Preventing incidents like the AT&T data breach

‍

AT&T recently announced a data breach affecting 110 million customers. The breach was disclosed in July but was actually uncovered in April when AT&T’s cloud provider, Snowflake, let them know their own systems had been compromised.

‍

We’re still learning the full extent of the stolen data – much of it appears to be metadata rather than message contents – as companies quietly ask themselves: could something like AT&T’s data breach happen at my company?

‍

Unfortunately, the answer is yes. Technology companies face a myriad of risks from cybersecurity to product liability and more that aren’t going away. There are, however, two critical ways tech companies can avoid and mitigate the effects of a data breach.

‍

Adhering to SOC 2 compliance controls

‍

Any organization that manages personally identifiable information (PII) is a candidate for a Services Organization Control 2 (SOC 2) Type I audit, which assesses an organization’s data security controls and ensures they meet all specified controls before granting a certification. SOC 2 Type II certification doubles down on Type I by measuring the effectiveness of controls in place, a process that inherently takes more time.

‍

SOC 2 Type I controls include the use of tools like multi-factor authentication, a practice which may not have been followed by a party of AT&T’s data breach. That organization was ultimately not fully SOC 2 compliant, a risk that could’ve been flagged long before this incident.

‍

Achieving SOC 2 Type I certification not only reduces the likelihood of adverse incidents like data breaches, it also signals to potential customers that they can safely rely on your services without worrying about their own customers.  

‍

Leaning on cyber liability insurance

‍

Businesses don’t only need preventative measures like compliance controls; they also need curative ones. Any company that handles customer data should consider insurance coverage like cyber liability, which typically covers damages stemming from cyber attacks and data breaches. Crucially, cyber attacks and the like are not covered by better-known policy types like General Liability or Errors & Omissions (E&O). Companies with cyber liability coverage effectively pass the costs of risks like litigation on to their insurers so that they can continue operating unaffected.

‍

Risk management’s consolidated future

‍

There will invariably be another large-scale data breach like what recently happened at AT&T. Companies can’t control whether they’ll be targeted; they can only put the best possible customer assurance plan in place: comprehensive business insurance combined with compliance and security automation that both decreases the likelihood of a cyber attack and safeguards their business from long-term financial damage.

‍

Koop’s customer assurance platform helps tech companies seamlessly navigate the complexities of business insurance, regulatory compliance, and security automation in one place.

‍

We provide a comprehensive suite of insurance coverage that includes General Liability, Technology Errors & Omissions, Cyber Liability, and Management Liability coupled with the most cost-effective SOC 2 compliance certification on the market.

‍

‍‍Ready to learn more? Visit our website at https://www.koop.ai or drop us a note at hello@koop.ai.