Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
External Communications: Customers, Media and Law Enforcement
Trust is on the line
Customers, partners and the public forgive incidents more readily than they forgive being misled. Clear, honest, timely communication can protect reputation through a serious breach; confused or defensive communication can destroy it.
Principles
| Do | Don’t |
|---|---|
| Communicate early, even with partial facts | Speculate or guess numbers |
| Be accurate, and say what you don’t know yet | Minimise, then have to correct it |
| Tell people what they should do | Blame others before the facts are known |
| Speak with one voice, through designated spokespeople | Let staff comment on social media |
| Update regularly | Release statements without legal review |
Audiences
| Audience | What they need | Who leads |
|---|---|---|
| Customers | What happened, the impact on them, what to do | Communications, with legal |
| Partners and suppliers | Impact on shared systems and data | Business owners and security |
| Media | A concise, approved statement | A designated spokesperson |
| Investors | Material impact and required disclosures | Investor relations and legal |
| Law enforcement | Evidence and facts to investigate | Legal |
Law enforcement and attackers
- Involving law enforcement can help investigation and recovery, but brings publicity and evidence requests. Legal and senior management decide.
- Contact with attackers happens only through authorised specialists, never by individual staff.
- Ransom decisions are made by executives with legal, the insurer and specialists. Payment doesn’t guarantee data is deleted or keys work, and may be illegal if the group is sanctioned.
- Insurers often require notice before the organisation engages response firms or pays anything.
Example. A retailer announces a breach early, says clearly that payment cards weren’t involved but email addresses were, warns customers about phishing emails using the breach as a lure, and updates its page daily. Complaints are lower than at a peer that delayed and later revised its numbers twice.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who speaks to the media? | A designated spokesperson |
| Most important principle in breach communication | Timely, accurate, honest communication |
| Who decides to involve law enforcement? | Legal counsel and senior management |
| Staff are approached by journalists | Refer them to the designated spokesperson |
| Risk of paying a ransom | No guarantee of recovery; may break sanctions laws |
In short
- External communication protects trust; how an incident is communicated often matters more to reputation than the incident itself.
- Principles: early, accurate, consistent, honest about what isn't known yet, and clear about what recipients should do.
- Only designated spokespeople speak externally; statements are reviewed by legal and communications.
- Customers and partners need practical guidance (reset passwords, watch for fraud); regulators get formal notifications.
- Involving law enforcement is a decision for legal and senior management, weighing investigation support against publicity and disruption.
- Ransom negotiations and payments involve legal, executives, insurers and specialists; sanctions laws may apply.
Exam traps
- Speculating about numbers or causes, then correcting them, damages credibility badly.
- Staff comments on social media can contradict official statements.
- Communicating with the attacker without authority and specialist help is dangerous.
- Paying a ransom may be illegal if the group is sanctioned, and doesn't guarantee data is deleted.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Principles
1 / 8