{"id":14837,"date":"2019-03-14T09:10:03","date_gmt":"2019-03-14T17:10:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/03\/14\/news-8586\/"},"modified":"2019-03-14T09:10:03","modified_gmt":"2019-03-14T17:10:03","slug":"news-8586","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/03\/14\/news-8586\/","title":{"rendered":"Reputation management in the age of cyberattacks against businesses"},"content":{"rendered":"<p><strong>Credit to Author: Jovi Umawing| Date: Thu, 14 Mar 2019 16:15:59 +0000<\/strong><\/p>\n<p>Avid readers of the Malwarebytes Labs Blog would know that we strive to prepare businesses of all sizes for the inevitability of cyber attacks. From <a href=\"https:\/\/blog.malwarebytes.com\/101\/2018\/11\/create-sticky-cybersecurity-training-program\/\" rel=\"noopener\">effectively training employees<\/a> about basic cybersecurity hygiene to guiding organizations in formulating an <a href=\"https:\/\/blog.malwarebytes.com\/101\/business\/2018\/03\/building-an-incident-response-program-creating-the-framework\/\" rel=\"noopener\">incident response (IR) program<\/a>, a <a href=\"https:\/\/blog.malwarebytes.com\/101\/2016\/03\/how-to-create-a-successful-cybersecurity-policy\/\" rel=\"noopener\">cybersecurity policy<\/a>, and introducing an <a href=\"https:\/\/blog.malwarebytes.com\/101\/2017\/10\/how-to-create-intentional-culture-of-security\/\" rel=\"noopener\">intentional culture of security<\/a>, we aim to promote proactive prevention.<\/p>\n<p>However, there are times when organizations need to be reactive about some things. And one of these is business reputation management (BRM), a buzzword that refers to the practice of ensuring that organizations are always putting their best foot forward, online <em>and<\/em> offline, by constant monitoring and dealing with information and communications that help shape the public perception of a company. This is a process that executives must not miss out on, most especially when the company has found itself in the center of a media storm after disclosing a cybersecurity incident that has potentially affected millions of their clients.<\/p>\n<p>In this post, we look at why companies of all sizes should have such a system in place by having a refresher on reputation and how much with consumer trust and loyalty have evolved. We\u2019ll also show you what proactive and reactive BRM would look like before, during, and after an event of a cybersecurity fallout.<\/p>\n<h3>Reputation, like beauty, is in the eye of the beholder<\/h3>\n<p>A company\u2019s reputation\u2014how clients, investors, employees, suppliers, and partners perceive it\u2014is its most valuable intangible asset. Gideon Spanier, Global Head of Media at Campaign, has said in <a href=\"https:\/\/raconteur.uberflip.com\/i\/501672-brand-and-reputation\/5?m4=\" rel=\"noopener\">his Raconteur piece<\/a> that it is built on three things: what you say, what you do, and what others say about you when you\u2019re not in the room. Because of the highly digitized and networked world we live in, the walls of this room have become imaginary, with everyone now hearing what you have to say and seeing what you\u2019re doing.<\/p>\n<p>Looking up organizations and brands online has become part of a consumer\u2019s decision-making process, so having a strong and positive online presence is more important than ever. But to see that only <a href=\"https:\/\/statuslabs.com\/reputation-management-stats-2018\/\" rel=\"noopener\">15% of executives<\/a> are addressing the need to manage their business\u2019s reputation risks is not just a sign of negligence on the part of those who chose not to do anything, it\u2019s also a sign of foolishness.<\/p>\n<h3>Consumer trust and loyalty evolved its relationship with company reputation<\/h3>\n<p>Brand trust has grown up. Before, we relied on word of mouth\u2014commendations and condemnations alike\u2014from friends and family, the positivity or the negativity of our own and others\u2019 experiences about a product or service, and endorsements from someone we look up to (like celebrities and athletes). Nowadays, many of us <a href=\"https:\/\/www.inc.com\/craig-bloem\/84-percent-of-people-trust-online-reviews-as-much-.html\" rel=\"noopener\">tend to believe what strangers say<\/a> about a brand, product, or service; read the news about what is going on with institutions; and follow social media chatter about them.