How To Prepare For A Cyber Crisis

Organisations have varied ways of dealing with crises - cyber attacks or otherwise. As a result, some are overcome with chaos and disorder, whereas others display professional composure and can rise to challenges.

Those able to withstand an attack are often prepared, have a preventative plan ready and have maybe even rehearsed a similar scenario. In contrast, relying on false reassurances that a business will cope during a serious cyber attack can lead to potentially severe consequences later.

Having led a global manufacturing organisation through a cyber attack, here are some of the ways I think an organisation can prepare for a cyber crisis. 

Grasping The Potential 

Crisis preparedness can make all the difference between surviving an attack and suffering the consequences, but we often underestimate the possible reach of an incident. From my own experience, the first step to being prepared is ensuring all employees can fathom what a crisis would mean. All the competence, processes, and creativity you have as an organisation is required instantly and to the highest degree. It’s like having to participate in the Olympic Games. That’s quite a step up from a local race and that even assumes that you have been training and competing at all. 

The key differentiator between cyber crisis and general crisis preparedness is that, firstly, it involves an adversary actively trying to cause harm. It is distinct from an earthquake or a flood in that your adversary is trying to inflict as much damage as possible during a period of time.

A cyber attack is not necessarily a one-off event but rather involves having to predict the attackers' potential next step.

Secondly, a cyber crisis can hit a company with much broader prospects than an ordinary crisis. Whereas most crises are limited geographically or concentrate on a few departments (e.g., legal), a cyber attack can spread to all departments concurrently and globally within seconds or minutes; something for which organisations need to account.

Common Challenges Of Cyber Attacks

1.    Most of the time, businesses struggle with preparing and responding to a cyber incident because they consider it a one-off event they can repair. 

2.    In cyber crime - to be specific, ransomware - the same actor and malware that attacks one company might have a completely different impact on another. It can cause severe operational, reputational, or financial stress and should, therefore, all be treated with the same caution.   

3.    Cyber crisis preparedness plans are often mistaken for a business continuity plan when in reality, they are not the same. A business continuity plan is absolutely needed but will be insufficient to deal with data theft or criminal gang intent such as extortion. 

How To Evolve A Crisis Response

The first few hours and days into a crisis are the most important. Immediate support allows the business to continue communicating with consumers and keep business operations running. However, it is practically impossible to have the same people who fix your systems also spearhead the critical operations while the attack is ongoing.

And what's more, it is also essential to start thinking about long-term plans such as rebuilding and recovering for the future in a safe way. 

Before an attack occurs, companies must ask themselves how they can best prepare for the different stages of a crisis, as it leaves an opportunity to emerge from an attack stronger. Cyberc security professionals and business heads should convene and discuss the impact a cyber attack can have on the business and which parts are most critical.  Executive management must also consider cyber crisis preparedness a high priority. 

Testing Preparedness

The first step in testing how prepared the organisation is in the event of a cyber attack is by identifying the crown jewels such as assets, business processes, and reputation. Business leaders must then predict in various credible scenarios how an attack can impact them. It is critical that these scenarios are as detailed, relevant and plausible as possible. (And even though a ransomware attack is an obvious scenario for all global businesses, do not regard it as the only one.) 

The second step is creating a playbook on how the organisation plans to respond and ensuring critical roles are allocated to the right people, both internally and externally. For example, do you have an incident response retainer on standby with a trusted partner? 

Finally, companies need to practice the playbooks. It is important to remember that tests and fire drills are not only litmus tests for preparedness but eye-openers for areas of improvement. 

Justifying Your Plans

Overall, crisis preparedness is about minimising the consequences of an attack as quickly as possible and maintaining business continuity. Though you hope it never comes to a cyber attack testing your preparations, your work can help improve the organisation's general crisis preparedness and vice versa. 

Both business and operational teams must come together and practice their playbooks, acting out plausible scenarios to ensure the drills are accurate. Organisations with robust crisis management programmes are more resilient and more likely to prevent a crisis from becoming a catastrophe. 

Jo De Vliegher is Client Partner at ISTARI

You Might Also Read: 

Cyber Insurance - Making The Ransomware Crisis Worse:

 

« Google Issues A Warning To Gmail Users
CIO & CISO Visions Leadership Summit - 9th to 11th October »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

DoD Cyber Crime Center (DC3) - USA

DoD Cyber Crime Center (DC3) - USA

DC3 is a US Department of Defense (DoD) center of excellence for Digital and Multimedia forensics.

iXsystems

iXsystems

iXsystems is a leader in Open-Source enterprise server and storage solutions including Backup & Recovery to protect critical data.

Cognizant

Cognizant

Cognizant offer services and solutions for IT Infrastructure Security, Enterprise Mobility and Internet of Things.

Merlin Cyber

Merlin Cyber

Merlin is a premier cybersecurity platform that leverages security technologies, trusted relationships, and capital to develop and deliver groundbreaking security solutions.

Tesorion

Tesorion

Tesorion is a fusion of different enterprises each with its own specialisation in the field of cybersecurity. We have combined these specialisations to create an integrated comprehensive solution.

AFNOR Group

AFNOR Group

AFNOR Group designs and deploys solutions based on voluntary standards around the world and provides services including training, professional and technical information, assessment and certification.

Netenrich

Netenrich

The Netenrich operations intelligence platform is built from the ground up to help enterprises resolve everyday and futuristic problems for stable, secure environments and infrastructures.

ADGS

ADGS

ADGS is a deeptech company focused in the fields of Agent-Based simulations (Emergent Behavior), Cybersecurity and Biometrics, Social Dynamics, Natural Language Processing and Artificial Intelligence.

Phakamo Tech

Phakamo Tech

Phakamo Tech offers a full set of governance, risk, compliance, cybersecurity and Microsoft Cloud services that include consulting, planning, implementation and cyber incident response.

FDD Center on Cyber and Technology Innovation (CCTI)

FDD Center on Cyber and Technology Innovation (CCTI)

The Foundation for Defense of Democracies is a nonprofit research institute focusing on foreign policy and national security. Ares of focus include cyber security and technology innovation.

Shorebreak Security

Shorebreak Security

Shorebreak Securioty specialize in conducting highly accurate, safe, and reliable Information Security tests to determine the risks posed to your business.

Vircom

Vircom

With a large majority of cyber attacks starting with email, Vircom provides protection against the worst email security threats to your business.

ZINAD IT

ZINAD IT

ZINAD is an information security company offering state-of-the-art cybersecurity awareness products, solutions and services.

Glasstrail

Glasstrail

Glasstrail are single-minded about helping organisations gather intelligence and manage vulnerabilities in their attack surface before adversaries exploit them.

Corinium Global Intelligence

Corinium Global Intelligence

At Corinium, we have been bringing together the brightest minds in data, AI and info sec since 2013, to innovate at the intersection of technological advancements and critical thinking.

Infosec Ventures

Infosec Ventures

Infosec Ventures incubates and scales cyber security innovators that solve inefficiencies in cyber security.