DataMuseum.dk

top - metrics - download

    Length: 3813 (0xee5)
    Types: TextFile
    Names: »the-press.tex«

└─⟦4f9d7c866⟧ Bits:30007245 EUUGD6: Sikkerheds distributionen
    └─⟦36857feb3⟧ »./papers/Security_Primer/primer.tar.Z« 
        └─⟦5c5f5f2d8⟧ 
            └─⟦this⟧ »the-press.tex« 

TextFile

\section{Handling the Press}

Often media inquiries can absorb more time than all of the others
issues in incident handling combined.  It is important to understand
this and to use your public affairs office if it exists.  
In the excitement, people, especially those who are not experience
speakers will often forget that they are not empowered to speak for
the center and that nothing is ever really said, ``Off the record.''

\subsection{Spin Control}

The phrase ``Spin Control'' was first used in political circles. It
refers to altering the perceptions about an incident rather than the
delaying with the facts of the incident themselves. Consider the two
statements.

\begin{enumerate}

\item {\it To keep our machines safe, we decided to disconnect them
from the network.}

\item {\it We were forced to shut down our network connections to
prevent damage to our machines.}

\end{enumerate}

I have found that the giving the press a state like the former tends
to produce a laudatory piece about one's staff while a statement like
the latter, produces an embarrassing piece.  The two statements are of
course essentially identical. 

Your public affairs group is probably familiar with these issues and
can help you form press statements

\subsection{Time Control}

With a sufficiently large incident, the media attention can absorb
almost unbounded amounts of time.  The press will often call employees
at home.  It is important the staff that are solving a problem
understand that the solving the incident is more important that
dealing with the press.  At the very least insist that all press
representatives go through the public affairs often so that the
standard questions can be easily and time-efficiently be answered.

\subsection{Hero Making}

The press likes to find outstanding heroes and villains.  As a result,
the media will tend to make one of your staff members into a hero if
at all possible from them to do so.  It is more likely than not that
the Hero will not be the person who has worked the hardest or the
longest.

\subsection{Discouraging or Encouraging a Next Incident}

The attention that an incident receives greatly affect the likelihood
of future incidents at that particular site.  It probably also
influences the decision process or potential future crackers in the
community at large.  Claiming that your site is invulnerable is an
invitation to a future incident.  Giving the media step by step
instructions on how to break in to a computer is also not a wonderful
idea. 

I (personally) suggest stressing the hard work of your staff and the
inconvenience to the legitimate users and staff members.  To the
extent practical portray the cracker as inconsiderate and immature and
try to avoid making him seem brilliant at one extreme or the attack
seem very simple at the other.

\subsection{Prosecution}

If you considering prosecution, you need to consult with your legal
counsel and law enforcement official for advise on press handling. 


\subsection{No Comment}

One common strategy for avoiding (or at least bounding) time loss with
the press is to simply decline to comment on the situation at all.  IF
you are going to adopt this approach, your public affairs office can
advise you on techniques to use.  It is important to tell everyone who
is involved in the incident that they should not discuss the
situation; otherwise people will leak things accidently.  Also,
without correct information from your center, the press may print many
inaccurate things that represent their best guesses.

\subsection{Honesty}

I recommend against trying to mislead the press.  It is hard to keep a
secret forever and when and if the press finds that you have lied to
them, the negative coverage that you may receive will probably far
exceed the scope of the actual incident.