4-Step Plan to Deal With a Security Breach

Working online can often feel like a double-edged sword. You have access to many great tools and a potentially huge audience, but you also face numerous security risks. Hacking attempts are on the rise year after year, and sometimes serious breaches can happen – no matter what security measures you put in place.

Although it's easy to panic in those situations, there are ways to bring your website back after an attack. Putting an effective strategy in place beforehand will ensure that you’re ready to deal with the fallout swiftly, so you can keep high levels of traffic and conversions rolling in.

In this post, we’ll explain why properly protecting your site is so essential. We’ll then explore the steps you’ll need to take in the event of a security breach. Let’s get to it!

The Unavoidable Risks of Doing Business Online

The web can be a dangerous place for website owners. Studies suggest that a hacking attempt is made every 39 seconds, and over 64% of companies say they have experienced a web-based attack. Put simply, breaches are incredibly common.

Although the actual impact will depend on the kind of attack, it’s safe to assume that it will always be negative. For starters, you’re likely to lose out on a lot of money. It’s thought that by 2020, the average cost of a data breach will exceed $150 million.

Figures like that are especially worrying when you consider the fact that 43% of hackers target small businesses. A tight budget will make coming back from an attack even more difficult. Monetary issues aside, a security breach could also result in a loss of important information.

That includes your own personal data. In fact, you could even lose access to your site. Your customers' information is also at risk. If you take payments on your site, a security breach could mean that credit card details and similar data end up compromised or even published. It goes without saying that this is likely to leave consumers feeling uneasy about visiting or buying from your site in the future.

4-Step Plan to Deal With a Security Breach

Of course, it’s much better to avoid security breaches whenever possible. Unfortunately, despite your best efforts, attacks can still sometimes happen.

You’ll need to be fully prepared in the event that a hacking or malware event damages your site, so you know how to react immediately. The following four steps will help you do just that.

Step 1: Attempt to Contain the Breach

The first step is to try and contain the breach as much as possible. It’s likely that an attack will hit one area of your site first, and then go further. By acting quickly, you can potentially limit its reach.

The way you’ll do that will depend on the nature of the breach, and the parts of your site that have been affected. However, here are a few key things to do in most situations:

Reset all passwords
Disable network access for affected computers
Recall or delete false information

Shutting down or separating individual sections of your site (or departments of your business, if you run a larger organization) should also help. Following this step should effectively contain the breach, so you can deal with it in isolation.

Step 2: Assess the Level of Damage

This step will help you ensure that your website can resume business as usual. To do that, you’ll need to investigate the attack, and assess any damage it has caused. Knowing how it all started could prevent it happening again in the future as well (more on that later).

Start by investigating the affected areas of your site. This will help you establish whether there’s any malware left behind, or if there are any remaining cracks in your security system. During your investigation, keep the following questions in mind:

Was the attack a result of human error, or something more serious?
Was the attack targeted at a particular area of your site, or did it aim to take down the entire thing?
How sensitive is the breached data?
Can any lost data be restored?

You’ll also need to consider how the attack will affect other people. If you store a lot of payment information or other sensitive data, you’re going to have to implement some damage control in the next step.

Step 3: Notify Those Who Are Affected

This is probably the least fun step, but also the most important. A serious security breach could negatively impact a lot of people, not just you and your business.

This is especially true if you let visitors make purchases on your site. Hackers could use sensitive payment and personal information to steal money from your customers, or set up fake accounts. Even if you manage to keep that from happening, you’ll still need to let customers know about the damage.

It's absolutely essential that you don’t try and hide what's happened. The truth will come out eventually, and you’ll be in a much worse situation than you already were. Instead, just try to be as honest as possible with your visitors. Explain what happened, and the steps you’ve taken to fix it and prevent a recurrence.

For small businesses, a series of emails or social media posts should be enough. However, large-scale organizations may need to take a more public approach – such as holding a press conference.. Regardless of your chosen method, make sure the focus of your statement is the solution. For more guidance on this step, it's worth checking out the GDPR guidelines on what to do (and what not to do) in this situation.

Step 4: Perform a Security Audit

This final step isn’t technically a requirement, but it comes highly recommended. Once the breach has been dealt with, you'll want to audit all of your existing security measures, and identify any areas that can be improved to prevent future attacks from succeeding.

For example, you can consider whether you're using a reliable host. A high-quality hosting provider will offer the most secure service, and will usually throw in some relevant additional features as a part of your plan. For example, here at Hosting.com we provide free Secure Sockets Layer (SSL) certificates, regular site backups, and 24/7 user support.

Even though your host will have your back, it’s important to take some security measures into your own hands. A strong password is always a smart place to start, and updating that password regularly is also essential. The same applies to anyone else who uses your site.

Conclusion

A major security breach can have a significant negative impact on your site. Users may lose their trust in your business, and you could face a reduction in traffic and revenue.

Fortunately, it is possible to resume business as usual after an attack – once you know where to start. In the event of a security breach, you'll want to: