How To Handle A Cyber Crisis

An unnamed Canadian Bank didn’t know how to publicly manage a cyber crisis and called in the experts. Here is their advice.

Head of  Toronto-based crisis management consulting firm, Allan Bonner was brought in some time ago to help an anonymous financial institution because the press wasn’t buying the company spokesperson’s answer to repeated questions on what had gone wrong.

The bank would only say something along the line of, ‘We are dedicated to customer satisfaction. In order to improve our customer relationships, we regularly improve our computer operations,’ Bonner recalled in an interview. He sat with a vice-president trying to get the real answer on this for several hours who said he was told by his staff the same thing. Bonner told the exec, “You should have the authority to find out what happened. Get one of your IT people on the line and ask.”

However, IT repeated the same explanation. Finally, one of Bonner’s researchers spoke to the IT leader and got the full answer: A technician tweaked a computer program, but a few hours later another person thought the change was wrong, reversed the tweak and, as Bonner puts it, “the computer’s head exploded” because there were two adjustments so close together.

The lesson: “In a crisis, cyber or not, the people reporting to you will keep you in the dark, as opposed to coming clean if there’s going to be some pain,” Bonner said.

Hard for the C-suite to believe, but some, maybe all, people in the organisation think the less management knows the better. And they think, sometimes on the advice of consultants, the less the company says during a crisis the better. Not so, Bonner believes.

First, “a mission vision statement (‘We try to serve customers well’) isn’t why you have a crisis,” he said, so repeating it isn’t convincing. As for being afraid of saying something that might admit liability, Bonner says a carefully-worded statement will avoid that: “We’re sorry this happened, We’re trying to get to the bottom of it.” Instead, some companies think total denial is a valid response. He recalled making a presentation on the necessity of clear communications to an Alberta firm. 

At one point a lawyer said he told a customer whose plant had burned down to say nothing publicly about the incident. But how, Bonner wondered, could the loss be hidden? Employees would know. Customers would know. Suppliers would know.
Just as important, if the crisis is a cyber breach criminals could quickly exploit personal information. Customers need to be warned fast, if only to avoid costly class action lawsuits.

It’s “silly advice” to say nothing publicly, he said. On the other hand, an organisation shouldn’t be too communicative. And most importantly, it shouldn’t lay blame.

So yes, chose your words carefully. “Crisis management is game of inches,” Bonner likes to say. A former CBC broadcaster, Bonner moved into media training for management in 1988 and then crisis management. More recently he’s been looking into how unprepared organisations are to face a crisis, cyber or other. He the author of, An Ounce of Prevention (2010), a book on how to navigate through damage control and crisis response.

His next book, which will hopefully be published later this year, is on how cities should plan for emergencies stemming from cyber security incidents. “It is absolutely shocking what is both in and omitted” from many municipal emergency plans, he said, including how to deal with cyber-related incidents (everything from a deliberate attack to solar flares knocking out electric systems).

Biggest mistakes
The biggest mistake management makes in a crisis is “hoping nobody’s going to find out,” Bonner said. However “studies are clear: those who take fast action” fare better. 

When a crisis breaks don’t wait to react: Start assembling the data, people and resources you need immediately. If you find you don’t need them nine hours later, he said, no harm has been done.

The second biggest mistake is issuing overly optimistic reports to the public: ‘We’ll have this will be fixed in two days,’ or ‘We know the problem.’

The third mistake is focusing on the immediate problems of the crisis and forgetting the organization will have to deal with ongoing effects such as publicity, legislation, regulation, inquiries and court cases.

Allan Bonner’s 12 principles of crisis management:

1. In all cases, the first order of business is to determine the facts: What is the cause of the crisis and what will be the public perceptions? Many events are surrogates for other issues. Most events morph and have new meanings over a short period of time.
2. How will the issue be framed?
3. Who will frame the issue, regulators, legislators, customers, shareholders, other stakeholders.?
4. What will this morph into in the days or weeks ahead? One may handle the event well, but not the inquiry or testimony at legislatures or eventual court cases.
5. Inquiries go up and back. This means as high up the chain of command as possible and as far back as possible.
6. One must act fast but be sure of actions and information.
7. One must apologise but not admit liability.
8. If liability is completely obvious one will look foolish talking around it.
9. Don’t blame anybody for anything.
10. Don’t try to sell product or enhance reputation from the incident.
11. The court case may go on for years, long after the event is forgotten.
12. Your staff may keep details from you to avoid confrontation or recrimination.

IT World Canada

You Might Also Read: 

What Should You Do If Your Business Is Hacked? (£):

PR & Press After An Attack (£):

Cybersecurity Is Just A Lot Of Trouble For The General Public:

 

 

« Twitter Reveals True Extent Of Russian US Election Posts
The CIA Discovers It Has A Mole »

Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

OCERT

OCERT

National Computer Emergency Response Team of Oman.

Kasin Consulting

Kasin Consulting

Kasin Consulting is a management consulting company combining a deep understanding of the cyber domain with C-suite level business understanding.

Vintegris

Vintegris

Vintegris are a Certification Authority and manufacturer of innovative systems and applications for the full cycle of digital identity.

CyberArts

CyberArts

CyberArts is founded on the belief that every single organization deserves and requires the creme de la creme when there is a need for Cyber services.

Trustless Computing Association (TCA)

Trustless Computing Association (TCA)

TCA is is a non-profit organization promoting the creation and wide availability of IT and AI technologies that are radically more secure and accountable than today’s state of the art.

Approachable Certification

Approachable Certification

Approachable Certification is a UKAS accredited certification body offering down-to-earth and competitively priced audits against ISO Management Systems standards.

Global EPIC

Global EPIC

Global EPIC is an international cybersecurity initiative designed to combat growing world challenges by facilitating global collaboration in the field of cyber security.

InCyber

InCyber

InCyber's mission is to defend enterprises against Insider Threats and/or those who are impersonating Insider credentials such as Hackers, Terrorists, and Malware.

PricewaterhouseCoopers (PwC)

PricewaterhouseCoopers (PwC)

PricewaterhouseCoopers is a multinational professional services network of firms headquartered in London, United Kingdom and operating in 157 countries.

Canopius Group

Canopius Group

Canopius is a global specialty lines insurance and reinsurance company and one of the top 10 insurers in the Lloyd’s insurance market.