How To Prepare For A Cyber Crisis

Organisations have varied ways of dealing with crises - cyber attacks or otherwise. As a result, some are overcome with chaos and disorder, whereas others display professional composure and can rise to challenges.

Those able to withstand an attack are often prepared, have a preventative plan ready and have maybe even rehearsed a similar scenario. In contrast, relying on false reassurances that a business will cope during a serious cyber attack can lead to potentially severe consequences later.

Having led a global manufacturing organisation through a cyber attack, here are some of the ways I think an organisation can prepare for a cyber crisis. 

Grasping The Potential 

Crisis preparedness can make all the difference between surviving an attack and suffering the consequences, but we often underestimate the possible reach of an incident. From my own experience, the first step to being prepared is ensuring all employees can fathom what a crisis would mean. All the competence, processes, and creativity you have as an organisation are required instantly and to the highest degree. It’s like having to participate in the Olympic Games. That’s quite a step up from a local race and even assumes that you have been training and competing. 

The key differentiator between cyber crisis and general crisis preparedness is that, firstly, it involves an adversary actively trying to cause harm. It is distinct from an earthquake or a flood in that your adversary is trying to inflict as much damage as possible during a period of time.

A cyber attack is not necessarily a one-off event but rather involves having to predict the attackers' potential next step.

Secondly, a cyber crisis can hit a company with much broader prospects than an ordinary crisis. Whereas most crises are limited geographically or concentrate on a few departments (e.g., legal), a cyber attack can spread to all departments concurrently and globally within seconds or minutes; something for which organisations need to account.

Common Challenges Of Cyber Attacks

1.    Most of the time, businesses struggle with preparing and responding to a cyber incident because they consider it a one-off event they can repair. 

2.    In cybercrime - to be specific, ransomware - the same actor and malware that attacks one company might have a completely different impact on another. It can cause severe operational, reputational, or financial stress and should, therefore, all be treated with the same caution.   

3.    Cyber crisis preparedness plans are often mistaken for a business continuity plan when in reality, they are not the same. A business continuity plan is absolutely needed but will be insufficient to deal with data theft or criminal gang intent such as extortion. 

How To Evolve A Crisis Response

The first few hours and days into a crisis are the most important. Immediate support allows the business to continue communicating with consumers and keep business operations running. However, it is practically impossible to have the same people who fix your systems also spearhead the critical operations while the attack is ongoing.

What's more, it is also essential to start thinking about long-term plans such as rebuilding and recovering for the future in a safe way. 

Before an attack occurs, companies must ask themselves how they can best prepare for the different stages of a crisis, as it leaves an opportunity to emerge from an attack stronger. Cyberc security professionals and business heads should convene and discuss the impact a cyber attack can have on the business and which parts are most critical.  Executive management must also consider cyber crisis preparedness a high priority. 

Testing Preparedness

The first step in testing how prepared the organisation is in the event of a cyber attack is by identifying the crown jewels such as assets, business processes, and reputation. Business leaders must then predict in various credible scenarios how an attack can impact them. It is critical that these scenarios are as detailed, relevant and plausible as possible. (And even though a ransomware attack is an obvious scenario for all global businesses, do not regard it as the only one.) 

The second step is creating a playbook on how the organisation plans to respond and ensuring critical roles are allocated to the right people, both internally and externally. For example, do you have an incident response retainer on standby with a trusted partner? 

Finally, companies need to practice the playbooks. It is important to remember that tests and fire drills are not only litmus tests for preparedness but eye-openers for areas of improvement. 

Justifying Your Plans

Overall, crisis preparedness is about minimising the consequences of an attack as quickly as possible and maintaining business continuity. Though you hope it never comes to a cyber attack testing your preparations, your work can help improve the organisation's general crisis preparedness and vice versa. 

Both business and operational teams must come together and practice their playbooks, acting out plausible scenarios to ensure the drills are accurate. Organisations with robust crisis management programmes are more resilient and likely to prevent a crisis from becoming a catastrophe.

This article first appeared on Cybersecurityintelligence.com.