<\/p>\n<p>The relationship between consumer trust and brand reputation has changed as well. While mainstream names are still favored over new or unfamiliar brands (even if they offer a similar product or service at a cheaper cost), connected consumers have learned the value of their data. Not only do they want their needs met, but they also expect companies to take care of them\u2014by extension, the information they choose to give away\u2014so they can feel safe and happy.<\/p>\n<p>Of course, with trust comes loyalty. Weber Shandwick, a global PR firm, has reminded business leaders in their report, <em><a href=\"https:\/\/www.webershandwick.com\/uploads\/news\/files\/InRepWeTrust_ExecutiveSummary.pdf\" rel=\"noopener\">The Company behind the Brand: In Reputation We Trust<\/a> <\/em>[PDF], has found that consumers in the UK tend to associate themselves with a product, and if the company producing that product falls short of what is expected of them, they tend to bail in search for a better one, which is usually offered by a competitor brand. It\u2019s not hard to imagine this same reaction from consumers in the United States but in the context of stolen customer data due to a company-wide data breach.<\/p>\n<h3>Business reputation management in action<\/h3>\n<p>The possibility of finding their business in the crosshairs of threat actors is no longer an assumption, but something executives should always be prepared for. The good news is that it\u2019s not impossible to protect your business reputation from risks.<\/p>\n<p>In this section, we outline what businesses can do in three phases\u2014before, during, and after an attack\u2014by illustration based on a real-world scenario to give organizations an idea on how they can formulate a game plan to manage their reputation either now or in the future. Note that we have aligned our pointers in the context of cybersecurity and privacy incidents.<\/p>\n<p><span style=\"text-decoration: underline\"><em>Before an attack: Be prepared for a breach<\/em><\/span><\/p>\n<ul>\n<li>Identify and secure your company\u2019s most sensitive data. This includes intellectual property (IP) and your customers\u2019 <a href=\"https:\/\/blog.malwarebytes.com\/glossary\/pii\/\" rel=\"noopener\">personally identifiable information (PII)<\/a>.<\/li>\n<li>Backup your data. We have <a href=\"https:\/\/blog.malwarebytes.com\/101\/2017\/04\/3-2-1-go-make-backups-of-your-data\/\" rel=\"noopener\">a practical guide<\/a> for that.<\/li>\n<li>Patch everything. It may take a while, and it may cause some disruption, but it\u2019ll be worth it.<\/li>\n<li>Educate employees on basic data security measures, <a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/social-engineering-cybercrime\/2018\/08\/social-engineering-attacks-what-makes-you-susceptible\/\" rel=\"noopener\">social engineering tactics<\/a>, and how to identify red flags of a potential breach.<\/li>\n<li>Put together a team of incident responders. That is\u2014if the company has decided to handle incidents in-house. If this is the case:\n<ul>\n<li>Provide them the tools they will need for the job<\/li>\n<li>Train them on how to use these tools and on established processes of proper evidence collection and storage.<\/li>\n<\/ul>\n<\/li>\n<li>Create a data breach response plan. This is a set of actions an organization takes to quickly and effectively address a security or privacy incident when it comes. Sadly, according to <a href=\"https:\/\/www.pwc.com\/gx\/en\/services\/advisory\/forensics\/economic-crime-survey.html\" rel=\"noopener\">PwC\u2019s 2018 Global Economic Crime and Fraud Survey<\/a>, only 30% of companies have this plan in place. Once created, make sure that all internal stakeholders\u2014your employees, executives, business units, investors, and B2B contacts\u2014are informed about this plan, so they know what to do and what to expect.<\/li>\n<li>Learn the <a href=\"http:\/\/www.ncsl.org\/research\/telecommunications-and-information-technology\/security-breach-notification-laws.aspx\" rel=\"noopener\">security breach notification laws<\/a> in the state your business is based in. Make sure that your company complies with the legislation.<\/li>\n<li>Establish an alert and follow-through process. This includes maintaining a communication channel that is accessible 24&#215;7. In the event of an attack, internal stakeholders must be informed first.<\/li>\n<li>On a similar note, create a notification process. Involve relevant key departments, such as Marketing and Legal, in coming up with what to say to customers (if the breach involves PII theft), regulators, and law enforcement and how to best notify them.