Intrusions into corporate networks have become common and, unfortunately, in most cases those affected only realise it too late. What can you do if you have been hacked? How can you prevent the next intrusion?
Perhaps the most important question is who is behind the hack. In most cases, bots constantly scanning the internet find vulnerabilities from the outside, or they infect employees’ computers and reach our devices through the vulnerable network. In the next phase of the intrusion, the automated tool is replaced by a malicious hacker who tries to obtain as much sensitive data as possible.
Documents, databases, images: they try to copy as much data as they can. The focus is on copying sensitive data, which means the data stays exactly where it should be, yet it is compromised and in the wrong hands. Attackers often work unnoticed and cover, hide or deliberately confuse their tracks.
The worst-case scenario is that a competitor with a financial interest in our sensitive data is behind the attack. This can sometimes explain a sudden loss of market share, lost bids or other financial setbacks.
What can we do?
If we were hacked and noticed it ourselves:
Find out the extent of the data breach, with the help of an external specialist if necessary. Report the data breach. Let the stakeholders know what happened. Change passwords. Conduct a security assessment. Handling the incident transparently is the best way to limit the damage to your reputation.
If we were hacked and someone else told us:
The worst-case scenario here is that we learn about the misuse of the leaked data from the media. In this case, negative news about the company is inevitable, and only transparency can win back our clients.
How can you protect yourself from hacking? Regular vulnerability assessments provide continuous feedback on the state of your systems. External and internal assessments, penetration tests and audits are the recommended tools. It is also important to train employees and raise their security awareness.