The Top 3 Mistakes Businesses Make After a Hack 

Rajesh De (pronounced Day) knows a thing or two about cybersecurity. Before becoming head of the cybersecurity and data privacy division at law firm Mayer Brown, he served as general counsel for the National Security Agency during the most notorious data breach in history: Edward Snowden’s exposing of the agency’s surveillance programs.  

“Back then, nobody knew about the NSA,” he told the audience at the Cyber Security Thought Leadership Forum in New York City on Monday. “[The joke was] the acronym stood for No Such Agency.” Even De’s wife was puzzled by his decision to work for “the agency that sends astronauts into space.”

Having experienced a high-profile data breach firsthand, De imparted some wisdom to the crowd at the forum this week. He explained the top three mistakes that businesses make when responding to a cyber attack.

1. Not recognizing cybersecurity is the responsibility of more than just the tech department.

When thinking about the issue of cybersecurity, organizations must realize that it’s more than a technical issue. “It’s much bigger than that,” De said. “It’s a core business risk, and the consequences of thinking of it as such reaches everything.”

Placing security as a core value means that it impacts prioritization, budget concerns, time management and preparation -- both to prevent a breach and to have a response plan at the ready.

2. Share the right amount of information at the right time.

De drew directly from his experience at the NSA when explaining that knee-jerk reactions to share too much and too little information with the public are dangerous. "Generally there’s one faction that will want to be so transparent, to tell everybody in the world anything that is known at any given moment, whether it’s definitive or not,” he said. “Of course there’s value in giving real-time education to customers, but there’s no value in spitting out a lot of info that has to be walked back. That really confuses people more than it enlightens people.”

Going too far in the opposite direction, however, is also ill-advised. “Clearly, that approach runs a huge range of risks, whether they’re reputational or otherwise,” he said.

Finding the right balance depends on a variety of factors -- the nature of the attack and how the facts develop, among other details -- but striking that middle ground is key.

3. Not having all of the relevant players in the loop ASAP.

While deciding what to explain to the public at what time can be tough to figure out, giving the details to the necessary people on the inside early on is vital. “If you don’t have a communications firm or a law firm built into your crisis response plan, and they have to catch up later, that really does a disservice to the organization,” De said.

Yet ripples from the Snowden hack at the NSA still loom large. On Tuesday, the Senate passed a controversial bill called the Cybersecurity Information Sharing Act (CISA). The bill encourages companies to share information about hackers and data breaches with both the government and other businesses in the private sector. Although critics say it infringes on customers’ privacy while also failing to adequately prevent cyber attacks, supporters say the legislation is a positive step to protect data from cyber attacks in the future.

The bill is expected to be sent to President Obama for his signature after it’s been combined with two additional bills passed by the House of Representatives earlier this year that also concerned sharing information.