<\/li>\n<li>Depending on the nature of your company and the potential assets that may be affected by a breach, prepare a list of possible special services your company can offer to clients that may be affected. For example, if your company stores credit card information, you can provide identity protection to clients with a contact number they can call to avail of the service. <a href=\"https:\/\/www.csoonline.com\/article\/2604320\/what-you-need-to-know-about-the-home-depot-data-breach.html\" rel=\"noopener\">This was what Home Depot did<\/a> when it got breached in 2014.<\/li>\n<\/ul>\n<hr \/>\n<p style=\"text-align: center\"><em>Read: <a href=\"https:\/\/blog.malwarebytes.com\/101\/2019\/02\/how-to-browse-the-internet-safely-at-work\/\" rel=\"noopener\">How to browse the Internet safely at work<\/a><\/em><\/p>\n<hr \/>\n<p><span style=\"text-decoration: underline\"><em>During an attack: Be strategic<\/em><\/span><\/p>\n<ul>\n<li>Keep internal stakeholders updated on developments and steps your company has taken to mitigate and remedy the severity of the situation. Keep phone lines open, but it would be more efficient to send periodic email updates. Create a timeline of events as you go along.<\/li>\n<li>Identify and document the following information and evidence as much as you can, as these are needed when the time comes to notify clients and the public about the breach:\n<ul>\n<li>Compromised systems, assets, and networks<\/li>\n<li>Patient zero, or how the breach happened<\/li>\n<li>Information in affected machines that have been disclosed, taken, deleted, or corrupted.<\/li>\n<\/ul>\n<\/li>\n<li>If your company has a blog or a page where you can post company news, draft up an account of the events from start to finish and what you continue to plan on doing in the next few weeks following the breach. Be transparent and effective. This is a good opportunity to show clients that the company is not just talking the talk but also walking the walk. The Chief Marketing Officer (CMO) should take the lead on this.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline\"><em>After an attack: Be excellent to your stakeholders<\/em><\/span><\/p>\n<ul>\n<li>Notify your clients and other entities that may have been affected by the breach.\n<ul>\n<li>Put out the company news or blog post the company has drafted about the cybersecurity incident.<\/li>\n<li>Send out breach notifications via email, linking back to the blog, and social media.<\/li>\n<\/ul>\n<\/li>\n<li>Prepare to receive questions from clients and anyone who is interested in learning more about what happened. Expect to have uncomfortable conversations.<\/li>\n<li>Offer additional services to your clients, which you have already thought out and prepared for in the first phase of this BRM exercise.<\/li>\n<li>Continue accepting and addressing concerns and questions from clients at extended periods for a certain length of time.<\/li>\n<li>Implement new processes and use new products based on post-incident discussions to further minimize future breaches from happening.<\/li>\n<li>Rejuvenate stakeholder\u2019s confidence and trust by focusing on breach preparedness, containment, and mitigation strategies as proof of the company\u2019s commitment to its clients. This can turn the stigma of data breaches on its head. Remember that a breach can happen to any company from any industry. How the company acted before, during, and after the incident is what will be remembered. So use that to your advantage.<\/li>\n<li>Audit the information your company collects and stores to see if you have data that is not necessarily needed to fulfill your product and service obligations to clients. The logic behind is the less data you keep about customers; the fewer data are at risk. Make sure that all your stakeholders, especially your customers, should know about what data you will not be collecting and storing anymore.Following a breach in December 2015, <a href=\"https:\/\/www.wired.co.uk\/article\/wetherspoons-email-database-gdpr\" rel=\"noopener\">Wetherspoon deleted its entire database of customer email addresses<\/a>, which is their way of minimizing the amount of data they store about their clients.<\/li>\n<li>Recognize the hard work of your employees and reward them for it. Yes, they&#8217;re your stakeholders, too, and shouldn&#8217;t be forgotten especially after the event of a cybersecurity incident.<\/li>\n<\/ul>\n<h3>Business reputation management should be the new black<\/h3>\n<p>Indeed, businesses remains a favorite target of today\u2019s threat actors and nation states. It\u2019s the new normal, at this point\u2014something that many organizations are still choosing to deny.