Atlanta Keynote Highlights: Hadas Cassorla

After SolarWinds, after Microsoft Exchange… and after all the breaches that haven’t happened yet, there are thousands of organizations that are suddenly faced with a mountain of decisions. And while the old adage says, “luck favors the prepared,” sometimes it’s a matter of how your organization prepares for a breach that makes all the difference.

Cybersecurity innovator and CISO Hadas Cassorla shared her thoughts on how companies can successfully tackle these challenging moments, and most importantly, regain the trust of their customers.

When it comes to building back the customer relationship, transparency is key. That’s not just in telling them what happened, but ensuring they know the processes you have in place for avoiding this in the future, she said.

“It’s in how you deal with it during the event. The more up front you are, the faster you are in communicating it, then you’ll be better off. Constantly discuss what you’re doing. The more you can share with your customers what you’re doing to protect their data, the better,” Cassorla said.

If your company already has a blog, then use that as your place for openly communicating what you’re doing to keep their data safe.

“From a public relations perspective, you should be as open and honest as you can without putting yourself in future danger.  Tell your consumers about what’s happened, what you’re doing to remediate, how you are containing the breach, and what of their data was affected,” Cassorla said.

To her, it feels like companies are improving on their transparency after a breach. “I really feel like companies more and more are doing better. They learned from other companies who failed miserably,” she said.

An important part of transparency is by being open to suggestions for your current security infrastructure. One great approach she suggests is by implementing bug bounty programs. That is, an incentive-based call to the community to help detect bugs in your infrastructure.

“There’s always potentially an issue. You can seek and invite people to help you secure your environment, and reward them for that,” Cassorla said. “These people are helping you before bad guys come in, as long as [they’re] giving you full disclosure and the opportunity to mediate and protect.”

In terms of prevention, it’s important to understand the timeline of a breach. “It takes 220 days to detect [a breach], and 50 days to remediate,” Cassorla said. “The more you can do in your environment to shorten that detection time, the better you and your customers will be.”

One of the most important things to remember is the ongoing and ever-evolving nature of cybersecurity. “It’s not set-it-and-forget-it,” she said. On this topic, Cassorla’s motto is, “Update, Educate, Automate.” — updates help ensure vulnerabilities are managed; education makes the users a good first-line of defense; automation helps the security team get more done.

But with that said, Cassorla mentioned that it’s important to be realistic about managing your security. Some of these are simple — in her words, “Rotate your keys, people!” But some things just aren’t going to be so easy.

“Every company has security problems! You can’t cure all your security problems; you’re not going to be 100% secure all the time,” she said.

To hear more from Hadas Cassorla, head to the Atlanta Cybersecurity Conference on October 20, where she will be discussing this plus the latest topics affecting cybersecurity professionals.