Before the Breach Part 1: Prepare for the Inevitable

Anthony Di Bello

Most every organization will be breached eventually. This is the first in a series of posts during Black Hat week covering six best practices that need to be in place for best response.

It’s unfortunate, but history shows that it’s not a matter of IF a business will be breached, but WHEN. According to the Ponemon study cited in this ZDNet blog post, Cybersecurity by the numbers: How bad is it?, 90 percent of businesses were breached during the period of the survey last year. Additionally, the study found a staggering 40 percent of businesses didn’t know the source of the attacks against them, while 48 percent pointed to malicious software downloads as a prominent attack vector.

The news isn’t all bad. The fact is that organizations can do a lot to mitigate their risks – if they take the right security precautions and maintain a healthy focus on their ability to respond to incidents as they occur. For example, a separate Ponemon Institute survey from last year found that there is a strong correlation between companies that have CISO-leading organizational security efforts and lower breach costs. The year-over-year cost per record declined from $214 to $194.

This SecurityWeek post, Report: Breach Costs Fall, You Can Thank Your CISO, quoted Dr. Larry Ponemon, chairman and founder of the Ponemon Institute, as saying, “One of the most interesting findings of the 2011 report was the correlation between an organization having a CISO on its executive team and reduced costs of a data breach.”

It stands to reason that a CISO would improve IT security effort efficiency. There’s an executive in the organization fully focused on security, and committed to driving best practices into the organization’s processes. The data show the profound impact that all of this focus and preparation creates. It’s also important, when it comes to information security, that focus not be so lopsided toward defense.

Let me explain. With the hostile environment we must do business in today, it makes sense to focus on defending your environment with technologies such as firewalls, anti-virus, intrusion detection systems, and the many other defensive tools available. However, just as fire prevention isn’t only about safety awareness and better building codes – it’s also about smart response, fire alarms and a fully trained and equipped fire department on the ready – IT breach incident response is the same way.

And the key to success in incident response is the determination to make it a priority, and having the right equipment and training in place. With that in mind, we recently conducted a webinar on The Six Best Practices on Incident Response that details the key things organizations need to do so that they can mitigate risk and lower the cost and impact of the incidents that come their way.

Throughout the week on this blog we will be taking a closer look at the best practices discussed in our webinar.

Be sure to follow @EnCase on Twitter for Guidance Software announcements and polls during Black Hat.

If you are at the conference, join me and Guidance Software in booth #113 where we will be showcasing the benefits of integrating cyber response technology with perimeter detection tools and raffling off a Google Nexus 7 each day!

Follow @EnCase