If you think a ransomware attack is the worst thing to happen to your organization, I hate to tell you – That’s only the beginning.
Don’t misunderstand – an attack is awful. But after an attack, you’re somewhat of a wounded gazelle and the predators start circling. While you may not be responsible for the attack itself, if you mishandle the recovery, regulatory requirements, and communication, you may be hit with multas e ações judiciais. And if that isn’t enough: attackers, competitors, and even potential acquirors and activists may seize the opportunity to pounce.
É por isso que, na qualidade de Diretor Jurídico e de Conformidade e de membro independente do conselho administrativo, acredito que vocês precisam de um plano de proteção de dados comprovado e testado na prática muito antes de seus dados serem comprometidos. Para ajudá-los nessa questão, eis quatro etapas que eu seguiria ao avaliar e responder a um ataque:
#1 Proteja seu perímetro. Ao primeiro sinal de um ataque, você precisa fechar a porta com força e conter o dano.A CrowdStrike estimou recentemente that an attack window is 84 minutes. That’s how long you have before data is bricked, exfiltrated, or destroyed. You don’t have time to debate and the moment you need to close all entry and access points to your business, a ransomware attack cannot be first time you bring the cross-functional team of IT, Security, Legal and others together. You need to be a well-oiled machine and act fast. Practice this like a drill. Know what assets you have, what they access – and be prepared to shut it all down.
#2 Avaliar os danos. Assim que o perímetro estiver protegido, é preciso avaliar os danos. Quais dados foram expostos ou roubados? Quais danos ocorreram? Qual é a sua obrigação contratual de manter e proteger os dados de clientes ou usuários? Como isso afeta você em termos de regulamentações setoriais, estaduais, federais e internacionais? Há mais requisitos de divulgação se aproximando e, como a PwC observou recentemente, seu“Global Digital Trust Insights 2023” survey, “only 9% of the respondents feel highly confident that they can effectively meet all disclosure requirements.” The sooner your team is engaged in the planning, assessment, and remediation process, the better.
#3 Were you a victim or negligent? Did you leave the perimeter unsecured? Did you have loose access or security controls? Do you have a data protection plan in place? When was your last tabletop exercise or system tests? Were the right controls in place to prevent (or quickly detect) the attack? Do you have cybersecurity awareness training in place for employees so they’ve learned how to identify phishing attempts? Customers expect that when they give you their data, you will protect it. Having a data protection plan or solution in place is the cost of doing business. Without it, you are not a victim.
#4 Communicate. Communicate. Communicate. Be transparent with your critical stakeholders. The speed in which you disclose can be a delicate balance because you’re still assessing the impact, identifying the root cause, and remediating. Clearly, your CEO and C-Suite leaders need to know as soon as possible and you’ll alert your Board of Directors. But the most important people you need to communicate with are those impacted by the breach, such as your customers, partners, or employees. You need to notify them as soon as possible.
Conclusão: os invasores estão à espreita, ficam mais espertos a cada dia e o tempo não está a seu favor. Essas medidas vão ajudá-lo a detectar um ataque e se recuperar mais rapidamente, além de lhe dar a confiança de que tomou medidas responsáveis e bem informadas para proteger seus dados.
