Data breach mitigation

GDPR, short for General Data Protection Regulation, mandates that data breaches be reported within 72 hours after they have been discovered. Therefore, an organisation requires a plan of an incident response before an incident actually happens. To mitigate damage after the breach has occurred, the first step is containing the breach. In order to do that, network security staff must learn exactly how the incident happened. This is to be able to take necessary action and prevent any future damage. Often that means disconnecting the company systems from the Internet but it is not always the case. After the incident has been contained, the next step is to assess the risks. This stage includes investigating the type of data breached, the level of data sensitivity, how many individuals were affected, which categories of people were affected, if any financial or other high-risk data was involved, if the data was encrypted and if the data was backed up. Depending on the scope of the breach, the organisation might have to notify the regulators about the incident. Under GDPR, data breach incidents are only need to be reported if they “pose a risk to the rights and freedoms of natural living persons”. As a final step, the organisation should take measures to prepare for future breaches. The breach that has just occurred should be used as a starting point to investigate which cyber security practices need improvement.

Whitelisting is a trust-centric approach to security whereby access is limited to good sources. Its advantages include computational efficiency, reduced rate of false positives and the fact that tracking of assets and users is enforced. Among its disadvantages are the fact that whitelisting could be labour-intensive and time-consuming to configure. Corporate firewalls should use whitelisting when access is well-defined, for example for accessing internal sources.

Blacklisting, on the other hand, is a threat-centric approach, whereby malicious sources are continuously blocked. Among its pros are the fact that malicious sources are blocked and false negative rate is reduced. Its cons include it being labour-intensive, delayed in time, riskier compared to whitelisting and not effective against zero-day threats. Corporate firewalls should use blacklisting when access sources cannot be easily defined, for instance when public resources are being accessed.