Common Causes of Data Leaks and Breaches

Cyber-crime-written-in-a-green-background

What should you watch out for when it comes to preventing data-related crises?

Cybercrime against organizations around the world is big business, and can cost big money for those impacted. Beyond the immediate financial damage, having to announce you’ve exposed valuable data shakes trust in your organization and can lead to long-term damage if you’re not careful. In a helpful infographic, UK tech experts Core explain the six most common external threats and data leaks that result in data being breached today, which are:

  1. Weak Credentials – aka simple and reused passwords.
  2. Stolen/Lost Devices – particularly misplaced laptops and mobile phones.
  3. Unsecure Access – often logging in from personal devices.
  4. Outdated Antivirus – simply not updating often enough to stay ahead of hackers.
  5. Ransomware/Phishing – being duped into allowing malware onto a device.
  6. Leaked Data – a direct leak, whether accidental or on purpose.


[Click to enlarge]

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm, and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Jonathan | Connect with Erik

The Psychology Behind Social Media Addiction

Social-media-addiction-on-a-blue-background

How does social media’s effect on the human brain impact crisis management?

When discussing social media outrage we often refer to the quick “hit” users get from posting anything that draws attention online. Well, it turns out that for many humans a “hit” of social media action releases an awful lot of the reward chemical dopamine into their brains (yes, the same dopamine which is released in heavy doses by many forms of drug use), which leads to a pattern of repeating a potentially negative behavior far more often than is healthy. An infographic published by Digital Information World exposed some concerning stats about social media use, including:

  • Tweeting may be harder for people to resist than cigarettes and alcohol.
  • 60% of females described themselves as addicted to social media.
  • 50% of users surveyed said using social networks actually made their lives worse.

Knowing social media users are actively encouraged by their own brain chemistry to have a reason to post helps to frame the patterns of online negativity that often grow wildly out of proportion to the issue at hand in a crisis. Unfortunately the conclusion is not a happy one for those caught in the crosshairs of a social media crisis. If humans feel good when they post, and even better when those posts get attention, then they have plenty of motivation to amplify any minor situation in order to receive more of those dopamine hits.

You can catch the rest of the Digital Information World infographic below.

Why We Like, Comment, and Share On Social Media - Infographic
Infographic courtesy of: Digitalinformationworld.com.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm, and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Jonathan | Connect with Erik

How Do You Stay Calm While Facing Public Outrage?

An-man-outraged-while-going-through-his-phone

These tips could help you survive an outrage outbreak

Though public outrage has always been a driving force in PR crises, I think we’d all agree it’s become a whole new beast over the last few years. Not only is it easier to share negative opinions than ever before, but it’s also more rewarding. Social media users provide immediate Outrage emoticon angry face on iPhonereinforcement to those expressing outrage with a quick hit of likes, shares, and supportive responses that encourages the cycle. Even traditional media is getting in on the game as many major newscasts now make a habit of highlighting particularly outraged posts in reaction to breaking crises.

If you’ve never faced an outraged audience before it’s only a matter of time, but don’t panic! Here are four ways you can stay calm when faced with public outrage:

  1. Have a plan and be prepared. As with any predictable crisis situation, if you know you’ll be the target of public outrage at some point it only makes sense to prepare in advance. Creating a plan and ensuring your people know how to use it will reduce the initial sense of panic.
  2. Quantify and qualify. Is this one vocal person or is it truly a concerning percentage? Are these actually your stakeholders or are they random internet users? Is the damage limited to reputation or are we already seeing a monetary loss? Questions like these will help ensure you have the info you need to prevent stressful surprises.

Want to see the second half of this handy list of ways to stay calm in the face of the all-too-common outrage outbreak? Click here for more.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

How a Crisis Management Plan Improves Employee Morale

A-board-of-crisis-management-team-in-a-company

[Editor’s note: This guest post from Brooke Cade takes an interesting angle, investigating how having strong crisis management planning actually serves to help improve employee morale – yet another benefit of planning in advance! After all, employees with high morale are more productive, more engaged, and better able to assist the organization in the midst of the crisis situation. It just makes sense.]

Nobody wants to think about what happens if the worst-case scenario comes to pass—particularly when it comes to your business. We can all hope and cross our fingers, but, if something does happen, the best-prepared will most likely emerge the least scathed. If you polled your employees today, do you think most of them would trust you to have a plan in place to deal with crises, or would most expect the winds of fate or luck to carry the day if something happened?

Focusing on fostering loyalty within employees will help them have better morale during a crisis than they otherwise would. Great leadership builds that employee loyalty, and showing that the company is ready for crises is one way to build it. People feel safer when they see that their leaders are building a secure and stable company for them to work in even if a crisis hits.

Employee morale during a crisis will be much higher if there’s a good crisis management plan in place so that employees know what to do. Without a good plan, they can feel overwhelmed, not being able to see anything except inevitable failure. But with a good plan, they can think, “Because we have this plan, we know what to do. We’ve practiced this. It’ll be okay.”

Understanding and Practicing the Plan

Employees need to review the plan in advance and see that it protects them. Their loyalty will grow with their sense of security, so bring in whatever help you need to create a well-thought-out plan. Remember, customer loyalty is actually closely tied to employee loyalty. And you’ll need your hard-working, loyal employees during a crisis and after it’s over.

It’s crucial to practice the plan. Even the best plan won’t be effective if no one has practiced it. But if they have, employee morale and confidence will be higher during a crisis. They’ll think, “We’ve rehearsed this scenario, it’s really happening now, so let’s go into this mode and activate such and such process”—which they’ll have available to them because they’ve experienced it in simulations.

Two Key Crisis Activities

So, what can employees actually do during a crisis? Here are two key activities to help your operations continue and your organization to emerge as unscathed as possible on the other side. When employees know about these before a crisis, they’ll feel more prepared to take action during a crisis—and more confident. These activities will give them a focus for their energy, improving their morale by making them feel competent to battle the storm.

Seek Solutions

During a crisis, employees can spend time brainstorming and designing solutions that will satisfy customers and win back their trust. For example, when Cyanide was placed in Tylenol bottles on shelves in 1982, Tylenol recalled 31 million capsules. Then, Tylenol added tamper-resistant packaging to their bottle, which helped the company recover their sales to almost the level from before the crisis. So, employees during the crisis were working on solutions to the crisis while it was happening: they thought up and designed the new packaging and then performed the hard work updating their manufacturing process. Imagine how focused and motivated they must have been to design improvements to their product in that situation!

Public Relations

Another task is managing media and public relations. During a product recall crisis at Mattel in 2007, employees called journalists at 40 media outlets and told them they had sent them all emails, which explained the reasons for the recalls. The emails also invited them to important teleconference calls and interviews. They eventually responded to 300 U.S. media inquiries. Getting important information out to the public can be an enormous job today when the media are so extensive, but it’s vital for large companies. Protecting future sales is a key to survival. And in a mass market, managing your reputation through public relations will give consumers the confidence to buy from you in the future.

It’s important for employees to know the roles and responsibilities they’ll have in a crisis before it hits. They need to practice the systems in a crisis management plan as much as a pilot needs to practice what to do during an engine failure. A great leader will carefully prepare for many types of crises and win employee loyalty and trust by showing that you’ll all make it through safely together.

About the Author: Brooke Cade is a freelance writer who’s committed to helping businesses and sales professionals build stronger connections with their customers. She writes for multiple publications including InMoment. In her spare time, she enjoys learning more about CX, reading, and engaging on Twitter.

How to Create a Crisis: The 10 Biggest Mistakes in Crisis Communications

All organizations are vulnerable to crises. Disasters, lawsuits, accusations of impropriety, sudden changes in ownership or management, and other volatile situations will happen. The threat of serious damage to people, property, reputation is real for virtually any organization, and many individuals as well.

