Evernote data breach: lessons to be learned

A month on, Davey Winder analyses what others can learn from the Evernote data breach...

Brand damage mitigation, post-breach best practice

Yvonne Eskenzi is director of Eskenzi PR, an agency which specialises in IT security, and unsurprisingly has some thoughts of her own on how Evernote handled things on this occasion

"Did Evernote get it right? If you have a look at all the negative press it's clear Evernote got it very badly wrong and this is going to follow them around like a nasty smell for a very long time as more and more people write about it negatively.

Evernote could have so easily avoided this mess if they followed a few basic rules: Preparation we would advise every business to plan for an incident. It's a bit like preparing for a play. Most of the work is done before the performance so when the actors get on stage they are polished, professional and well rehearsed.

Communication [needs to be carried out] clearly, simply and quickly. You can only do this if you have rehearsed and prepared in advance. The Evernote email was clumsy, inaccurate and difficult to understand. Short, clear and simple should do the trick. Be as honest as you can, your customers will always appreciate an honest truthful explanation.

Advertisement
Advertisement - Article continues below

Use every communication method open to you to jump on the rumours before it spirals out of control. If you provide the content people will use it, if you don't people will make it up.

Unfortunately, with social media, speed is of the essence, but that should be no excuse for a badly written inaccurate email such as Evernotes.

Knowledge is king so gain as much knowledge as you can around the incident and get your facts right, combine this with a smack of honesty and you should be fine. If you keep your audience in the loop and keep them briefed you'll win them over.

You also need to decide who is going to be your spokesperson, in the Evernote email, written by the Evernote team, you couldn't get more impersonal that a general sign-off, someone needs to be accountable and you must have a point of contact. You need to decide long before a breach or incident who has the knowledge and personality to stand up in front of an audience and take the flack and handle it!

Make sure they are media trained. This could be the chance for the CISO to shine as they are the ones with the knowledge.

Organisations need to realise that breaches are becoming more and more of an unfortunate part of our lives and it's not necessarily if, but when it's going to happen to you.

Preparation and communication will stand you in good stead, so that when it happens you're not the company caught with egg on your face"

Featured Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now
Advertisement

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
Visit/strategy/28115/the-pros-and-cons-of-net-neutrality
Business strategy

The pros and cons of net neutrality

4 Nov 2019
Visit/domain-name-system-dns/34842/microsoft-embraces-dns-over-https-to-secure-the-web
Domain Name System (DNS)

Microsoft embraces DNS over HTTPS to secure the web

19 Nov 2019
Visit/social-media/34844/can-wikipedia-founders-social-network-really-challenge-facebook
social media

Can Wikipedia founder's social network really challenge Facebook?

19 Nov 2019