• Profile hackers and plan your interactions with them.

Understand that hackers have different motivations and try to anticipate which ones will be most attracted to your organization. Provide clear mechanisms that hackers or those who find security problems with your infrastructure can use to communicate with you should they choose to; for example, institute a very accessible email address on your website (e.g., security@your_company.com). Finally, train customer service staff so they know how to deal with hackers who contact them to point out a vulnerability.


• Build an incident response plan and team.

Practice your organization’s security strength by assessing its response to actual and simulated incidents.