Things are going to get a little crazy, requests become orders and niceties fall to the wayside. In times of crisis, sanity becomes more important than pleasantries. Studies have shown that people would rather work with unfriendly, competent people, than unfriendly, incompetent people. This effect becomes more pronounced during times of crisis; do not worry about offending people by not being nice to them, worry about not adding to the insanity.
Inevitably, you are going to end up making some judgment calls that may be above your station and tasking people that you normally would have no authority over, on the understanding you'll answer for it later on; so long as you make this clear at the time, any reasonable person should support you on this.
As the long hours and sleepless nights count up, remember that there is an end and life will return to normal once more. If public disclosure of your breach is required, know that it is a double-edged sword. You may well experience great catharsis in knowing that the truth is finally out there, but you must come to terms beforehand that the PR spin engine will be operating at full pace and you will be under a mountain of non-disclosure.
People working in information security generally tend to be self-reliant types and the idea of using support resources outside of your own network of friends and family may seem alien, even repellant to you, but if you work for a suitably sized organization they will have employee councilors, who can be bound to the same NDA's you are. Don't underestimate the value of having someone you can legally discuss things with.
Handling a corporate breach is likely to be one of the most intense moments of your security career; you wouldn't be faulted for wondering if it's time for a career change because of it. Remember however, that in the world of incident response, there are two types of people - those that have been through a major breach, and those that haven't. Your employer will, in all likelihood, continue to remain in business and you will continue to remain employed. In this day and age, it is an accepted truth that all organizations will be breached at some point - what is important is how you handle it. Manage the stress, try not to say anything you canít take back and realize that you are going to come out of this with experience that you can't learn in any lab, or simulated exercise.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.