From crisis to control: Why timely incident reporting matters

In 2018, a Tesla employee reported suspicious behaviour from a colleague who was accessing sensitive company data without authorisation. The employee’s quick action in reporting the behaviour led to an internal investigation.

The internal investigation uncovered that the colleague was indeed engaging in unauthorised activities, including leaking confidential data. Tesla’s security team swiftly acted to terminate the individual’s access and secure the compromised systems.

Benefits of Swift Incident Reporting

Whether it’s an insider threat or a suspicious emails landing in your inbox, there are multiple benefits to swift incident reporting:

Prevention of data theft: A quick report prevents further data leakage and protected a business’s intellectual property and sensitive data, particularly personally identifiable information (PII).

Strengthened security measures: Identified incidents lead to enhanced monitoring and security protocols to prevent future threats.

Reinforced trust: Timely reporting reinforces a culture of trust and responsibility among employees, emphasising the importance of vigilance and ethical behaviour.

The Role of Incident Response (IR)

Incident response is a critical component of an organization’s cybersecurity strategy. By understanding the importance of incident response and actively participating in the protection of your business’s digital assets, you play a vital role in safeguarding the company from potential cyber threats.

Here are the incident response best practices, including the do’s and don’ts, detailing the importance of reporting cyber incidents:

Before we dive into the do’s and don’ts, let’s clarify what incident response is. Incident response refers to the process of detecting, analysing, and mitigating security incidents within an organisation. These incidents can include data breaches, cyberattacks, or any situation where sensitive information is compromised.

The Do’s of Incident Response

1. Report Immediately:

• Do report incidents promptly. As soon as you suspect an incident, notify your IT or Cybersecurity team. Time is critical in containing and minimising damage.
• Remember, reporting promptly helps protect the organisation and its digital assets.

2. Follow incident response procedures:

• Do familiarise yourself with the incident response plan. Understand your role and responsibilities during an incident.
• Follow the documented procedures step by step.

3. Preserve evidence:

• Do preserve evidence. Avoid tampering with affected systems or files.
• Document everything—timestamps, actions taken, and any suspicious activity.

4. Collaborate and communicate:

• Do work closely with your incident response team. Share information and collaborate effectively.
• Communicate quickly and clearly with management about the incident.

5. Learn from incidents:

• Do treat incidents as learning opportunities. After resolution, analyse what went wrong and how to prevent similar incidents in the future.
• Continuous improvement is key.

The Don’ts of Incident Response

1. Don’t panic:

• Don’t panic or make hasty decisions. Stay calm and follow established procedures.
• Panic can lead to mistakes that worsen the situation.

2. Don’t delay reporting:

• Don’t wait to report an incident. Delaying reporting can escalate the impact.
• Remember, early detection and response really do matter.

3. Don’t share sensitive information:

• Don’t discuss incident details with unauthorised individuals. Only share information with the information security department and incident response team.
• Confidentiality is crucial.

4. Don’t retaliate or investigate alone:

• Don’t take matters into your own hands. Leave the investigation to the experts.
• Retaliating against attackers can backfire.

5. Don’t ignore security policies:

• Don’t bypass security policies or procedures. They exist for a reason.

Understanding the importance of reporting cyber incidents

The Protection of Personal Information Act (POPIA) mandates that reporting incidents is mandatory, and a business must inform all data subjects if their PII has been breached – this includes employees, customers and suppliers. Failure to report can result in significant fines and penalties.

However, as an employee, you also have a crucial role to play. For example, reporting incidents and sharing the information, helps improve overall cybersecurity awareness. The sooner you report, the faster experts can assist in responding to the attack.

Remember, cybersecurity is a collective effort. Being mindful of these guidelines, you contribute to safeguarding your company’s digital assets and reputation.