Recently 2 popular websites (Zendesk and Evernote) were hacked. It happens! Yes, that’s right. If you are running a e-business, chances are things “will” go wrong no matter how much preparation/precautions have been awarded. You can never foresee every possible cause or scenario. What you can do is this; know how to resolve any problem as quickly as possible and all with minimal impact to your customers and company cost.
Security breach procedures commonly overlooked by many businesses; also known as “Incident Response Procedures”.
Think about the “what could possibly go wrong” in terms of a security breach. For instance, if you are running an ecommerce website, the most important thing to protect iis the customer’s data, particularly if transactional or financial. Now, you have identified what the critical information is that you need to protect. Now ask yourself; what could possibly go wrong? Some examples are:
- Unauthorized access to the data;
- Data corruption;
- Data loss;
- Stolen data;
The procedures should be designed with below questions in mind. They should be executed in an appropriate sequence to minimize any damage and/or impact.
- What actions can you take to stop the exploit immediately?
- Whom should you contact immediately?
- How do you assess the severity of the situation and if need be, how do you escalate it?
- What time frame has your team been granted?
- How can you ensure the situation is actually under control?
- How and when do you notify your users?
- What measures do you take to prevent this from happening again?
You may use a flowchart to visualize the workflow prior to drafting your procedures. Below is an example of a security procedure from NYU.
Secruity breach may occur anytime so start creating your procedure (SOP) now.
