Estimates of the number of cyberattacks taking place daily across the world vary significantly. The nature of data breaches makes accurate reporting difficult and some may never come to light at all. One thing is clear, however: the volume of cyberattacks and the damage they cause is only increasing. We frequently hear of data breaches compromising the records of thousands or even millions of individuals. For anyone tasked with keeping their organisation's data safe, the challenge can feel insurmountable.
When an organisation becomes aware that a cyberattack has taken place or is in progress, a rapid response is crucial – but so is the correct response. Different types of forensic IT support are available in IT security breach scenarios; ensuring the correct support is lined up and ready to deploy in the event of an incident can save many hours of work, much stress and significant financial resources.
There are many types of cyberattack, some sophisticated and some opportunistic. Perpetrators (generally known as 'threat actors') are constantly evolving new ways to exploit and cause harm to their targets. Some of the most common attacks we see are:
In many other cases a third party gets lucky by exploiting a vulnerability created by the organisation itself. Failure to encrypt data-rich systems and files, failure to patch and maintain security software and infrastructure, and poor password or security profiles make organisations easy targets for opportunistic hackers.
When unusual activity is identified, whether by IT security systems or human engagement, it is crucial to respond swiftly and in line with a pre-agreed breach preparation plan. The nature of the initial response can make a huge difference to an organisation's ability to restore services, stem the flow of data being exfiltrated and maintain customer and employee confidence. Swift action is also expected by data regulators and delays will have to be explained.
A good breach preparation plan won't just outline the steps to be taken once an incident comes to light, it will include the details of external advisors – legal and technical – who ,ideally, will know the business and be ready to hit the ground running to recover systems and identify the cause of the breach. Another benefit of having pre-approved forensic IT support is that, like external legal counsel, they can also be pre-approved by cyber insurance providers, meaning that there is no need to delay appointment or to switch to an approved supplier half way through the incident response process. Every hour lost in responding to a cyber incident can add thousands of pounds or more to the cost of lost business, regulatory fines, group litigation claims and legal and IT supplier fees.
It may also be advisable to have IT forensic support instructed by and reporting to outside legal counsel. This will maximise the chances of preserving legal privilege in reports created in response to an incident. Privilege is not easy to preserve in a context where the advice offered is more practical than legal, so efforts to adopt this approach will be more likely to succeed if carefully planned as part of breach preparedness rather than breach response activities.
As soon as a cyberattack or breach incident is identified, external forensics support should be called in. The initial investigation may last a few hours and will focus on what data and systems may have been compromised. Nothing should be done without caution and preferably without external support:
Preservation of evidence from the start is crucial; it will be needed to answer questions from Supervisory Authorities if personal data is compromised. It may also be needed in legal action against threat actors and third party platforms they may try to use.
External forensic support will be able to preserve all evidence collected and document every step taken, including who does what and when. It might seem as though internal IT experts could perform these activities, and in many cases they can. But by seeking external support, an organisation can ensure a calm and dispassionate approach is taken. It is also sensible to have an investigation conducted by someone independent, who was not responsible for maintaining the organisation's IT security, to ensure a completely honest and, where necessary, critical assessment of findings.
Once systems are secure and the source of the breach or attack is identified, thoughts will turn to working in conjunction with legal advisors and potentially PR specialists. An expert IT forensics team will provide the information needed to prevent follow-on attacks, to identify the damage that has been done and to report the breach to regulators or affected individuals where necessary.
As ransomware attacks continue to increase, many IT consultancies are also developing expertise in engaging with threat actors to negotiate and sometimes even avoid ransom payments. The decision to pay a ransom is controversial and may not be legal (if the threat actor is associated with certain groups or regimes) but understanding the source of the threat may be crucial to avoiding an escalation or repeat attack.
Putting together a breach preparation plan may feel a bit like planning your own funeral. As activities go it is not the most relaxing experience, but by getting ahead of the risk and regularly updating and refreshing the plan it is possible to significantly decrease the stress of going through a data breach scenario.
Alongside legal support, IT forensics help is essential for any organisation trying to address and resolve a cyber incident. The more work that can be done in advance to prepare those in the internal chain of command and those in the external support team, the better equipped the organisation will be to resolve the incident, implement changes needed as a result and minimise the financial and reputational cost sustained.
To discuss the issues raised in this article in more detail, please reach out to a member of our Data Protection & Cyber team.
Ed Hadcock looks at data audits and how they help reduce the risk of data breaches and regulator action.
1 of 5 Insights
Edward Spencer and Michael Yates look at the potential consequences of a data breach which affects a large number of claimants.
2 of 5 Insights
Michael Yates looks at information likely to come into the public domain about an ICO investigation into a data breach and how to reduce the risk of reputational damage.
4 of 5 Insights
Helen Farr and Edward Spencer look at the risk of deliberate data breaches by employees and at how to mitigate them.
5 of 5 Insights