Craig McGill, Comms for PwC in Scotland, was invited to speak at #PRFest about cyber security and how PR had to be involved from the outset. www.prfest.co.uk

1. Cyber security and PR
Crisis comms
www.pwc.co.uk/Scotland

2. PwC
Annoying but not the end of the
world and relatively easy to fix –
unless defamatory material or
phishing links posted:
• Change passwords and login details
• Enable – where possible – two-factor
or multi-factor login
• Check access privileges
• Inform relevant stakeholders
• Inform media if necessary
• Apologise where necessary – either to
groups or at individual level –
• Remove offensive material
• Work with law-enforcement and cyber
security teams if necessary
• Remind staff of user guidelines for
social media accounts
Where is cyber security an issue?
Quite simply: everywhere
PwC
REPUTATION
Social media accounts
hacked and off-brand
messaging posted
STAKEHOLDER AND
CUSTOMER
INFLUENCE
Website breached and
defaced
FINANCIAL
Corporate network
breached and company data
accessed by unauthorised
third party/parties
Irritating, embarrassing with
potential for far more serious
consequences:
• Same actions as for social media
account issues
• Double check all links, code and
material on site
• Ensure website plugins, CMS are at
latest versions
• Work with experts to ensure no
further data – customer credit cards
for example – was stolen
• If necessary, inform authorities
• Upgrade to HTTPS if not already done
so
• Consider a reward/bounty scheme to
prevent future incidents
The worst kind of attack:
• All information, including emails, on a
network may have been copied
• Staff details, including addresses and
banking information
• Customer details inc cards, personal
data and passwords
• Company plans including product
timelines and intellectual property
• Confidential material company would
have preferred to remain discrete
• Access codes
• Information relating to any third-
parties the company works with,
which may also include IP
• May have been breached via third-
party
#prfest

3. PwC
2016 Cyber Security Breaches Survey
Source: HM Government
#prfest

4. PwC
Why is this an issue?
#prfest

5. PwC
Why is this an issue?
#prfest

6. PwC
Why is this an issue?
#prfest

7. PwC
Why is this an issue?
#prfest

8. PwC
Why is this an issue?
#prfest

9. PwC
Who would do this and what is their capability?
PwC
Disgruntled
customers or
competitors who want
to embarrass you or
steal your data –
potentially even
media
Script kiddies, bored
people and
wannabee Mr Robot
types just looking for
something to do or to
make a name for
themselves
Professional
breachers looking for
data to either steal or
hold a firm to ransom
for
Staff – either current
or ex-staff who are
disgruntled and want
access to information
for personal gain or
those duped into
giving access
• The sad reality is that in 2017 there are multiple people with multiple reasons to want unauthorised access to
your data
• The even more inconvenient fact is that even with the best systems in the world the odds are you cannot stop
people accessing
• What you can do is ensure you have multiple systems to try and deter them in the hope they go away and
have the best tools so that when a breach happens you are ready to react. Better to be prepared and it never
happens than the alternative
People or bots who
want control of your
machine so they can
use it for things like
DDoS attacks
#prfest

10. PwC
Source: Verizon Data Breach Report 2016
It’s as much an internal issue as external…
Harder to spot
malicious activity
when user access is
authorised
Legal hurdles to
monitoring all staff
interactions
Why are they so hard to manage?
Insiders remain the biggest threat….
#prfest

11. PwC
So this happens…
#prfest

12. PwC
What does an attack look like?
Reconnaissance Infiltrate Execute attack &
Cover tracks
www
Embed &
Orientate
>_ DLL
Attacker gathers intelligence
on the target organisation and
it‘s customers to refine their
attack and increase their
chances of success.
• Social media analysis
• Digital footprinting
• Network scanning
Attacker tricks a user into
executing malicious software
to compromise their machine
or gain unauthorised access to
the network.
• Targeted phishing emails
• Social engineering
Attacker gains more access
and installs tools to monitor
systems and business
processes, increasing the
potential impact or financial
rewards for their attack.
• Privilege escalation
• Network traversal
• Passive monitoring
Attacker quickly executes the
attack and the remove
evidence in order to stop the
target identifying the attacker
and preventing future attacks.
• Data extraction
• Financial fraud
• Denial of Service (DoS)
StageTactic/Technique
The majority of attacks target poor security behaviours by individuals to gain initial access, they then
use this access to prepare and then execute their attack for maximum impact/financial gain.
#prfest

