Page 51 - the SyI Quarterly 15

concerned - and the public at large. Such publicity 3. There is often a reluctance to destroy personal
inevitably has a negative impact on the reputation
of any organisation, potentially incurring fines for
inadequate security measures in the storage of
personal data, bringing a flood of complaints from
unsuspecting affected parties, and even resulting in
lawsuits from individuals.
Things get more complicated when hackers proceed
with a triple extortion. This is a scenario, where if the
victim does not succumb, the hackers now target the
affected individuals themselves since they have their
personal data and threaten to reveal personal details.
If this data is sensitive, the extortion success rates
increase.
If organisations do their homework i.e. their risk
and threat assessment they will be soon aware of
the consequences they will be facing in case of a
successful Ransomware attack. The engagement of
sophisticated exploit methods and tools by hackers
often backed by Artificial Intelligence becomes
a real challenge for cybersecurity professionals.
Ransomware as a service becomes a notorious
service for anyone with ulterior motives to engage
such methods to profit. Therefore, in addition to
the imperative cybersecurity measures the need
to implement to protect and prevent Ransomware
attacks, it is recommended that the organization
focuses on increasing its resilience. On the one hand,
this will limit the damage after a successful cyber-
attack, and on the other hand, it will significantly
reduce the time it takes for the organisation to return
to normal operations. There are many things that an
organisation of any size can and should do. Below are had personal data compromised. The losses in time,
five basic and simple tips to reduce the risk of data
breaches and improve resilience:
1. The volume of personal data is a decisive factor,
both in the assessment of potential fines and
in the organisation’s efforts to identify and
inform those individuals affected. Therefore, it is
recommended that the amount of personal data
retained be kept to a minimum.
2. Encryption is a very important mechanism for
the defence of the organisation, which is also
recommended by the actual Data Protection
Regulations. Therefore, the organisation should
encrypt the personal data where possible
including data in backups and databases. Even if
the data are exfiltrated cannot be used since are
not in readable form.
data that is no longer needed. Record
management policies become of particular
importance as mentioned above, and therefore
periodic housekeeping and destruction of personal
data that have expired, are inactive or previously
acquired and kept for no specific purpose, is
recommended.
4. A simple and well-tested data breach response
plan should be in place beforehand, including likely
data breach scenarios and corresponding actions
of coordination, for notification to authorities,
communication with individuals affected and other
stakeholders to ensure transparency about the
incident. It is also of particular importance that
the organisation is able to respond and notify the
incident within 72 hours of the time it comes to
its attention, which can be particularly challenging
when the breach occurs during holidays and
weekends.
5. Finally, many organisations mistakenly fear the
cost of an in-depth investigation, not realising that
the investigation will allow them to quantify the
risk to the individuals and thus avoid unnecessary
actions and fines that may sometimes exceed the
cost of the investigation. A detailed investigation
process at a legal, technical and operational level
is considered of particular importance, mandated
by the GDPR itself, and expected by competent
authorities as part of the principle of accountability
following a data breach.
Clearly there is no easy way out for an organisation
that has been attacked by Ransomware and has
resources and reputation can potentially become
enormous. The process from the moment the incident
is discovered is painstaking and tests the resilience of
any organisation of any size to a very high degree.
Drawing lessons from organisations that have been
affected by Ransomware attacks internationally,
invariably forces organisations to up their security
game and plan to function at a high resilient state.
Admitting that sooner or later a security incident will
occur and disrupt operations helps the executives
to invest in resilience. A resilient organisation is one
that primarily has the capabilities to respond and the
capacity to absorb the consequences of any security
incident. Anticipation, preparation, vigilance and
coordinated response are elements that increase the
capacity of the organization and remain critical factors
for navigating today’s rising digital threats.