Evernote data breach: lessons to be learned

A month on, Davey Winder analyses what others can learn from the Evernote data breach...

Brand damage mitigation, post-breach best practice

Yvonne Eskenzi is director of Eskenzi PR, an agency which specialises in IT security, and unsurprisingly has some thoughts of her own on how Evernote handled things on this occasion

"Did Evernote get it right? If you have a look at all the negative press it's clear Evernote got it very badly wrong and this is going to follow them around like a nasty smell for a very long time as more and more people write about it negatively.

Evernote could have so easily avoided this mess if they followed a few basic rules: Preparation we would advise every business to plan for an incident. It's a bit like preparing for a play. Most of the work is done before the performance so when the actors get on stage they are polished, professional and well rehearsed.

Communication [needs to be carried out] clearly, simply and quickly. You can only do this if you have rehearsed and prepared in advance. The Evernote email was clumsy, inaccurate and difficult to understand. Short, clear and simple should do the trick. Be as honest as you can, your customers will always appreciate an honest truthful explanation.

Use every communication method open to you to jump on the rumours before it spirals out of control. If you provide the content people will use it, if you don't people will make it up.

Unfortunately, with social media, speed is of the essence, but that should be no excuse for a badly written inaccurate email such as Evernotes.

Knowledge is king so gain as much knowledge as you can around the incident and get your facts right, combine this with a smack of honesty and you should be fine. If you keep your audience in the loop and keep them briefed you'll win them over.

You also need to decide who is going to be your spokesperson, in the Evernote email, written by the Evernote team, you couldn't get more impersonal that a general sign-off, someone needs to be accountable and you must have a point of contact. You need to decide long before a breach or incident who has the knowledge and personality to stand up in front of an audience and take the flack and handle it!

Make sure they are media trained. This could be the chance for the CISO to shine as they are the ones with the knowledge.

Organisations need to realise that breaches are becoming more and more of an unfortunate part of our lives and it's not necessarily if, but when it's going to happen to you.

Preparation and communication will stand you in good stead, so that when it happens you're not the company caught with egg on your face"

Featured Resources

Five lessons learned from the pivot to a distributed workforce

Delivering continuity and scale with a remote work strategy

Download now

Connected experiences in a digital transformation

Enable businesses to meet the demands of the future

Download now

Simplify to secure

Reduce complexity by integrating your security ecosystem

Download now

Enhance the safety and security of your people, assets and operations

Enable a true vision of security with an engineered solution based on hyperconverged and storage platforms

Download now

Most Popular

Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020
Accenture ploughs $3 billion into cloud migration support group
digital transformation

Accenture ploughs $3 billion into cloud migration support group

17 Sep 2020
16 ways to speed up your laptop

16 ways to speed up your laptop

16 Sep 2020