The Top 3 Mistakes Businesses Make After a Hack A cybersecurity expert explains what not to do after a data breach.

By Carly Okyle

entrepreneur daily

Opinions expressed by Entrepreneur contributors are their own.

Shutterstock

Rajesh De (pronounced Day) knows a thing or two about cybersecurity. Before becoming head of the cybersecurity and data privacy division at law firm Mayer Brown, he served as general counsel for the National Security Agency during the most notorious data breach in history: Edward Snowden's exposing of the agency's surveillance programs.

"Back then, nobody knew about the NSA," he told the audience at the Cyber Security Thought Leadership Forum in New York City on Monday. "[The joke was] the acronym stood for No Such Agency." Even De's wife was puzzled by his decision to work for "the agency that sends astronauts into space."

Having experienced a high-profile data breach firsthand, De imparted some wisdom to the crowd at the forum this week. He explained the top three mistakes that businesses make when responding to a cyber attack.

Related: Alphabet's Eric Schmidt: Gmail Is "Far More Secure' Than Government Systems

1. Not recognizing cybersecurity is the responsibility of more than just the tech department.

When thinking about the issue of cybersecurity, organizations must realize that it's more than a technical issue. "It's much bigger than that," De said. "It's a core business risk, and the consequences of thinking of it as such reaches everything."

Placing security as a core value means that it impacts prioritization, budget concerns, time management and preparation -- both to prevent a breach and to have a response plan at the ready.

2. Share the right amount of information at the right time.

De drew directly from his experience at the NSA when explaining that knee-jerk reactions to share too much and too little information with the public are dangerous. "Generally there's one faction that will want to be so transparent, to tell everybody in the world anything that is known at any given moment, whether it's definitive or not," he said. "Of course there's value in giving real-time education to customers, but there's no value in spitting out a lot of info that has to be walked back. That really confuses people more than it enlightens people."

Going too far in the opposite direction, however, is also ill-advised. "Clearly, that approach runs a huge range of risks, whether they're reputational or otherwise," he said.

Finding the right balance depends on a variety of factors -- the nature of the attack and how the facts develop, among other details -- but striking that middle ground is key.

Related: 8 Tips To Prepare Your Business for an Inevitable Cyber Attack

3. Not having all of the relevant players in the loop ASAP.

While deciding what to explain to the public at what time can be tough to figure out, giving the details to the necessary people on the inside early on is vital. "If you don't have a communications firm or a law firm built into your crisis response plan, and they have to catch up later, that really does a disservice to the organization," De said.

Yet ripples from the Snowden hack at the NSA still loom large. On Tuesday, the Senate passed a controversial bill called the Cybersecurity Information Sharing Act (CISA). The bill encourages companies to share information about hackers and data breaches with both the government and other businesses in the private sector. Although critics say it infringes on customers' privacy while also failing to adequately prevent cyber attacks, supporters say the legislation is a positive step to protect data from cyber attacks in the future.

The bill is expected to be sent to President Obama for his signature after it's been combined with two additional bills passed by the House of Representatives earlier this year that also concerned sharing information.

Related: All in the Family: How This Father-Son Team Built a $3.5 Billion Cybersecurity Business

Carly Okyle

Assistant Editor, Contributed Content

Carly Okyle is an assistant editor for contributed content at Entrepreneur.com.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick

Related Topics

Data & Recovery

Get 2TB of Cloud Storage with PhotoSphere for Just $280 for a Limited Time

Easily store and access photos, videos, and other files spread across your work devices.

Thought Leaders

10 Simple, Productive Activities You Can Do When You Aren't Motivated to Work

Quick note: This article is birthed out of the urge to do something productive when I am not in a working mood. It can also inspire you on simple yet productive things to do when you're not motivated to work.

Business Ideas

55 Small Business Ideas to Start in 2024

We put together a list of the best, most profitable small business ideas for entrepreneurs to pursue in 2024.

Business News

Here Are 3 Strategies Startup Founders Can Use to Approach High-Impact Disputes

The $7 billion "buy now, pay later" startup Klarna recently faced a public board spat. Here are three strategies to approach conflict within a business.