How to Avoid a “Zombie” Breach

Recently, power outage messages in one city have included warnings about zombies. While fans of the Walking Dead may have been amused (or frustrated that “Walker” wasn’t used instead), misuse of an emergency notification system greatly affects the reception of future messages and public perception of the sender, and may increase the likelihood of opt-outs. While the messages were not sent from an Everbridge system, it’s important to reiterate that these systems shouldn’t be trivialized, and offer some guidance on how to effectively protect your emergency messaging system. Create Clear Boundaries

1. Separate Live and Test Modes – Have distinct Test and Live modes, where both the controls and the look and feel are different. Message senders should be able to quickly recognize that they are in one mode versus the other. Setting Test mode as the default will require an active switch to Live mode; an fast enough switch to make that triggers a change in mindset for operators.
   1. Compliance Reminders – Make sure your HR policies and any internal message requirements you have are clearly defined and visible each time a message sender logs in; ideally as a page that senders need to agree to with each new log in.

Customize Access

1. Build In Access Controls – Set up your system with custom permissions for each type of message sender. Will you provide templates as guidance for message senders to customize as needed, and limit them only in the recipients they can send alerts to? Or will you preconfigure an entire template and lock down access to specific parts of the template (message body, recipients, or settings)? Everbridge offers permission configuration for both situations – check how your access is configured, and make sure that message senders are appropriately restricted based on their role at your organization.
2. Continually Manage Access – Administrators should continuously review user access and bake it into their existing onboarding and off-boarding processes, so employees out on leave are temporarily disabled, and those who no longer work at the organization should be immediately removed as Users. Ensure that any message sender who should have access knows their login credentials, and usernames and passwords are unique per user and never shared. Passcode reset intervals should be clearly defined in your system to ensure passwords are updated on a continual basis, and should never be saved on a public device.

Test, Test and Test Again No matter how much work you put into recipient data, template preparation, and training, ultimately your system depends on the strength of your message senders. If there is a zombie apocalypse, operators should be able to rely on a process that is familiar and comfortable while searching for a good hiding place. Run regular tests of your system, sending those test alerts to pre-identified recipients who expect the message, and include language reminding recipients the message is only a test. As my colleague Jeremiah likes to say, “You fight how you train” – so make sure your people are ready for anything.