The brand battle CMOs must fight in the face of data breaches and cybersecurity attacks

Fresh cyber attacks and data breaches across Volkswagen, Audi, McDonalds and Electronic Arts highlight the growing cybersecurity and data threat. So what can marketing leaders do about preventing and reacting to these crises?


How marketers can help cope with a data breach

With every business facing the very real scenario of being breached, it’s clear brand leaders should be actively involved in a game plan for dealing with the fallout. The obvious area of focus for marketers is communications and customer management.  

As of 2018, Australia’s Notifiable Data Breaches (NDB) scheme requires an organisation with greater than $3 million in turnover that experiences a data breach likely to result in serious harm to any individuals whose personal information is involved, to notify the Office of the Australian Information Commissioner and any affected individuals. However, wording admittedly provides some wriggle room, particularly regarding what constitutes ‘serious harm’ and ‘likely to result’.

Outside of legal requirements, if a breach occurs, it’s imperative brands be open and honest about what happened and what next steps the business is taking to remedy the situation, Bassett said. “This will make the difference in the impact on consumer confidence,” he said.

Ram also highlighted the need to be transparent with breach notifications, alerting customers and relevant authorities quickly. “The best policy is transparency,” Knudsen agreed.

“Nobody likes being lied to, or even not getting the whole truth. When breaches or other bad things happen, customers will appreciate a prompt, honest communication about what happened and what the organisation is doing about it. Having a solid incident response plan can help with this.” 

One important learning from Check Point Incident Response team Ram pointed to is that most organisations don’t have a platform to enable efficient cross-company communication and collaboration between key stakeholders. Often, this means legal, PR teams and executives don’t have a platform to effectively communicate with the rest of the incident response team.  

“Most organisations also don’t do table-top exercises under the new normal conditions. It’s vital you test your incident response with scenarios where key stakeholders are unable to get into the same room and are forced to work remotely,” Ram said.  

Englert stressed the criticality of a unified communications approach internally and externally. “The key here is that there is unity in communications and activities —both predatory and response— across the organisation,” he said.  

“This is actually a place where marketing, rather than legal or IT, can help lead the organisation’s response and strengthen both its pre-breach and post-breach cybersecurity posture.”  

If you don’t get the internal and external communications right, “the whole thing can fall apart and you can be left with lumpy notifications based on really narrow agendas”, Englert warned.  

“One company we dealt with inadvertently set off a comms disaster by letting the sales team essentially do enterprise customer notification,” he recalled. “The result was that they triggered SLAs in some of their customers that mandated immediate public notification. Unfortunately, no one was ready for this and the comms that went out were based on incomplete forensic findings and an overall immature, unsophisticated understanding of what was acceptable in tech and wider business media.  

“Every piece of comms, including managing your customer service desk with an integrated plan and strict oversight, is important.”  

Whole-of-company collaboration  

Despite this, as Englert’s failed response example makes apparent, security breaches such as those suffered by McDonalds, Electronic Arts and Volkswagen are whole-of-organisation issues. For Knudsen, infusing every part of an organisation with security can only happen with commitment from the highest levels of management. He again saw this as an opportunity for marketing chiefs to lead.  

“A CMO, for example, can minimise the risk of future marketing-related software security incidents by mandating that security is part of every aspect of the organisation,” Knudsen said. “When security is accepted in the day-to-day work of everyone in the organisation, overall risk is reduced.”   

With security integral to every aspect of the business – including marketing – CMOs should also be ensuring security is part of planning any marketing project, from concept through execution, Knudsen said. “Whenever you collect customer data, or whenever you perform analyses, you must consider not only what you’re trying to accomplish but also the security ramifications,” he continued.  

“Where are you storing the data? Who has access? How can you make it more secure? In the end, risk can be lowered but never eliminated. Even if you do everything right, bad things might still happen. Consequently, having a good incident response plan in place is important.”   

Mimecast marketing director A/NZ, Daniel McDermott, recommended ensuring digital brand protection is part of your risk management framework and start partnering with your CISO today on mitigation strategies. 

“For too long ‘cyber’ has been off to the side and seen as the CISO or CIO’s problem. The CMO, as the ultimate brand custodian, has to step up and play an active role,” he said. “This means the CMO, CISO, communications and legal teams need to work in lockstep to ensure they’re all aware of each other’s roles in any incident, have trust in each other and open lines of communication across teams to ensure maximum protection and – when a breach does occur – minimise customer impact as well as brand damage and reputational fallout.”

Knudsen emphasised marketing teams, like other parts of an organisation, also use software to interact with customers, gather important data, store customer information and analyses, and perform every other part of marketing.   