The cheapest way to turn experience into future profits is to learn from others’ mistakes. With that in mind, I hope that the following examples of inappropriate crisis communications policies, culled from real-life situations, will provide a tongue-in-cheek guide to the mistakes you must avoid when your organization is faced with a crisis.

If you want your crisis to quickly spiral out of control you should employ any combination of these wrong-way tactics:

  1. Play Ostrich. What Lance Armstrong did for years. Hope that no one learns about it. Cater to whoever is advising you to say nothing, do nothing. Assume you’ll have time to react when and if necessary, with little or no preparation time. And while you’re playing ostrich, with your head buried firmly in the sand, don’t think about the part that’s still hanging out.
  2. Only Start Work on a Potential Crisis Situation after It’s Public. This is closely related to item 1, of course. Even if you have decided you won’t play ostrich, you can still foster your developing crisis by deciding not to do any advance preparation. Before the situation becomes public, you still have some proactive options available. You could, for example, thrash out and even test some planned key messages, but that would probably mean that you will communicate promptly and credibly when the crisis breaks publicly, and you don’t want to do that, do you? So, to allow your crisis to gain a strong foothold in the public’s mind, make sure you address all issues from a defensive posture — something much easier to do when you don’t plan ahead. Shoot from the hip, and give off the cuff, unrehearsed remarks.
  3. Let Your Reputation Speak for You. That worked out so well for the now-defunct Arthur Andersen, once one of the largest accounting firms in the world – before Enron.

Want to know the rest of The 10 Biggest Mistakes in Crisis Communications? Click here!

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

The 3 Types Of Crisis

A-woman-placing-her-head-on-her-laptop

Crises can be divided into three categories:

1. Creeping Crises – foreshadowed by a series of events that decision makers don’t view as part of a pattern.

2. Slow-Burn Crises – some advance warning, before the situation has caused any actual damage.

3. Sudden Crises – damage has already occurred and will get worse the longer it takes to respond.

It is not uncommon for what seems to be a sudden crisis to have actually, first, been a creeping crisis that was not detected. Appropriate measures, early in the process, can often prevent or, at least, minimize the damage from slow-burn and sudden crises.

Below are some examples from the healthcare industry. From this, readers in other industries should be able to develop comparable lists.

1. Creeping Crises

  • Lack of a rumor-control system, resulting in damaging rumors.
  • Inadequate preparation for partial or complete business interruption.
  • Inadequate steps to protect life and property in the event of emergencies.
  • Inadequate two-way communication with all audiences, internal and external.

2. Slow-Burn Crises

  • Internet activism
  • Most lawsuits.
  • Most discrimination complaints.
  • Company reputation
  • Lack of regulatory compliance – safety, immigration, environment, hiring, permits, etc.
  • Major operational decisions that may distress any important audience, internal or external.
  • Local/state/national governmental actions that negatively impact operations.
  • Official/governmental investigations involving your healthcare organization and/or any of its employees.
  • Labor unrest.
  • Sudden management changes – voluntary or involuntary.
  • Marketing misrepresentation.

3. Sudden Crises

  • Patient death – Your healthcare organization perceived to be liable in some way.
  • Patient condition worsened – Your healthcare organization perceived to be liable in some way.
  • Serious on-site accident.
  • Insane/dangerous behavior by anyone at a location controlled by your healthcare organization.
  • Criminal activity at a company site and/or committed by company employees.
  • Lawsuits with no advance notice or clue whatsoever.
  • Natural disasters.
  • Loss of workplace/business interruption (for any reason).
  • Fires.
  • Perceptions of significant impropriety that damage reputation and/or result in legal liability, e.g., publicized involvement of company employee in a group or activity perceived to be a threat to the U.S. government or society; inappropriate comments by a “loose cannon;” business activities not officially authorized by management.

Typically, reviewing a list like this triggers thoughts of other situations that need to be addressed during the crisis planning process. Know what constitutes a creeping, slow-burn or sudden crisis for your organization and have plans in place to address them!

Looking for more on crisis management, prevention, preparedness and response? Click here to head to our articles section.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

Litigation-Related Crisis Management: Educating the Jury Pool

A-judge-mantle-with-a-weighing-scale

Which of the following statements about a jury, civil or criminal, are true?

