All businesses with an online presence face a range of cyber risks. Prominent among them are data breaches, which constitute a class of vulnerability that the public is particularly concerned about, especially in light of recent high-profile data breaches like that which affected Facebook in September 2018. There’s no way to eliminate cyber risks like data breaches but there are a variety of measures that can help businesses manage and mitigate risks.
Reducing the risk
As with so many other risks, the best way to manage cyber risks like data breaches is to reduce the risk and exposure as much as possible. Reducing the risk protects a business and its customers and clients from having their data compromised while reducing the exposure protects a business from the consequences of data breaches.
A cyber liability insurance policy may assist in reducing exposure following a cyber incident. Reducing the risk is best accomplished by implementing the security measures that best suit the business and the type of data being held. Unfortunately, there isn’t a global standard or a solution that suits all organisations.
Regardless of which security measures are chosen, it’s vital that security products and services be continuously monitored and kept up to date. Businesses must also take steps to ensure basic cyber safety practices are implemented. This includes measures like good password practices and employing data encryption where relevant. This won’t create a foolproof system that eliminates the risk of a data breach occurring but it will significantly reduce the risk.
Responding to a data breach
In addition to implementing practices and procedures that prevent data breaches, a good data breach risk management strategy will include guidelines that should be followed in the event a breach does occur. Such guidelines should specify whether IT, PR, legal etc. professionals need to be engaged and should also cover protocols for:
Containing a breach and limiting further damage including protocols for shutting down and preventing further access to a system that has been breached.
Assessing the risks associated with and impacts of a breach including the impacts on the business, such as whether compromised data will affect other business processes or relationships with third parties, and the impacts on the business’s customers, such as the number of people affected and the nature of the data that was compromised.
Reporting a breach who needs to be notified, when and how they should be notified and what information they need to be given.
Rectifying a breach including procedures for attempting to recover lost data and restarting compromised systems.
Assessing the effectiveness of the response and preventing future breaches including protocols for: determining whether criminal activity, human error or inadequate procedures contributed to the breach; evaluating any operational, policy, resource, employee or management issues that arose during the response to a breach; and modifying any procedures or behaviours that contributed to the breach.
Managing cyber risks like data breaches requires an integrated approach designed to:
This content is brought to you by Chubb Insurance Australia Limited (“Chubb”) as a convenience to readers and is not intended to constitute advice (professional or otherwise) or recommendations upon which a reader may rely. Any references to insurance cover are general in nature only and may not suit your particular circumstances. Chubb does not take into account your personal objectives, financial situation or needs and any insurance cover referred to is subject to the terms, conditions and exclusions set out in the relevant policy wording. Please obtain and read carefully the relevant insurance policy before deciding to acquire any insurance product. A policy wording can be obtained at www.chubb.com/au, through your broker or by contacting any of the Chubb offices. Chubb makes no warranty or guarantee about the accuracy, completeness, or adequacy of the content. Readers relying on any content do so at their own risk. It is the responsibility of the reader to evaluate the quality and accuracy of the content. Reference in this content (if any) to any specific commercial product, process, or service, and links from this content to other third party websites, do not constitute or imply an endorsement or recommendation by Chubb and shall not be used for advertising or service/product endorsement purposes. ©2020 Chubb Insurance Australia Limited ABN: 23 001 642 020 AFSL: 239687. Chubb®, its logos, and Chubb.Insured.SM are protected trademarks of Chubb.