Breach Disclosure: Engaging the Enemy
When does preemptive breach disclosure make sense?
By Tracy Mayor
February 01, 2004 — CSO — You've made a big arrest. You've uncovered hostile activity before any damage was done. Is it ever wise to take a preemptive approach to disclosure, to brag to the world of the virtues of your crack security team?
The short answer is no, no, never and no. Security experts unanimously agree that it's never a good idea to release security news, happy or not, unbidden. But there is one clear exception: If the press is going to find out come hell or high water.
Last September, a former Guantanamo Bay translator was arrested at Logan International Airport in Boston with hundreds of CDs of allegedly classified information in his luggage. That same day, Massport Director of Corporate Security Dennis Treece informed his director of media relations, José Juves, that the man had applied for a job at Logan Airport in the days immediately following Sept. 11, 2001.
Rather than have that fact dribble out later and overshadow the good news of the successful arrest, Juves took the news to the media himself. "That way, we were able to get ahead of the story and to put it in context," he says. "If it came out two or three days later, the emphasis would be on how Massport reacted, rather than on the arrest itself."
And it's always best, Juves says, to try to contain coverage to as few news cycles as possible. "When people see several stories on the same incident out there on successive days, even if it's positive, it starts to erode their confidence. As much as possible, we try to have all the information out there at the same time."
Read more about data protection in CSOonline's Data Protection section.
Other stories by Tracy Mayor
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- Introduction to VMware vCenter Site Recovery Manager 5
- Introduction to Virtualization
- Preventing Unplanned Downtime with Server Virtualization
- Secure Cloud Infrastructure and Next-Generation Data Centers - An Interactive Panel for Decision Makers
- Gartner Next Generation Network IPS Webcast
- Understand Your Data: The Future of Backup and Archiving
- Overcome Top 7 Admin Challenges of Active Directory
- Insiders Can Ruin Your Company. Take Action.
- Top Solutions and Tools to Prevent Devastating Malware
- X-Ray of the PCI Process-4 Proactive Steps
- Streamline Compliance and Increase ROI
- Beyond SFTP: Five Ways Secure Managed File Transfer Can Improve Your Business
CSO Corporate Partners
- Patch Tuesday preview, February 2012
Microsoft published its Patch Tuesday Preview for February of 2012 a few minutes ago. IT admins can expect nine bulletins to address 21 security vulnerabilities.
It looks like four bulletins will be rated critical while the rest are designated as important.
Affected Microsoft products are:
- M86 report proves water is wet
- Actor, banker, soldier, spy: Suits and Spooks Anti-Conference aims to redefine security
More Salted Hash with Bill Brenner