13. PwC
Operation Cloud Hopper
https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html
#prfest

14. PwC
Compromise/Detection times
Source: Verizon Data Breach Report 2016
#prfest

15. PwC
Annoying but not the end of the
world and relatively easy to fix –
unless defamatory material or
phishing links posted:
• Change passwords and login details
• Enable – where possible – two-factor
or multi-factor login
• Check access privileges
• Inform stakeholders inc media
• Check what links where shared
• Apologise where necessary – either to
groups or at individual level –
• Remove offensive material
• Work with law-enforcement and cyber
security teams if necessary
• Remind staff of user guidelines for
social media accounts
REPUTATION
Social media accounts
hacked and off-brand
messaging posted
STAKEHOLDER AND
CUSTOMER
INFLUENCE
Website breached and
defaced
FINANCIAL
Corporate network
breached and company data
accessed by unauthorised
third party/parties
Irritating, embarrassing with
potential for far more serious
consequences:
• Same actions as for social media
account issues
• Double check all links, code and
material on site
• Ensure website plugins, CMS are at
latest versions
• Work with experts to ensure no
further data – customer credit
cards for example – was stolen
• If necessary, inform authorities
• Upgrade to HTTPS if not already done
so
• Consider a reward/bounty scheme to
prevent future incidents
The worst kind of attack:
• All information, including emails, on a
network may have been copied
• Staff details, including addresses and
banking information
• Customer details inc cards, personal
data and passwords
• Company plans including product
timelines and intellectual property
• Confidential material company would
have preferred to remain discrete
• Access codes
• Information relating to any third-
parties the company works with,
which may also include IP
• May have been breached via third-
party
From the moment you detect a breach, the battle for
comms is to save and restore the company’s reputation
After the technical team, there is no-one more important
#prfest

16. PwC
Annoying but not the end of the
world and relatively easy to fix –
unless defamatory material or
phishing links posted:
• Check what links where shared
The more serious breach
REPUTATION
Social media accounts
hacked and off-brand
messaging posted
STAKEHOLDER AND
CUSTOMER
INFLUENCE
Website breached and
defaced
FINANCIAL
Corporate network
breached and company data
accessed by unauthorised
third party/parties
Irritating, embarrassing with
potential for far more serious
consequences:
• Work with experts to ensure no
further data – customer credit
cards for example – was stolen
The worst kind of attack:
• All information, including emails, on a
network may have been copied
• Staff details, including addresses and
banking information
• Customer details inc cards, personal
data and passwords
• Company plans including product
timelines and intellectual property
• Confidential material company would
have preferred to remain discrete
• Access codes
• Information relating to any third-
parties the company works with,
which may also include IP
• May have been breached via third-
party
#prfest

17. PwC
Most companies have a relatively
conservative and reactive stance –
but in a crisis that needs to flip and
quickly
• Are the C Suite and other seniors able
to see the value in going from their
traditional approach to a far faster,
proactive pace – especially when most
don’t speak tech or cyber?
• Has that been tested to ensure the
company is able to demonstrate
control (or as much as is possible)
• A company’s stance is not just a
comms issue but is one that comms
need to be heavily involved with
Comms informing the bigger picture proactively
STANCE CORPORATE VALUES TRAINING
Despite the nature of a crisis,
leadership teams need to be able to
hold fast to some, if not all,
corporate values
• Ensure the C Suite and other seniors
are able to align to the company
corporate values and use them in time
of crisis
• Crisis situations are when leaders are
often defined – their actions
remembered for months if not years.
Will they be remembered for putting
customers first, for pulling down the
hatches or some other action?
• Will they agree to stick to the
corporate values and not suddenly
flipflop in the heat of the crisis?
Most media training these days is
relatively benign
• Do the relevant people have proper,
hardened crisis training?
• Can they speak professionally and
with authority without falling back on
jargon?
• Could they sustain a tense live
atmosphere where every action or
utterance – even if meant to be off-
record – could dictate the fate of the
company?
• Will they hold the lines – and the
corporate values – when under
sustained pressure?
• Have they been tested?
#prfest

