What's the best strategy for communications after a data breach, like the one suffered by Global Payments Inc.? Bob Carr, CEO of Heartland Payment Systems, discusses what to say in the weeks following a breach.

To respond to a security incident, an organization must first be aware of it. But too many intrusions go undetected, says Rob Lee of SANS Institute. That's the first problem that needs to be addressed.

One of the biggest mistakes companies make after a major data breach is communicating with the news media, consumers and others before all the facts are clear, says attorney Ronald Raether.

"Regulation drives spending," says George Tubin of GT Advisors. "You're in a situation where the regulators are telling you, 'You have to do something; you have to make improvements.' Therefore, the bank has to spend some money on technology."

What might the Global Payments breach investigation entail? Dave Ostertag of Verizon's Investigative Response unit describes a forensics investigation - how long it can take and what it might reveal.

Healthcare organizations need to make mobile device security a top priority because so many recent data breaches can be tied to poor mobile device management, says consultant Jeff Brandt.

Companies should hire a breach resolution vendor before they experience a data breach to help ensure rapid, appropriate response, says security consultant Robert Peterson.

Gartner Analyst Avivah Litan, one of the first fraud experts to report the Global Payments Inc. data breach, says the latest revelations raise more questions than answers about the incident's impact.

In the wake of the Global Payments Inc. card breach, ID theft expert Neal O'Farrell says banks and credit unions must be proactive with outreach to customers. What should institutions' messages include?

From 2010: When he first learned of the full magnitude of the Heartland Payment Systems data breach, Heartland CEO Bob Carr had one overriding thought: "Can we survive this?"