This document outlines 5 steps to successfully protect an organization's brand image in the event of a data breach: 1. Contain the breach by isolating affected systems, implementing an incident response plan, and preserving evidence. 2. Investigate to fix systems and prevent further damage by following the incident response plan and assembling an incident response team. 3. Consider public communications by determining notification procedures, identifying spokespeople, and crafting audience-specific statements with legal counsel.

1. Successfully Protecting Your Organization's Brand Image
If you suspect a data breach, your goal is clear: stop information from being
stolen, and repair your systems so it won’t happen again. The following 5
steps will help you successfully stop information from being stolen, mitigate
further damage, and restore franchise operations as quickly as possible.
OF BREACHES INVESTIGATED BY SECURITYMETRICS FORENSIC INVESTIGATORS:
A BUSINESS TYPICALLY LEARNS THEY’VE BEEN BREACHED IN ONE OF FOUR WAYS:
33%Food Services Retail Trade Hospitality
29% 10%
HOTELHOTEL
A bank
informs you
Law
enforcement
Discovered
Internally
A customer's
complaint
DO YOU SUSPECT A DATA BREACH?
consulting@securitymetrics.com
801.705.5656
ISOLATE THE AFFECTED SYSTEM(S) TO PREVENT FURTHER DAMAGE.
CONTAIN
THE BREACH3.3.
Implement your IRP
Disconnect from the Internet
Document the entire incident
Disable remote access capability and wireless access points
Change access control credentials (usernames and passwords)
Segregate all hardware devices in the payment process
Quarantine instead of deleting (removing) identified malware
Preserve firewall settings, firewall logs, system logs, and security logs
Restrict Internet traffic
Contact your merchant processing bank
Consider hiring a law firm experienced in managing data breaches
2.2.PRESERVE
EVIDENCE
WHEN YOU OR YOUR FRANCHISEES DISCOVER A BREACH, REMEMBER:
Don’t panic
Don’t take any hasty actions
Don’t wipe and re-install your systems (yet)
Do follow your incident response plan
START YOUR
INCIDENT RESPONSE PLAN1.1.
Assemble your Incident Response team immediately
Inform franchisees of your IRP
Teach franchisees of immediate and long-term actions
4.4.CONSIDER PUBLIC
COMMUNICATIONS
Determine how and when notifications will be made
Know legislated mandatory time frames
Identify who is responsible for public statements
Seek the guidance of your legal counsel
Don't allow employees to announce the breach
Craft specific statements that target various audiences
INVESTIGATE, FIX YOUR
SYSTEMS, AND IMPLEMENT
YOUR CYBER INSURANCE PLAN5.5.
BRING AFFECTED SYSTEMS
BACK ONLINE
Ensure all systems have been:
Hardened
Patched
Replaced
Tested
SET YOUR BREACH PROTECTION
SERVICES INTO MOTION
Breach protection services can reimburse for:
Forensic investigation fees
Notification costs
Card brand fines
REMEMBER, PRACTICE REDUCES PANIC!REMEMBER, PRACTICE REDUCES PANIC!
© 2016 SecurityMetrics