{"id":12835,"date":"2016-10-01T11:40:27","date_gmt":"2016-10-01T11:40:27","guid":{"rendered":"http:\/\/www.biphoo.com\/bipnews\/?p=12835"},"modified":"2016-10-01T11:40:27","modified_gmt":"2016-10-01T11:40:27","slug":"10-things-need-business-gets-hacked","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/security\/10-things-need-business-gets-hacked.html","title":{"rendered":"10 Things You Need to Do If Your Business Gets Hacked"},"content":{"rendered":"

10 Things You Need to Do If Your Business Gets Hacked<\/span><\/strong><\/span><\/h2>\n

10 Things You Need to Do If Your Business Gets Hacked<\/strong> : What\u2019s worse than a massive data breach? Not reporting it.<\/span><\/p>\n

Yahoo is learning that lesson the hard way. The Internet giant is coming under intense scrutiny for only just revealing that at least 500 million of its user accounts were stolen back in 2014. It now faces multiple class action lawsuits and its sale to Verizon could be in danger.<\/span><\/p>\n

The lessons learned don\u2019t apply just to big corporations: any small business that collects customer information also has important obligations to its customers. In fact, 47 states and the District of Columbia each have their own data breach laws. (Only Alabama, New Mexico, and South Dakota do not.)<\/span><\/p>\n

Increasingly, hackers are turning their attention to entrepreneurs. Forty-three percent of hack attacks in 2015 were against small businesses, according to Symantec\u2019s 2016 Internet Security Threat Report. This is a 9% increase compared to 2014.<\/span><\/p>\n

Here\u2019s what small-business owners are required to do in the event of a data breach:<\/span><\/p>\n

1. Inform customers immediately: Once you know a breach has occurred, by law you are required to inform customers whose data has been compromised. State laws may vary on how quickly you need to get the word out. Generally speaking, however, \u201cspeed is of the essence,\u201d says Thomas Brown, managing director in charge of the cyber-security and investigations practice at Berkeley Research Group. Michael Kaiser, the executive director of the National Cyber Security Alliance, says businesses should inform consumers as quickly as possible, even if they don\u2019t have all the answers. Exceptions may include when an investigation by law enforcement authorities is underway.<\/span><\/p>\n

2. Send a written notification: You\u2019ll need to send a written notification to every customer, that clearly states a data breach has occurred, when it occurred, and what kind of information was compromised. For example, was it driver\u2019s licenses, credit card numbers, or social security numbers that were stolen? You\u2019ll also need to say what the company is doing to provide a remedy, and what actions customers can take. Remedies may include directing people to a website or a 1-800 number set up by the company, where they can get additional information. You may also want to supply contact information of the three credit monitoring agencies, Equifax, Experian and Transunion, which can put fraud alerts on consumer accounts. In some cases, if the data breach involved more than 500,000 customers or notification costs would exceed $250,000, many state laws allow you to send electronic communication. (California, whose data breach statute is considered the most stringent in the U.S., includes in its law the exact template that businesses need to follow when communicating with customers about a data breach.)<\/span><\/p>\n

<\/object><\/span><\/p>\n

3. Know the state laws. Currently the only state to do so, Connecticut recently amended its breach statute requiring businesses to offer a minimum of one year of credit monitoring to consumers affected by a data breach. You\u2019ll need to offer it if you operate in the state.<\/span><\/p>\n

4. File a notice of breach. If you notify more than 500 customers about a breach, many states will also require you to file a notice with your state attorney general\u2019s office.<\/span><\/p>\n

5. Comply with your industry\u2019s regulating bodies. Businesses operating in certain industries, such as healthcare and financial services, may have additional notification requirements for example under the Health Insurance Portability and Accountability Act (HIPPA), or through regulating bodies including the Securities and Exchange Commission (SEC) or the Financial Industry Regulatory Authority (FINRA). Among other things, HIPPA stipulates that if a healthcare business experiences a breach involving more than 500 customers, it must notify a prominent media outlet about the incident. The SEC and FINRA also require financial services businesses to contact them about breaches, as well as any state regulating bodies.<\/span><\/p>\n

6. Implement an \u2018incident response\u2019 plan. Have an \u201cincident response\u201d plan in place. It should be written and updated at least once a year. It should include the telephone numbers for attorneys, IT forensic experts, and vendors who can help with customer outreach. It should also map out what your computer network looks like, so you can easily identify the potential vulnerabilities. That would include any staff regularly working offsite, cloud service providers, or the networks of any company you may have recently acquired.<\/span><\/p>\n

7. Call in a forensics team. Once a hack attack occurs, you should bring in cybersecurity experts who can test your network to find out what kind of hack attack occurred and in what part of your network. You should also consider annual testing to find out where your network weaknesses are \u2014 through a process called \u201cpenetration testing\u201d, where experts closely scrutinize your network for holes that hackers can exploit. That\u2019s particularly important as the nature of cyber threats changes quickly and continuously, security experts said.<\/span><\/p>\n

8. Notify local and federal authorities. It\u2019s not a requirement in most instances, but it could be extremely helpful, as the hack attack against your business might be part of a coordinated attack by criminals. \u201cLocal police may already be seeing similar kinds of attacks, and collecting evidence against perpetrators,\u201d Kaiser says.<\/span><\/p>\n

9. Consider cyber insurance. Policies can be purchased from most major insurance carriers for between $5,000 and $10,000 per $1 million in protection, says Mark Greisiger, president of NetDiligence, a cyber risk management firm. Policies will generally cover things like legal and forensic fees, expenses related to customer outreach, costs for providing customer credit monitoring, and court costs related to civil litigation and class actions. Many policies come pre-loaded with access to online portals that let you connect immediately with the experts you\u2019ll need following a breach, Greisiger says.<\/span><\/p>\n

10. Come up with a contingency plan. Data theft can shut down your business for weeks or months while IT experts work to secure your network again. You\u2019ll need to do serious damage control with your existing customers, and figure out a way to keep sales channels open. That might include having a backup network or reverting to old-fashioned methods of selling, such as taking orders by phone or paper. \u201cYou have to get back to operating as quickly as possible,\u201d Kaiser says.<\/span><\/p>\n

Source<\/strong> : http:\/\/fortune.com\/2016\/09\/30\/10-things-business-hack-attack\/<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t