Data Breaches | News

ID Experts Develop Methodology for Data Breach Response

• By Dian Schaffhauser
• 09/19/12

A company that specializes in helping organizations deal with the fallout from a data breach has developed a methodology for dealing with a security incident. ID Experts' YourResponse provides processes and tools for analyzing and responding to a data breach incident that will result in, as the firm said in a statement, "the most positive outcomes."

The methodology guides the affected organization through four phases in order to determine whether notification is required:

• Discovery, encompassing digital forensics; root cause discovery, and chain of evidence preservation;
• Analysis, to perform incident assessment; risk score, and regulatory obligations;
• Formulation of response, to assess demographics and the special needs of affected individuals in developing a response program to address needs and risks; and
• Response, a program that maps out notification to individuals, regulatory authorities, and the media, develops advisories for incoming phone and web inquiries, identifies identity protection services, and manages identity recovery for victims.

"Too often companies try to handle data breaches themselves, which is just like a patient performing their own appendectomy," said Bob Gregg, CEO of ID Experts. "We created the YourResponse method in order to make data breach response more science than art. By using it, we have the highest customer satisfaction of any data breach solutions vendor."

"ID Experts was the cornerstone for our response. Their expertise and leadership helped us navigate the crisis and respond in a timely, organized, and thoughtful manner to our students, faculty, staff, and community," said Carl Powell, CIO of Eastern Michigan University. The university has suffered through two data breaches in recent years. In 2010 the institution reported that a server containing passwords and PINs for students and staff had been hacked. In 2011 two student employees were accused of misusing personal information from the records of other students housed in the offices where they worked.