  1. Prospective jury members never lie regarding their advance bias about a case.
  2. Jury members are always truly “peers” of the defendant.
  3. Jury members never talk about a case outside of jury deliberations, or read and watch TV about a case when sequestered, once directed not to do so by a judge.

If your answer is “none of the above,” you begin to appreciate the potential value of crisis/issues management for the purpose of educating a jury pool. Now, I am aware, though not an attorney, that members of the bar are not allowed to influence a jury. Ed Novak, a partner at the Phoenix-based law firm, Quarles & Brady Streich Lang, bridges the gap between influencing and educating.

“While it is unethical to attempt to influence prospective jurors, there is nothing unethical or unprofessional about having an accurate picture of your client presented to the media and other audiences,” said Novak.

A jury consultant is typically not called in until there is some high certainty that a case will, in fact, go to trial. By then, if the case in question has been highly visible in the press, it may well be too late to educate a jury pool “contaminated” by the media’s interpretation of events.

Any honest reporter (yes, there are honest reporters who might even acknowledge there are honest attorneys) will admit that he or she brings a natural bias and an institutional editorial perspective to a story. Journalists will do their best, in that context, to report in a “balanced manner,” with the exception of columnists, who are often free to say pretty much what they please and not worry about “balance.” These media representatives are a gateway through which both plaintiff/prosecutor and defendant can communicate not only to the publics thought of most often – business contacts, community VIPs, etc. – but also to potential jury members. It is the responsibility of counsel, with expert assistance as necessary, to direct media relations that can shift the balance of coverage.

“If we say something to the media, we realize we may be talking to future jury members as well, and if we don’t say something, we’re telling those jury members ‘we don’t care enough about you to keep you informed.’ When we get to court, they’ll remember that,” said Novak.

And, he notes, his firm has realized that the same analysis done by crisis management professionals to anticipate multi-audience response to various public relations tactics also helps them anticipate jury response.

“I’ve had a crisis consultant sit in on practice sessions for depositions, resulting in a change in the client’s choice of words,” he said. In that circumstance, the crisis consultant was actually hired as a jury consultant under the law firm’s umbrella of confidentiality.

What tactics can be used for this public education process? They include, but are not limited to:

  • The use of spokespersons trained to deliver key messages to the media and other audiences.
  • Educating employees of defendant or plaintiff’s companies about what to say or not to say about the situation at hand when they’re back home, out in the community which will eventually be the source of jurors.
  • Advertorials — buying print space or broadcast time in which one puts news-like stories about your client organization that are designed to help balance any misinformation which may already be in the public eye. This tactic is usually only employed if the media has consistently mis-reported the facts.

The battle for the hearts, minds and votes of jury members does not begin in the courtroom. In my experience, advance communication begins immediately after a legal situation hits the media. It can work together with legal tactics to (a) preclude a case ever going to trial (assuming that’s a desired outcome for either side of the issue) or (b) affect public perception sufficiently to enhance either side’s chance of a favorable outcome in court.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

What’s a vulnerability audit and why do you need one?

An-auditor-going-through-documents-in-her-office

A vulnerability audit is a thorough self-inspection designed to identify potential crises before they occur and pave the way for creation of a crisis communications plan which will allow an organization to avoid, or at least minimize, the negative impact of such crises.

This is done by:

  1. Collecting data from people in key information flow positions. Senior executives are not always aware of all of the circumstances which can lead to the birth of a crisis. Hence, interviews are conducted with both white- and blue-collar personnel at various echelons of the company, typically a minimum of 20 interviews. Multi-location businesses usually require interviews with remote location personnel who have insights specific to their area.

  2. These interviews are conducted on an extremely confidential basis. Ideally, interviewees are told that the firm’s senior management will not, under any circumstances, be told “who said what.” Information gleaned during the interview process includes (1) potentially harmful trends (facts or perceptions reported by multiple sources); (2) significant inconsistencies between answers from different subjects; (3) non-verbal cues that there may be something amiss in certain areas, which then prompts further questioning; and, (4) consensus opinion regarding the probability of certain types of crises.