18. PwC
The first big decisions
The sort of issues a crisis comms plans around cyber security include the
following…
• Who do we call if informed of a breach or it is detected?
• Who makes the call?
• Who is our spokesperson? Do we need more than one?
• Do we drop the website? Even at 2am in the morning?
• Who authorises pulling all the pipes – especially at 2am?
• Do we close the social channels?
• Do we cancel our advertising?
• How do we balance business needs with customer needs?
• How often can we get an update from the technical team?
#prfest

19. PwC
So what to do?
What’s the one
process you see in the
company that
instinctively doesn’t
feel right?
Challenge it.
On projects you are
involved in– challenge
how security – and
privacy - is being built
in
Look for opportunities
to share data with
colleagues in financial
crime, risk, physical
security
Raise awareness of
phishing, data leakage
through interactions
with business contacts
‘Hook’ interest with
strategic links
Where you see
datasets being held in
shared drives, ask
‘why are we doing
that?’, and ‘who has
access?’
Are your security risks
raised, logged and
prioritised?
Do they have the
correct priority?
Inform customers and staff first – but only
when certain a breach has confirmed. Do not
broadcast a breach when it is ongoing
Ensure customers are reached in as many
ways as possible – think PESO but do not
just think digital - and if data has potentially
been stolen, that they understand this
Ensure social and customer teams know
exactly what to say (and what not to say) to
customers
Regular updates on website and social.
Encourage media to get material from these
sites to minimise duplication of effort
One narrative for every channel, updates on
a regular basis
Have a Comms ‘war room’ and have Comms
at heart of decision making
Ensure legal and tech teams understand the
urgency involved – but heed their advice too
Best way to restore that
reputation is by being
transparent
This starts internally
(including legal and tech
teams) but spreads to
external, customer service,
social
Stakeholders will go to four
places when they find out:
• website
• social
• customer phone lines
• media
Only two of those four
channels can be directly
controlled
#prfest

20. PwC
As the technical teams get, well, technical, the role of comms is to
communicate
Customers Regulators Investors
Politicians Media
Third-
party orgs
Security
orgs
Legal
Staff and
C Suite
#prfest

21. PwC
What sort of comms should be going out – and who do you
prioritise?
Customer
emails
Media
statements
Website
– front
page
Visuals
Customer
video(s)
Postal
letters
Intranet
Staff email,
Slack, etc
Video(s)
for others
Info for
suppliers,
third
parties,
FAQ and
responses
Script for
phone
customer
teams
PPC and
social
spend
Advertising
#prfest

22. PwC
How will it play out?
Every scenario is different but there can be similarities…
DAY ONE
• Attack discovered
• Motive understood –
publicity, cash, IP theft,
credit card/login theft
• Technical investigation
launched
• Initial alert to customers
• Update to customers
• Media informed and
updated across rolling
news cycle
• CEO and C-Suite aligned
to corporate values and
do not stray
WEEK ONE
• All customers reached
• Technical issues resolved
– or ongoing to be
resolved
• Review begins – internal
and independent
• Ongoing updates
• Ensure functionality of
websites is restored
• Never say you are now
breach-proof
• Review internal security
procedures and remind
staff
MONTH ONE
• Ensure customers have
done all they can to
protect data
• Campaign to try and
minimise customer losses
• Review processes
• Share as much as
possible to rebuild
confidence by all
stakeholders
• Remind staff cyber
security is not just an
IT matter
#prfest

23. PwC
Preventing a next time – from comms perspective
Disgruntled customers or competitors
who
want to embarrass you or steal your
data – potentially even media
Script kiddies, bored
people and
wannabee Mr Robot
types just looking for
something to do or to
make a name for
themselves
Professional
breachers looking for
data to either steal or
hold a firm to ransom
for
Staff – either current or ex-staff who are
disgruntled and want access to information
for personal gain or those duped into giving
access
• Ensure staff are up to date
with cyber security
policy/process
• Have an up to date policy
• Introduce no-blame policy
• Run drills
• Treat staff and ex-staff in
the best way possible –
salaries, holidays, perks,
place of work and so on
• Offer bounties and rewards for those
who find weaknesses
• Be more involved in cyber community
• Befriend as many as possible
• Hide comms in the code that only
hackers would see
• Be honest and be authentic
• Be the best company you
can be
• Engage with audience and
change things for them
• Treat customers as
partners, not as a cash
grab
• Monitor and respond to
everything
• Use key dates to ensure all
stakeholders are aware of
improvements
#prfest

