Carphone are NCC Group. for today and in the future. just some of the big names that have been smacked hard in the corporate face. Bruis- Oliver Pickup ing data haemorrhages seem to be a reg- Award-winning journalist, he ular occurrence, while the dreaded fall- specialises in technology, business out on social feeds, tabloid headlines and and sport, and contributes to a wide range of publications. 24-hour online media can be legion. “Once more unto the breach, dear friends, once more” is not so much a line One of the first Tim Cooper from Henry V and the Bard himself, but Award-winning freelance fi nancial more a 21st-century hue and cry from the challenges in dealing journalist, he has written for publications including The Spectator, public relations, C-suite and cybersecu- aff ected organisation often has very few ically – as the breach involved virtually Look closer and you may realise that our with a cyberattack is London Evening Standard, Guardian rity teams as they clamour to shore up tat- facts to work with. Maintaining stakeholder everyone who entered their credit card data infrastructure has been built using Weekly and Weekly Telegraph. tered brand images and stymie any fi nan- time. Incidents can confi dence when you have no facts is a chal- details on their website over the period of methods created in the 20th century and cial losses. lenge and especially because these facts can the hack.” we’re now having to re-engineer our data- “One of the first challenges in dealing go viral and global take days, weeks, even months to uncover.” In the summer of 2018, the details of fed world to deal with security in the 21st, with a cyberattack is time. Incidents can in an instant At the same time, we live in an era when around 380,000 airline bookings were including the cloud, mass digitalisation of go viral and global in an instant. Organ- there’s a toxic cocktail of high breach compromised when hackers obtained supply chains, the internet of things, robot- isations will be dealing with short time- fatigue among consumers and low public names, streets and email addresses, as ics and artifi cial intelligence, as well as the frames to manage reputational risk, trust in companies that hold our precious well as credit card numbers, expiry dates merger between physical and cyber-realms, recover data and prepare a co-ordinated data. Arguably, it’s how businesses have and security codes; certainly enough the so-called fourth industrial revolution. response to regulators, third parties and There’s no doubt that a proactive handled attacks globally that has led to information to steal from people’s bank Next-generation intelligence-driven Publishing manager affected customers,” says Dr Paul Robert- response must be delivered alongside an this state of affairs. accounts. In textbook style, British Air- security is needed. “Before a breach, busi- Reuben Howard son, cybersecurity, privacy and resilience honest plan to tackle a breach, even if its “The reporting of incidents has gen- ways immediately contacted customers nesses struggle to know whether they director at EY. knee jerk, otherwise it’s carnage. erally been poor and often doesn’t high- when the breach became clear. need to invest and struggle to under- Associate editor We also have to face up to the fact we “The saying that 'a lie can travel half- light the real scope of a data breach, with “Within the incident report, you had stand what the impact of inaction will be Peter Archer live in a post-GDPR world. Companies way around the world before the truth has incident reports littered with non-defi - to scroll down the page to see the advice on their business. They know this after a Managing editor have 72 hours to fess up to a cyberattack its shoes on' is very real when it comes to nite words such as ‘could have’, ‘might related to credit cards. At the time, the breach, of course, but at which point it’s Benjamin Chiou or face crippling fines under the EU’s Gen- social media. A misrepresentation of the be’ and so on,” says Professor Bill announcement was your passport details too late,” says Nigel Ng, vice president of eral Data Protection Regulation. As the facts can become a ‘fact’ very quickly and Buchanan, cybersecurity expert at Edin- were safe and that your card details were international sales at RSA Security. Head of production clock ticks in those early hours, the pres- is then often picked up by traditional news burgh Napier University. at risk. You can see that PR teams will try Many organisations are now being more Justyna O'Connell sure can be extreme. sources,” warns Richard Horne, cyberse- “In the case of British Airways, to soften the scope of a data breach, but proactive and less reactive. As Cesar Cer- “Consumers are becoming increas- curity partner at PwC. every customer should have stopped this doesn’t help the media or the general rudo, chief technology officer at IOActive, Digital content executive ingly savvy about the value of their “Cyber-crises are also diff erent to many transactions on their credit card – public understand the scope of an attack,” puts it: “This is no longer an IT issue, but a Fran Cassidy data. Transparency, particularly when others in that directly after the event, the in fact, it should have happened automat- says Professor Buchanan. business imperative.” Although prepared- ness is more prevalent in the likes of say Design financial services than in healthcare. Grant Chapman Big companies now have so-called Sara Gelfgren MOST CONCERNING CONSEQUENCES OF A CYBERATTACK TIME TAKEN TO IDENTIFY AND CONTAIN Kellie Jerrard fi re-response policies and cyber- A DATA BREACH, BY ROOT CAUSE Harry Lewis-Irlam Percentage of executives who believe the following would have a big impact on their organisation breach simulations bringing IT, public Samuele Motta Survey of 477 companies that experienced relations and customer service teams together a data breach in 2018 as they work on dry runs and responses. How- Head of design Business interruption ever, there’s increasing realisation that a Tim Whitlock 75% Average number of days to identify more holistic approach is needed. Average number of days to contain “Embedding security into an organi- sation's DNA goes far beyond just raising Reputational damage 59% Although this publication is funded through ad- awareness or training people; everyone vertising and sponsorship, all editorial is without 221 needs to understand how the business bias and sponsored features are clearly labelled. Malicious or For an upcoming schedule, partnership inquir- decisions they make can impact cyber- Breach of customer information 55% criminal attack ies or feedback, please call +44 (0)20 8616 7400 risk,” says Mr Horne. However, this still or e-mail [email protected]. Raconteur is a 81 doesn’t tackle the issue of reviving pub- leading publisher of special-interest content and research. Its publications and articles cov- Data or software damage % lic trust, which is sorely needed before the er a wide range of topics, including business, 49 next round of breaches. fi nance, sustainability, healthcare, lifestyle and technology. Raconteur special reports are pub- “It is often difficult to tell the difference lished exclusively in The Times and The Sunday Extortion/ransomware 177 between say a bank which invests heav- Times as well as online at raconteur.net. The 41% System glitch ily in their cybersecurity and one that information contained in this publication has been obtained from sources the Proprietors doesn’t,” says Professor Buchanan. believe to be correct. However, no legal liability Liability to third parties 60 “For those affected, it is often finan- can be accepted for any errors. No part of this 35% cial loss, which worries many people, and publication may be reproduced without the pri- resulting from a breach or consent of the Publisher. © Raconteur Media therefore we need ever-increasing levels of security. Our ‘Wild West’ of data-han- Disruption/interruption of industrial 29% 174 systems or other technology Human error dling and data-mining needs to end some- time soon.