What To Do When A Breach Occurs

The first challenge to the GDPR’s breach notification requirement is to detect when a qualifying breach has taken place and determine which assets might be at risk. Almost by definition, any successful external security breach must have either evaded detection entirely or was not detected quickly enough. This means it either exploited an attack mechanism unlike any previously encountered, or the flags that it did raise were missed. In 2016, the average time taken for an organizationto become aware of a typical breach was almost fivemonths! Fortunately, the GDPR 72-hour notification window opens at the moment of detection, not the moment of intrusion. Since it is clearly impossible to detect the undetectable, security administrators should accept and prepare for the inevitable, occasional intrusion while striving to minimizesuch occurrences and hasten their detection through every means possible. As previously noted, the GDPR does not require notification for all security breaches, only those that present a risk to the rights of individuals.

In the moment of a breach, please try and contact DWS,as we work proactively with organizationsto help your situation to ensure it is handled effectively and immediately. A strategy will be defined,and the appropriate technology around that strategy will ensure that proper incident management procedures are followed, the right stakeholders are alerted and actively involved, documentation is captured throughout the investigation,and remediation processes are followed to ensure proper reporting post-mortem. Remember, the full process of identifying, reporting,and resolving the breach must be completed within 72 hours.