24. PwC
The checklist
Does your crisis comms plan have all of these covered?
• Do we have standing
statements ready to go
for the most common
and most likely
scenarios?
• Is the crisis comms plan
integrated into the
master crisis document?
• What budgets have been
agreed for emergency
spend?
• Who can approach who
when a situation arises?
• Are there pre-agreed
time periods for comms
to get updates,
minimising intrusion on
tech team time?
• Do we have all the
relevant contact details
– for media, internally
and other stakeholders?
• Are we monitoring all
the right channels on a
24/7 basis
• Do we have a response
plan in place for when
we are informed of a
breach by a third-party?
• Does the comms plan
include us contacting
external orgs that trust
us with their data?
• Have we recently tested
our crisis comms
scenarios?
• Do we accept we will be
on the back foot for a lot
of this and do the
relevant powers that be
accept that?
• Do we have holding
statement webpages and
imagery ready to go?
• Is our data as secure as
can be?
• Is the leadership sure
this is aligned to core
values and can respond
in that way in a live
crisis?
• How good is our crisis
media training?
#prfest

25. PwC
Cyber security is not going away…
Digital revolution
Growing cyber risk
More regulation
Cloud“IoTs” Big DataSocial Media
Evolving
threats
More
connections
Talent
shortage
Arms
race
#prfest

26. PwC
General Data Protection Regulation (GDPR) is coming…
GDPR is built around 3 key pillars:
Transparency Framework Compliance Journey Punishment Regime
• Prior information must be clearer
• Consent rules toughened up
• Access rights are boosted
• Mandatory breach disclosure
• Enhanced rights of regulatory
inspection and audit
• Privacy by Design
• Privacy Impact
Assessments
• Accountability
• Data Portability
• Right to be Forgotten
• Tougher enforcement
powers for regulators
• Financial penalties at 4%
Group Annual
Worldwide Turnover
• Compensation rights for
distress
• Litigation rights for Civil
Society Organisations
• Data Processors liable
#prfest

27. PwC
In summary…
What’s the one
process you see in the
company that
instinctively doesn’t
feel right?
Challenge it.
On projects you are
involved in– challenge
how security – and
privacy - is being built
in
Look for opportunities
to share data with
colleagues in financial
crime, risk, physical
security
Raise awareness of
phishing, data leakage
through interactions
with business contacts
‘Hook’ interest with
strategic links
Where you see
datasets being held in
shared drives, ask
‘why are we doing
that?’, and ‘who has
access?’
Are your security risks
raised, logged and
prioritised?
Do they have the
correct priority?
• Identify – What are our crown jewels
and biggest threats?
• Protect – Implement controls in line
with risk appetite
• Detect – Implement monitoring
processes
• Respond – Have tried and tested
response plan. Learn from past
incidents.
Treat cyber security as you would any other
risk
Understand your exposure and appetite –
set controls accordingly
#prfest

28. PwC
The key messages…
• Cyber security has become a key risk for businesses of all sizes and across all industries
• Cyber security goes beyond the realms of IT and should involve the entire organisation
• People remain the biggest weakness in Cyber security defences – education & awareness programs
should be a key strategic priority
• External cyber attacks are becoming ever increasingly indiscriminate – assuming you will not be a
target is no longer an option. You may even be collateral damage
• Those organisations who have tried and tested responses processes are those least impacted by an
incident
• The cost of failure is huge – Comprises not just business disruption and remedial activity, but
reputational and increasingly punitive damages…
#prfest

29. PwC
The key point to remember…
Cyber security and infosec is no longer an IT issue, it is something
that impacts upon all staff at all levels and as such should be
treated that way
(And ensure you have everything drilled and rehearsed in
training)
This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the
information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy
or completeness of the information contained in this publication, and, to the extent permitted by law, PriceWaterhouseCooper LLP, its members, employees and
agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the
information contained in this publication or for any decision based on it.
© 2017 PriceWaterhouseCooper LLP. All rights reserved. In this document, “PwC” refers to PriceWaterhouseCooper LLP which is a member firm of
PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity. #prfest