Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/13/2019
01:30 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
0%
100%

6 Questions to Ask Once Youve Learned of a Breach

With GDPR enacted and the California Consumer Privacy Act on the near horizon, companies have to sharpen up their responses. Start by asking these six questions.
Previous
1 of 7
Next

 

Companies don't have the luxury of waiting days and even weeks before they report a data breach to the public. Many global firms do business overseas and are subject to GDPR, and California's data privacy law goes into effect Jan. 1, 2020. There are other such measures on the way in India and Brazil.

All these new measures require that companies report a breach within 72 hours.

That means it's more important than ever for companies to know how to respond once they learn that they've been breached. The M-Trends 2019 report released by FireEye Mandiant found that 59% of breaches are self-detected, while 41% are reported to breached companies by external sources.

Charles Carmakal, strategic services CTO for FireEye Mandiant advises companies to start by validating that a breach took place and if you haven’t already, develop a comprehensive incident response plan.

"It's really important to know what the attack was and why the bad threat actors broke in," Carmakal says. "Do your due diligence and have this information because it will really help you from a legal perspective if the case gets turned over the law enforcement and there's an indictment."

While some companies have clear processes and procedures in place, many companies (especially SMBs) are not at all prepared to handle a breach. Start by asking the following six questions.

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
9/16/2019 | 3:22:27 PM
Nouns
Words are important and ages ago Cliff Stoll wrote an engaging book THE CUCKOO'S NEST which should be required reading for any cyber pro.  In this book, at one point, he was asked by the FBI to define the threat and theft.  Their language was proper and mild and I think this is so here...

Threat Actor?  No - how about Bald Faced Criminal

Ongoing?  No, how about barn door still unlocked?

Data theft?  No, how above did they empty Fort Knox.

Ongoing?  No, are the black trucks still at the docking back.

Restoration protocol?  No, are we still screwed in putting shit back-together?

Don't have a plan?  are we then up Schitt's creek with no paddle or boat? 

I noticed that responsibility for defense was not mentioned?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Can you smell me now?
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.