According to the National Institute of Standards and Technology, there are four phases of a data security incident: (1) Preparation before an incident occurs, (2) Detection and Analysis, (3) Containment Eradication and Recovery, and (4) Post-Incident Activity, which is essentially steps taken to ensure – as much as possible – that a similar incident does not occur in the future.   

In other words, both the first and fourth phases entail taking steps to avoid a future data security incident. As a former FBI executive in charge of the data presentation and storage for the agency’s operational missions, my daily question was, How much preparation is enough? Businesses face the same daily question: What level of cybersecurity is enough to prevent or thwart an attack on our computer systems? I found that the best question to ask myself was, What would it take to prevent or thwart the most likely attacks on our computer systems?

In preparing to defend against a network attack, I found external sources of expertise to be very helpful. Instead of looking inward for answers, we invited outside professionals to thoroughly assess our cybersecurity posture— by showing us our weaknesses and deficiencies. As capable experts, they were able to point out many areas for improvement, such as hardware, software, networks, and training. As we made changes to our digital environment and training regimen, we also reviewed, edited, and drafted policies and protocols to protect our data. We then tested these internal rules and guides by engaging in internal table-top exercises. All of that helped to emphasize the importance of preparation in defending against the inevitable cyber attack.

Many businesses struggle to identify the best means of preparation against cyber attacks. Some businesses may need the proactive services of technical experts who can scan for vulnerabilities, test for intrusion vectors, provide cyber training, or design and install new systems built around the concept of security as a pillar, not as an add-on. Other businesses may require proactive services focused on new security and data handling policies and protocols along with tabletop exercises for management and staff. These measures help businesses identify security issues with the collection, processing, and management of sensitive data, such as personal information and protected health information. Other businesses may want an assessment of their internal systems, in addition to policies or protocols, to help them better prepare for a data security incident.

For every business, the need for preventive services can vary by size, industry, regulations, unique workflows or objectives, and general operations, among other factors. Each business will define its level of preparation differently. Professionals in the field of data privacy and information security know that when a business questions the sufficiency of its cybersecurity posture, the response should always be tailored to the client’s specific needs.

No matter the size or business sector, the Constangy Cyber Team can develop solutions tailored to your organization’s unique needs. Contact us today at cyber@constangy.com for support with incident response planning and practical ways to mitigate your security risks.