How To Prepare For A Cyber Crisis

Organisations have varied ways of dealing with crises - cyber attacks or otherwise. As a result, some are overcome with chaos and disorder, whereas others display professional composure and can rise to challenges.

Those able to withstand an attack are often prepared, have a preventative plan ready and have maybe even rehearsed a similar scenario. In contrast, relying on false reassurances that a business will cope during a serious cyber attack can lead to potentially severe consequences later.

Having led a global manufacturing organisation through a cyber attack, here are some of the ways I think an organisation can prepare for a cyber crisis. 

Grasping The Potential 

Crisis preparedness can make all the difference between surviving an attack and suffering the consequences, but we often underestimate the possible reach of an incident. From my own experience, the first step to being prepared is ensuring all employees can fathom what a crisis would mean. All the competence, processes, and creativity you have as an organisation is required instantly and to the highest degree. It’s like having to participate in the Olympic Games. That’s quite a step up from a local race and that even assumes that you have been training and competing at all. 

The key differentiator between cyber crisis and general crisis preparedness is that, firstly, it involves an adversary actively trying to cause harm. It is distinct from an earthquake or a flood in that your adversary is trying to inflict as much damage as possible during a period of time.

A cyber attack is not necessarily a one-off event but rather involves having to predict the attackers' potential next step.

Secondly, a cyber crisis can hit a company with much broader prospects than an ordinary crisis. Whereas most crises are limited geographically or concentrate on a few departments (e.g., legal), a cyber attack can spread to all departments concurrently and globally within seconds or minutes; something for which organisations need to account.

Common Challenges Of Cyber Attacks

1.    Most of the time, businesses struggle with preparing and responding to a cyber incident because they consider it a one-off event they can repair. 

2.    In cyber crime - to be specific, ransomware - the same actor and malware that attacks one company might have a completely different impact on another. It can cause severe operational, reputational, or financial stress and should, therefore, all be treated with the same caution.   

3.    Cyber crisis preparedness plans are often mistaken for a business continuity plan when in reality, they are not the same. A business continuity plan is absolutely needed but will be insufficient to deal with data theft or criminal gang intent such as extortion. 

How To Evolve A Crisis Response

The first few hours and days into a crisis are the most important. Immediate support allows the business to continue communicating with consumers and keep business operations running. However, it is practically impossible to have the same people who fix your systems also spearhead the critical operations while the attack is ongoing.

And what's more, it is also essential to start thinking about long-term plans such as rebuilding and recovering for the future in a safe way. 

Before an attack occurs, companies must ask themselves how they can best prepare for the different stages of a crisis, as it leaves an opportunity to emerge from an attack stronger. Cyberc security professionals and business heads should convene and discuss the impact a cyber attack can have on the business and which parts are most critical.  Executive management must also consider cyber crisis preparedness a high priority. 

Testing Preparedness

The first step in testing how prepared the organisation is in the event of a cyber attack is by identifying the crown jewels such as assets, business processes, and reputation. Business leaders must then predict in various credible scenarios how an attack can impact them. It is critical that these scenarios are as detailed, relevant and plausible as possible. (And even though a ransomware attack is an obvious scenario for all global businesses, do not regard it as the only one.) 

The second step is creating a playbook on how the organisation plans to respond and ensuring critical roles are allocated to the right people, both internally and externally. For example, do you have an incident response retainer on standby with a trusted partner? 

Finally, companies need to practice the playbooks. It is important to remember that tests and fire drills are not only litmus tests for preparedness but eye-openers for areas of improvement. 

Justifying Your Plans

Overall, crisis preparedness is about minimising the consequences of an attack as quickly as possible and maintaining business continuity. Though you hope it never comes to a cyber attack testing your preparations, your work can help improve the organisation's general crisis preparedness and vice versa. 

Both business and operational teams must come together and practice their playbooks, acting out plausible scenarios to ensure the drills are accurate. Organisations with robust crisis management programmes are more resilient and more likely to prevent a crisis from becoming a catastrophe. 

Jo De Vliegher is Client Partner at ISTARI

You Might Also Read: 

Cyber Insurance - Making The Ransomware Crisis Worse:

 

« Google Issues A Warning To Gmail Users
CIO & CISO Visions Leadership Summit - 9th to 11th October »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

InfoSec People

InfoSec People

InfoSec People is a boutique cyber and technology recruitment consultancy, built by genuine experts.

Exclusive Networks

Exclusive Networks

Exclusive Networks accelerate market entry and growth for innovative cybersecurity, networking and infrastructure technologies.

Fastpath Solutions

Fastpath Solutions

Fastpath deliver software solutions that enable you to take control of your security, compliance and risk management initiatives.

InteliSecure

InteliSecure

InteliSecure offer Professional Services, Security Assessments and Managed Services for data and threat protection.

Cyberbit

Cyberbit

Cyberbit empowers cybersecurity teams to be fully prepared with a product portfolio ready to detect and respond effectively across both IT and OT networks.

NRI Secure Technologies

NRI Secure Technologies

NRI SecureTechnologies is a Cybersecurity group company of the Nomura Research Institute (NRI) and a global provider of next-generation Managed Security Services and Security Consulting.

Optiv

Optiv

Optiv is a market-leading provider of end-to-end cyber security solutions. We help clients plan, build and run successful cyber security programs that achieve business objectives.

ITC Secure Networking

ITC Secure Networking

ITC are a leading cloud-based MSSP delivering service innovation in cyber security analytics & cloud technology.

Center for Long-Term Cybersecurity (CLTC)

Center for Long-Term Cybersecurity (CLTC)

The Center for Long-Term Cybersecurity is developing and shaping cybersecurity research and practice based on a long-term vision of the internet and its future.

Matias Consulting Group (MCG)

Matias Consulting Group (MCG)

Your Business needs competitive and resilient ICT solutions. MCG defines, deploy & support them enabling you to focus on your core business.

Root9B (R9B)

Root9B (R9B)

R9B offers advanced cybersecurity products, services, and training to enhance the way organizations protect their networks.

Madrona Venture Group

Madrona Venture Group

Madrona Venture Group invests in seed and early-stage technology companies in areas including cybersecurity.

IoTeX

IoTeX

Building the connected world. IoTeX is a fast, secure, and decentralized platform that connects real world devices/data to the blockchain.

SignMyCode

SignMyCode

SignMyCode is a one-stop shop for trusted and authentic code signing solutions to safeguard software.

RADICL

RADICL

RADICL's mission is to give SMBs that serve America's Defense Industrial Base (DIB) access to strong, enterprise-grade cyber security protection.

Multidisciplinary Institute for Cybersecurity and Cyber Resilience (IMC2)

Multidisciplinary Institute for Cybersecurity and Cyber Resilience (IMC2)

IMC2 brings together resources to carry out ambitious, innovative and multidisciplinary projects in the field of cybersecurity and cyber resilience.