“While powerful tools are readily available, security needs to be part of how marketing groups select, configure and use software,” he said. “One small example is sharing information with the rest of the marketing team. When you share a file, you want to make sure that co-workers can access the file and use its information. But security is just as important. Can you limit access to specific people? Would it be hard for an attacker to get the file?”    

Another potential issue Ram spotted was in cyber strategies not taking a holistic enough view that includes ensuring third parties accessing and processing customer data have the same level of security or higher than the data owner organisation.  

“It is essential organisations understand who is accessing their crown jewels and deploy appropriate security controls to ensure security best practice such as the principle of least privilege, where user and systems are given the minimum levels of access – or permissions – needed to perform these tasks,” Ram said. “A zero-trust approach to accessing and processing of data is vital to ensure organisations aren’t the low hanging fruit for cyber criminals.”  

Keeping perspective  

Yet even as we all work to build adequate plans to prepare for an attack from cyber security criminals, Englert said CMOs should keep some perspective on the fallout on customer and brand reputation. Sound brand fundamentals are vital here.  

“If you have a lot of good faith in the marketplace, you should be fine as long as you ensure your communications planning is firmly in place and integrated into your culture for what I would consider the inevitable, a breach or privacy data issue,” he said. “Never lie. More importantly, have complete organisational buy-in, from the board on down, to never lie, to disclose and to take a deep breath and respond evenly when that bad cyber day arrives. 

In some ways, there is a tendency to over-react on the part of the organisation and think customers will simply abandon you if you have a breach. This is not true. If you handle communications well, are transparent and put yourself in your customers and stakeholders’ shoes, you will usually find most people are actually incredibly understanding and not nearly so precious about their data.    

“This might sound sacrilegious with the rise of privacy regulations across every jurisdiction. But people generally understand it is really hard to defend 100 per cent against a breach and they can put their own personal data into perspective.”    

One example of this for Englert was a breach his team handled where over 200,000 records were affected. Fewer than 10 customer complaints were received.  

“The main things was customers knew we were being honest and looking after their best interests in a tough situation,” he said. “In that case, the NPS score actually improved only a month after the breach.    

It’s like the organisation is a human. When the chips are down, you get insights into the person’s true colours — the same applies here.”  

Don’t miss out on the wealth of insight and content provided by CMO A/NZ and sign up to our weekly CMO Digest newsletters and information services here. 

You can also follow CMO on Twitter: @CMOAustralia, take part in the CMO conversation on LinkedIn: CMO ANZ, follow our regular updates via CMO Australia's Linkedin company page

 

 

 

 

 

 

 

 

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

More Videos

More Brand Posts

What are Chris Riddell's qualifications to talk about technology? What are the awards that Chris Riddell has won? I cannot seem to find ...

Tareq

Digital disruption isn’t disruption anymore: Why it’s time to refocus your business

Read more

Enterprisetalk

Mark

CMO's top 10 martech stories for the week - 9 June

Read more

Great e-commerce article!

Vadim Frost

CMO’s State of CX Leadership 2022 report finds the CX striving to align to business outcomes

Read more

Are you searching something related to Lottery and Lottery App then Agnito Technologies can be a help for you Agnito comes out as a true ...

jackson13

The Lottery Office CEO details journey into next-gen cross-channel campaign orchestration

Read more

Thorough testing and quality assurance are required for a bug-free Lottery Platform. I'm looking forward to dependability.

Ella Hall

The Lottery Office CEO details journey into next-gen cross-channel campaign orchestration

Read more

Blog Posts

Marketing prowess versus the enigma of the metaverse

Flash back to the classic film, Willy Wonka and the Chocolate Factory. Television-obsessed Mike insists on becoming the first person to be ‘sent by Wonkavision’, dematerialising on one end, pixel by pixel, and materialising in another space. His cinematic dreams are realised thanks to rash decisions as he is shrunken down to fit the digital universe, followed by a trip to the taffy puller to return to normal size.

Liz Miller

VP, Constellation Research

Why Excellent Leadership Begins with Vertical Growth

Why is it there is no shortage of leadership development materials, yet outstanding leadership is so rare? Despite having access to so many leadership principles, tools, systems and processes, why is it so hard to develop and improve as a leader?

Michael Bunting

Author, leadership expert

More than money talks in sports sponsorship

As a nation united by sport, brands are beginning to learn money alone won’t talk without aligned values and action. If recent events with major leagues and their players have shown us anything, it’s the next generation of athletes are standing by what they believe in – and they won’t let their values be superseded by money.

Simone Waugh

Managing Director, Publicis Queensland

Sign in