Companies advised on data-breach clean-up

Any organisation trying to cope with the consequences of a data breach should beware of getting bogged down in the details, according to a former US Air Force major.

The US Air Force experienced a data breach in May 2005 when 33,000 personal staff records were downloaded from a management system.

Bruce Jenkins, a recently retired major from the US Air Force and now security director at Fortify Software, was on the team responsible for managing the fallout from the data breach.

When the breach occurred, a crisis action team was activated — consisting of programme-management officers, security analysts and special investigators to liaise with the Air Force's network operators and security centre.

The team then did a top-to-bottom review of all the applications within the breached management system, which included reviewing the system's password procedures, log-on methods and revalidating privileges.

The new identity-authentication and system-design policies were in place within 90 days of the breach.

Speaking at the Gartner IT Security Summit, Jenkins said it is important to "take baby steps but to do something" when managing a breach and not get caught up in the exact details of an action. Jenkins said, however, that it is also important to make sure lessons are learnt and any early successes are communicated to the rest of the workforce.

Jenkins added it is also important to quantify the cost of the data breach when implementing the subsequent security programme.

He added that those managing the response to a data breach should sell hard to key leaders to get the job done but "not shove things down the throats of the developers", instead highlighting the improvements any changes will make to their work.