Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/13/2019
01:30 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
0%
100%

6 Questions to Ask Once Youve Learned of a Breach

With GDPR enacted and the California Consumer Privacy Act on the near horizon, companies have to sharpen up their responses. Start by asking these six questions.
Previous
1 of 7
Next

Image Source: Adobe Stock: Yury Zap

Image Source: Adobe Stock: Yury Zap

 

Companies don't have the luxury of waiting days and even weeks before they report a data breach to the public. Many global firms do business overseas and are subject to GDPR, and California's data privacy law goes into effect Jan. 1, 2020. There are other such measures on the way in India and Brazil.

All these new measures require that companies report a breach within 72 hours.

That means it's more important than ever for companies to know how to respond once they learn that they've been breached. The M-Trends 2019 report released by FireEye Mandiant found that 59% of breaches are self-detected, while 41% are reported to breached companies by external sources.

Charles Carmakal, strategic services CTO for FireEye Mandiant advises companies to start by validating that a breach took place and if you haven’t already, develop a comprehensive incident response plan.

"It's really important to know what the attack was and why the bad threat actors broke in," Carmakal says. "Do your due diligence and have this information because it will really help you from a legal perspective if the case gets turned over the law enforcement and there's an indictment."

While some companies have clear processes and procedures in place, many companies (especially SMBs) are not at all prepared to handle a breach. Start by asking the following six questions.

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
9/16/2019 | 3:22:27 PM
Nouns
Words are important and ages ago Cliff Stoll wrote an engaging book THE CUCKOO'S NEST which should be required reading for any cyber pro.  In this book, at one point, he was asked by the FBI to define the threat and theft.  Their language was proper and mild and I think this is so here...

Threat Actor?  No - how about Bald Faced Criminal

Ongoing?  No, how about barn door still unlocked?

Data theft?  No, how above did they empty Fort Knox.

Ongoing?  No, are the black trucks still at the docking back.

Restoration protocol?  No, are we still screwed in putting shit back-together?

Don't have a plan?  are we then up Schitt's creek with no paddle or boat? 

I noticed that responsibility for defense was not mentioned?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
'Unkillable' Android Malware App Continues to Infect Devices Worldwide
Jai Vijayan, Contributing Writer,  4/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Digitized COVID-19 Prevention
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9499
PUBLISHED: 2020-04-09
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
CVE-2020-9500
PUBLISHED: 2020-04-09
Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down.
CVE-2020-10603
PUBLISHED: 2020-04-09
WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.
CVE-2020-10617
PUBLISHED: 2020-04-09
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
CVE-2020-10619
PUBLISHED: 2020-04-09
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.