  3. Looking for operational and communications weaknesses which could cause or contribute to a crisis.An employee who’s a “loose cannon” is a more obvious potential source of problems, even if he/she is well-intentioned, but there are less obvious issues revealed through the vulnerability audit process. For example, one past client relied on a single fax machine for incoming and outgoing faxes from its headquarters offices during a crisis, which tremendously delayed communication with a number of important audiences. The simple addition of fax machines, creation of broadcast fax/email lists and similar tactics can often greatly improve crisis response.

  4. Anticipating actual crisis scenarios. Every organization is vulnerable to certain types of crises inherent in the nature of its business, plus others inherent, perhaps, in the nature of its particular style of operating. Additionally, the vulnerability audit has been known to reveal “skeletons” of which senior management may not have been aware.

  5. Reporting results. The conclusions from the vulnerability audit are then analyzed and presented both as a in-depth overview of issues that need to be addressed.

The information collected during the vulnerability audit process is used as the basis for writing a manual which will guide the entire organization in the communications aspects of responding to crisis situation. A side benefit we’ve seen – the discussions necessary to the audit process often spur more overall interest in protecting the company from crisis, which of course saves you money!

We typically spot the first vulnerability within minutes, and as the process continues problems “everyone knew” existed (except, often, those at the top!) quickly emerge. Time after time clients who feel they’ve prepared adequately are stunned by the list of vulnerabilities this process identifies, and the liability they would have faced if the possibilities had become reality. Every organization has weaknesses but they don’t have to put you out of business. Know what they are and make prevention a part of daily conversation.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

Still Not Worried About Crisis Training?

A-departmental-head-training-colleagues-on-work-issues

Practice makes perfect is cliche for a reason. We all accept that it takes repetition and training to be good at anything, but in spite of this we’ve seen certain concerning behavior repeated throughout our 30+ years of experience:

  • Many organizations still don’t plan or train for crises at all, either rolling the dice that their “crisis number” doesn’t come up and/or wrongly assuming that they can “wing it” because of their combined skills.
  • Even when organizations have gone to the effort (and cost) of developing or even getting initial training in the use of business continuity or crisis communications plans, most still engage in little to no ongoing training thereafter.
  • Most organizations go through periods of significant personnel turnover and major operational changes, all of which can require modification of existing crisis plans and then re-training. The former happens sometimes, the latter – not so often!
  • Too many organizations continue to turn incidents into crises, and minor crises into major ones, because their people simply aren’t ready to rumble.

If you could choose to know – in advance – how you’re going to handle your own nightmare scenario, and that your team can handle it, why wouldn’t you? Crisis training just makes sense.

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm, and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Bernstein Crisis Management | Connect with Jonathan | Connect with Erik

Before You Communicate, Consider Your Audience

A-business-man-speaking-to-an-audience

When creating crisis communications we see far too many failing to consider their audience in the writing. Whether it comes as a result of being overly insulated in your own company culture or simply being out of touch with the segment of the population that’s been impacted, not considering your target audience and how they believe communications should go is one of the most common mistakes made in crisis situations.

Fortunately it’s not hard to fix. All you need is the ability to put yourself in the audience’s shoes – what concerns do they want addressed, and what factors are driving the emotions they’re feeling about you and your brand? Sometimes it can help to get an outside perspective from a trusted adviser, or even to ask folks from the stakeholder group (if that’s an option), but regardless until you understand what the audience needs from you, you can’t start writing.

One of the best ways to practice this might be to take crisis communications you see coming from other organizations and try to re-write them to be more effective given what you know from news coverage, etc. of public reaction, and if you truly want to get better at communicating in ugly situations you’ll make this a regular part of your professional routine.

——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is vice president for the firm, and also editor of its newsletter, Crisis Manager]

We love to connect with readers on LinkedIn! Connect with Jonathan | Connect with Erik