<\/p>\n<p>Knowing how to manage your business\u2019s reputation is seen as a competitive advantage. Sure, it\u2019s one thing to know <a href=\"https:\/\/blog.malwarebytes.com\/101\/2017\/02\/what-to-do-after-recovering-from-a-cyberattack\/\" rel=\"noopener\">how to cope from a cybersecurity incident<\/a>. But it\u2019s quite another to know <em>what to do<\/em> to keep the brand\u2019s image intact amidst the negative attention and <em>what to say<\/em> to those who have been affected by the attack\u2014your stakeholders\u2014and to the public at large.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/101\/2019\/03\/reputation-management-age-cyberattacks-businesses\/\">Reputation management in the age of cyberattacks against businesses<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/101\/2019\/03\/reputation-management-age-cyberattacks-businesses\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Jovi Umawing| Date: Thu, 14 Mar 2019 16:15:59 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/101\/2019\/03\/reputation-management-age-cyberattacks-businesses\/' title='Reputation management in the age of cyberattacks against businesses'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2019\/03\/shutterstock_466221722.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>A business\u2019s reputation takes years to build. With the current climate of data breaches, unsurprisingly, destroying it could only take seconds. What can businesses do to protect their brands from a fallout following a cybersecurity incident? In this post, we answer these questions and more.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/101\/\" rel=\"category tag\">101<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/101\/business\/\" rel=\"category tag\">Business<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/101\/fyi\/\" rel=\"category tag\">FYI<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/brm\/\" rel=\"tag\">brm<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/business-reputation-management\/\" rel=\"tag\">business reputation management<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/chief-marketing-officer\/\" rel=\"tag\">chief marketing officer<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/cmo\/\" rel=\"tag\">cmo<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/global-economic-crime-and-fraud-survey\/\" rel=\"tag\">global economic crime and fraud survey<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/home-depot\/\" rel=\"tag\">home depot<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/incident-response\/\" rel=\"tag\">Incident Response<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/personally-identifiable-information\/\" rel=\"tag\">personally identifiable information<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/pii\/\" rel=\"tag\">PII<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/privacy\/\" rel=\"tag\">privacy<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/reputation-management\/\" rel=\"tag\">reputation management<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/security-breach-notification-laws\/\" rel=\"tag\">security breach notification laws<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/social-engineering\/\" rel=\"tag\">Social Engineering<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/wetherspoon\/\" rel=\"tag\">Wetherspoon<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/101\/2019\/03\/reputation-management-age-cyberattacks-businesses\/' title='Reputation management in the age of cyberattacks against businesses'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/101\/2019\/03\/reputation-management-age-cyberattacks-businesses\/\">Reputation management in the age of cyberattacks against businesses<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10519,21261,1001,21262,21263,21264,10520,21265,21266,12657,19130,19131,5897,21267,21268,10510,21269],"class_list":["post-14837","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-10519","tag-brm","tag-business","tag-business-reputation-management","tag-chief-marketing-officer","tag-cmo","tag-fyi","tag-global-economic-crime-and-fraud-survey","tag-home-depot","tag-incident-response","tag-personally-identifiable-information","tag-pii","tag-privacy","tag-reputation-management","tag-security-breach-notification-laws","tag-social-engineering","tag-wetherspoon"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/14837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=14837"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/14837\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=14837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=14837"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=14837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}