How To Prepare For A Cyber Crisis

Organisations have varied ways of dealing with crises - cyber attacks or otherwise. As a result, some are overcome with chaos and disorder, whereas others display professional composure and can rise to challenges.

Those able to withstand an attack are often prepared, have a preventative plan ready and have maybe even rehearsed a similar scenario. In contrast, relying on false reassurances that a business will cope during a serious cyber attack can lead to potentially severe consequences later.

Having led a global manufacturing organisation through a cyber attack, here are some of the ways I think an organisation can prepare for a cyber crisis. 

Grasping The Potential 

Crisis preparedness can make all the difference between surviving an attack and suffering the consequences, but we often underestimate the possible reach of an incident. From my own experience, the first step to being prepared is ensuring all employees can fathom what a crisis would mean. All the competence, processes, and creativity you have as an organisation is required instantly and to the highest degree. It’s like having to participate in the Olympic Games. That’s quite a step up from a local race and that even assumes that you have been training and competing at all. 

The key differentiator between cyber crisis and general crisis preparedness is that, firstly, it involves an adversary actively trying to cause harm. It is distinct from an earthquake or a flood in that your adversary is trying to inflict as much damage as possible during a period of time.

A cyber attack is not necessarily a one-off event but rather involves having to predict the attackers' potential next step.

Secondly, a cyber crisis can hit a company with much broader prospects than an ordinary crisis. Whereas most crises are limited geographically or concentrate on a few departments (e.g., legal), a cyber attack can spread to all departments concurrently and globally within seconds or minutes; something for which organisations need to account.

Common Challenges Of Cyber Attacks

1.    Most of the time, businesses struggle with preparing and responding to a cyber incident because they consider it a one-off event they can repair. 

2.    In cyber crime - to be specific, ransomware - the same actor and malware that attacks one company might have a completely different impact on another. It can cause severe operational, reputational, or financial stress and should, therefore, all be treated with the same caution.   

3.    Cyber crisis preparedness plans are often mistaken for a business continuity plan when in reality, they are not the same. A business continuity plan is absolutely needed but will be insufficient to deal with data theft or criminal gang intent such as extortion. 

How To Evolve A Crisis Response

The first few hours and days into a crisis are the most important. Immediate support allows the business to continue communicating with consumers and keep business operations running. However, it is practically impossible to have the same people who fix your systems also spearhead the critical operations while the attack is ongoing.

And what's more, it is also essential to start thinking about long-term plans such as rebuilding and recovering for the future in a safe way. 

Before an attack occurs, companies must ask themselves how they can best prepare for the different stages of a crisis, as it leaves an opportunity to emerge from an attack stronger. Cyberc security professionals and business heads should convene and discuss the impact a cyber attack can have on the business and which parts are most critical.  Executive management must also consider cyber crisis preparedness a high priority. 

Testing Preparedness

The first step in testing how prepared the organisation is in the event of a cyber attack is by identifying the crown jewels such as assets, business processes, and reputation. Business leaders must then predict in various credible scenarios how an attack can impact them. It is critical that these scenarios are as detailed, relevant and plausible as possible. (And even though a ransomware attack is an obvious scenario for all global businesses, do not regard it as the only one.) 

The second step is creating a playbook on how the organisation plans to respond and ensuring critical roles are allocated to the right people, both internally and externally. For example, do you have an incident response retainer on standby with a trusted partner? 

Finally, companies need to practice the playbooks. It is important to remember that tests and fire drills are not only litmus tests for preparedness but eye-openers for areas of improvement. 

Justifying Your Plans

Overall, crisis preparedness is about minimising the consequences of an attack as quickly as possible and maintaining business continuity. Though you hope it never comes to a cyber attack testing your preparations, your work can help improve the organisation's general crisis preparedness and vice versa. 

Both business and operational teams must come together and practice their playbooks, acting out plausible scenarios to ensure the drills are accurate. Organisations with robust crisis management programmes are more resilient and more likely to prevent a crisis from becoming a catastrophe. 

Jo De Vliegher is Client Partner at ISTARI

You Might Also Read: 

Cyber Insurance - Making The Ransomware Crisis Worse:

 

« Google Issues A Warning To Gmail Users
CIO & CISO Visions Leadership Summit - 9th to 11th October »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

PointSharp

PointSharp

Pointsharp provides leading products for secure login and multi-factor authentication that allow enterprise organizations to embrace a modern workplace.

Institute for National Security and Counterterrorism (INSCT)

Institute for National Security and Counterterrorism (INSCT)

INSCT is a center for the study of national security, international security, and counterterrorism. Research programs include New Frontiers in Science, Cyber, & Technology

SiteGuarding

SiteGuarding

SiteGuarding provide website security tools and services to protect your website against malware and hacker exploits.

CloudCodes Software

CloudCodes Software

CloudCodes is a cloud security solutions provider focused on providing cloud security solutions to enterprise customers.

HackCon Norway

HackCon Norway

HackCon is for the people who are interested in technology, psychology, IT and security, and who wants to improve their knowledge within these areas.

Watchdata Technologies

Watchdata Technologies

Watchdata Technologies is a pioneer in digital authentication and transaction security.

Infodas

Infodas

Infodas provides Cybersecurity and IT consulting / system integration services as well as a range of innovative Cybersecurity products to public sector and commercial clients.

Perseus Cyber Security

Perseus Cyber Security

Perseus provides all-around digital protection for small and medium-sized businesses through state-of-the-art software solutions, flexible online training and emergency response.

DeepCyber

DeepCyber

DeepCyber supports its customers, with an “intelligence-driven” approach, to improve their proactive detection and response "capability" of cyber threats.

Foreseeti

Foreseeti

Foreseeti is Europe’s leading provider of Automated Threat Modeling and Attack Simulation solutions.

Pioneer Search

Pioneer Search

Pioneer Search is a UK based Technology & Change, Electronics Engineering, Cyber Security & Cloud and Data & Analytics Employment Agency.

Enet 1 Group1

Enet 1 Group1

Enet 1 Group audits, assesses, recommends, and delivers tested solutions for the ever-increasing threats to your critical systems and digital assets

SyferLock Technology Corp.

SyferLock Technology Corp.

SyferLock is an innovative provider of next-generation authentication and security solutions.

Information & Communications Technology Association of Jordan (int@j)

Information & Communications Technology Association of Jordan (int@j)

The Information & Communications Technology Association of Jordan is a membership based ICT and IT Enabled Services (ITES) industry advocacy, support and networking association.

Amidas Hong Kong

Amidas Hong Kong

Amidas is your trusted companion on the road to Digital Transformation. We provide a full range of Information Technology Solutions and Professional Services to Enterprise customers.

AdvIntel

AdvIntel

AdvIntel is a next-generation threat prevention and loss prevention company launched by a team of certified investigators, reverse engineers, and security experts.