Archive for December, 2010

For years in the continuity business, I’ve spoken to audiences about the fact that you can’t outsource your first response. This is true at a community level, and it is true for businesses. When a fire strikes, the red trucks and water don’t come from Washington; they come from your local volunteer or paid fire fighters. The same is true for corporate disasters; outsourced partners and support vendors will be involved, but the first response will likely come from within your organization.

Step One: Prepare in Advance

Preparing first response tactics are best done well in advance of any actual disaster. You need health and safety plans in place before any fire, flood or earthquake impacts your business. For some events, like a hurricane, you may have a few hours’ notice before the storm actually hits, but in this stage you are likely already activating your response plan – not creating it as the storm winds gather.

Cybersecurity is no different from a planning perspective, but is often overlooked. Recently, major credit card companies Visa and MasterCard experienced disruptions in service due to cyber attacks, as reported in the Huffington Post and most major news outlets. A key lesson to be learned here is that when we hear names like Visa and MasterCard, we know they have sophisticated security systems and teams of people handling their security threats 24 x 7. And even with those protective measures, they still were compromised.

Some in our industry use the phrase “… it’s not ‘if’ but ‘when’ you experience a disaster …” to justify support for their programs, or to spur management support for improving the maturity of existing programs. Cyber threats are a certainty – their probability is 100%. It has been estimated by security software vendor Symantec that more than 90% of all Internet traffic can be classified as spam or malware.

Mitigate Impact With Effective Crisis Communications

That means that cyber threats need to be classified as high frequency events with potentially high impact. Effective cybersecurity programs call for defense in layers, monitoring potential attacks, and need to include not only a technical team of first responders, but an effective management response and crisis communications. E-Commerce depends on trusted pathways that reflect security that consumers are comfortable will protect their financial information. A recent SunGard paper reported that 69% of the financial impact from security failures was due to lost revenue and customer turnover. Just as in the often used example of the Johnson and Johnson response to the Tylenol disaster some 20 years ago, effective first responders – which include crisis communications – are essential for companies to maintain the trust of their customers in any e-commerce systems and applications.