The reason? Sony lacked an effective incident response process for online security and privacy issues, something even smaller organizations need to implement. "Any organization that's a custodian of customer data needs to spend time figuring out what it's going to do if something happens to that data," he says. "Besides avoiding damage to their reputations, they also need to protect themselves against legal and regulatory risks."
Nearly every state has laws requiring organizations to notify customers in the event of a data breach. Publicly traded companies must also worry about the impact of security and privacy incidents on their share price.
Building an emergency response team means marshaling resources across the organization -- legal, communications, and technical. It also requires a mandate from top management that empowers the team to do what needs to be done, swiftly and without interference, Budd adds.
"You need to get out there as quickly as possible and be as transparent as you can be," he says. "You need to say what has happened, and also what hasn't happened. Because one way or another, the story will get out. You want to be the one to step out onto the stage, grab the microphone, and take charge of the situation."
Because it bungled its initial response, by the time Sony finally did something right -- shutting down the network for a month and rebuilding it piece by piece, taking a huge financial hit in the process -- it got almost no credit for it, says Budd.
However, Sony may have learned its lesson, he adds. After thwarting attempts by hackers to access nearly 100,000 PSN accounts earlier this month, Sony got ahead of the crisis by reporting it quickly and in detail, minimizing further damage to its reputation.
So, if this is such a great idea, why isn't everyone doing it? Most organizations are focused on generating revenues, not on the bad things that might happen to them, says Budd. Crisis response can be expensive, and many companies simply lack the expertise.
"When people get in trouble, a lot of them automatically start acting like five-year-olds," he adds. "Their first response is to cover it up. It takes a certain amount of courage to go out on stage in front of a hostile audience and say, 'Here's the bad thing that's going on now.' It's easier to adopt a bunker mentality."