When cybersecurity breaches come to light, there’s an understandable focus on the financial impact. The subsequent FAQs often include: How much will it cost to get systems back online and repair the damage? What is this costing on a global level? And more recently, how much cryptocurrency was stolen?

Indeed, for organizational leaders dealing with the aftermath of a breach, cost implications are front and center. But what else is at stake when a cyberattack hits the headlines? One of the most serious issues is the impact on brand reputation among key stakeholders – and ironically – across the cybercrime ecosystem responsible for selecting targets to attack.

Take T-Mobile, for example, which recently agreed to pay a $500 million settlement for a cyberattack it suffered in 2021 – reportedly the fifth time the company had been hacked in just four years. According to analysis in Cybersecurity Dive, T-Mobile is known for having poor security, with Allie Mellen, a senior analyst at Forrester telling the site that “attackers take advantage of that. They are an easier target because of it.”

She went on to say: “Ultimately it’s going to take them even longer to really build up their defensive strategies because of all these continued breaches, and they’re also a much bigger target because of it.”

Ultimately, for any organization that finds itself hitting the headlines after a breach – or even worse – mentioned on one of the many lists that detail the biggest data breaches, the result is the same: serious, long-term reputational damage.

 

Proactive brand protection

So, what’s the alternative? At Glasswall, we are very focused on the importance of proactive cybersecurity protection. Our CDR (Content Disarm and Reconstruction) technology delivers zero-trust file protection, keeping organizations secure from file-based threats that can result in serious breaches and subsequent reputational damage.

In contrast, detection-based security, such as antivirus and sandboxing solutions must play catch up with new threats, whereas Glasswall instantly cleans and rebuilds every file to match its ‘known good’ industry specification.

Proactive protection also extends to having plans and processes in place to address the reputational impact of a cyberattack. Where many organizations go wrong is they have no communications strategy ready to activate should a breach be discovered. They have to respond to almost everything on the fly, working out what to say, who to communicate with, how regularly to update people and even what tone to adopt.

This is a recipe for reputational disaster, resulting in anything from unhappy customers and lost business to falling shareholder value as organizations frantically try to bring a chaotic situation under control. At the most extreme end of the scale, the risk can be existential with brands finding their reputation shredded – not just by the attack itself, but by their inadequate response.

Instead, leadership teams should be following tried and tested crisis management principles by having a proactive communication strategy ready to roll if they are attacked. Key components of these plans should cover:

• Crisis team members, roles, responsibilities, hierarchy and lines of reporting
• Internal communication and management processes to ensure effective and timely decision-making and information sharing
• Governance and compliance reporting requirements
• Key messages to deliver clarity of information, purpose and steps toward resolution for each external stakeholder group
• Plans for proactive media outreach to ensure key messages are more widely shared
• Timetable for providing updates as the situation develops
• The allocation of resources (human and financial) to ensure each element of the strategy can be fully delivered

With these and other considerations in place, organizations are more strongly positioned to deliver an effective and authentic response to a cybersecurity crisis. Done well, this can go further than just protect a brand and its hard-won reputation – it can even enhance it.