A Goal Without A Plan Is Just A Wish

We can all agree that if two buildings are on fire, the building that has taken steps to reduce the ability of the fire to spread, has fire marshalls, evacuation plans and a sprinkler system which are all regularly tested is likely to be less damaged than the one without any of these.

Additionally, we can also agree that the longer the fire is burning, the more damage it causes.

The same can be said in the realm of cyber security (and now we have research to back it up). IBM’s 2023 Cost of a Data Breach Report tells us that investing in a robust incident response (IR) strategy is key to limiting damage from a breach and can reduce costs by up to a third. The report also found that the most effective IR strategy for reducing the period that the ‘cyber fire’ is burning was to combine formation and testing. This led to a decrease of 19.4% in the time taken to identify and contain a breach, saving organisations, on average, over $1m.

So we should know (both through IBM’s cyber research and common sense) the importance of not only having a well-baked IR plan, but one that is tested thoroughly and regularly. Yet do we actually do this? 

Plans Need To Be Tested

On the subject of whether a goal without an IR plan is just a wish, the common sense and wisdom of Antoine de Saint-Exupéry can teach us a lot (in life as well as cyber security). 

“A goal without a plan is just a wish,” whilst originating from a children's book author (and pilot), is very solid advice. So how do we move from wishes, to plans, to goals? It is very easy in our industry to develop something akin to “IR-plan envy.” We look around and see other people’s advanced IR plans and their incredible level of management buy-in and funding. 

However, for organisations without an IR plan or reviewing an existing one, there is plenty of useful guidance included in the ISO/IEC Standard 27035. What makes IR plans and processes special is their cyclical nature. Rather than being a linear process that is completed, they are a feedback loop of continuous improvement.

This is why starting can appear to be the hardest part but is also the most essential. It is also why testing them is so vital. 

Only by going through drills will organisations discover whether there are any opportunities for improvement in their execution of the plan and, in a more fundamental sense, if it is even likely to work. Things like communication gaps, outdated procedures, team members unsure of their responsibilities and technology issues can all be identified in a safe environment of testing. 

Testing can not only highlight unclear roles within the IR team and wider organisation but also provides an opportunity to build trust and understanding between areas of the business that may not regularly interact. 

Implementing and regularly testing a cyclical incident response plan can also serve to combat the toxic elements of finger pointing and blame. Where organisations can leave behind notions of “passing”, “failing” or “blaming” and move towards a culture of improving processes, culture and security can improve dramatically. 

A Final Word On Regulations & Compliance 

It is at this point that some authors may throw in the scary Boogie Man of ‘Regulations’ and ‘Compliance’ to ensure that you agree with and participate in the points made so far. A “Now go ‘do brilliant incident response’ or the regulator will get you” approach. 

Whilst regulator interaction is beyond the scope of this article it is worth noting that a well-defined IR plan with evidence of regular testing and improvement forms a fantastic vehicle for communicating the security posture of an organisation to regulators and stakeholders alike. 

In its simplest sense it says, “we care enough about our stakeholders to take this seriously that we operate from a position of realism as opposed to blind optimism.” We have plans for if things fail rather than just failing to have plans. 
 
Introduction of new regulations, such as those introduced by the Securities and Exchange Commission (SEC) in December 2023, are often presented in the media as introducing an unwelcome level of scrutiny when they could equally as easily be viewed as an opportunity to promote openness and trust between stakeholders, regulators and organisations. 

Through the practice of implementing and maintaining an IR plan, communication with regulators can become more refined (and ironically less likely to be required).

If your goal is a robust information security programme and you don’t have an incident response plan that you are regularly testing, what you actually have is an “information security wish.” If this is your organisation, now is the time to take that first step. It does not need to be perfect but it does need to be. 

Chris Denbigh-White is CSO at Next DLP 

Image: cottonbro studio 

You Might Aso Read: 

The Duality of Cybersecurity:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Managed Security Services In The Age of Advanced Threat Intelligence 
US Navy Will Use Data Analytics For Maritime Security »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Devo Technology

Devo Technology

Devo Security Operations is a next-gen cloud SIEM that enables you to gain complete visibility, reduce noise, and focus on the threats that matter most to the business.

Open Information Security Foundation (OISF)

Open Information Security Foundation (OISF)

OISF is a non-profit organization led by world-class security experts, programmers, and others dedicated to open source security technologies.

ThreatQuotient

ThreatQuotient

ThreatQuotient delivers an open and extensible threat intelligence platform to provide defenders the context, customization and collaboration needed for increased security effectiveness.

ThreatSpike Labs

ThreatSpike Labs

ThreatSpike Labs provides the first end-to-end fully managed security service for companies of all sizes.

itbox.online

itbox.online

Itbox.online offers IT solutions to ensure that your company's technologies are always available and secure as your business demands.

X4 Technology

X4 Technology

X4 Technology is a leader in finding the very best technology talent for some of the world’s most innovative start-ups and globally recognised brands.

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions is an industry leading Data Sanitization Software, Hardware and Onsite Service Provider.

Netizen

Netizen

Netizen is an award-winning company that develops and leverages innovative solutions to enable a more secure cyberspace for clients in government and commercial markets.

Cyber Skyline

Cyber Skyline

Cyber Skyline is a revolutionary cloud platform to practice, develop, and measure your team's technical cybersecurity skills.

StrataCore

StrataCore

StrataCore is a single-source technology lifecycle advocate that works behind IT teams as a strategic partner to help them achieve peak enterprise outcomes.

FastNetMon

FastNetMon

FastNetMon is a very high performance DDoS detection and mitigation tool which could detect malicious traffic in your network and immediately block it.

StealthPath

StealthPath

StealthPath is focused on endpoint protection, securing the “implicit trust” vulnerabilities of current leading information security solutions.

Kubus Hitam

Kubus Hitam

Kubus Hitam are a research-based company focused on cyber security. we strongly believe that innovation and safety are the two keywords for the future business market.

Global Resilience Federation (GRF)

Global Resilience Federation (GRF)

GRF builds, develops and connects security information sharing communities for mutual defense.

SecureWeb3

SecureWeb3

SecureWeb3 helps businesses and brands to secure their Web3 presence by offering a full suite of security services including training, consultancy & brand protection solutions.

RevEng.AI

RevEng.AI

RevEng.AI is designed to rigorously validate the integrity of software supply chains at a binary level, ensuring uncompromising security and trustworthiness in digital ecosystems.