Cyber threats loom large today. So, have you wondered what actually happens during a cyber-attack? Can cybersecurity training and specifically incident response training help the chaos and pandemonium that ensues? In this blog, our CEO, Amar Singh, globally acknowledged expert on cyber resilience and crisis management, and creator of the NCSC-certified Cyber Incident Planning and Response course elaborates.
See what's in the blog below:
An indescribable adrenaline rush, panic attacks, flaring tempers, flying files, tonnes of chaos, a lot of confusion, blame, guilt, desperation – does it sound like a scene from a sitcom?
Well, it’s also what exactly an organisation under attack looks like! Cyber criminals don’t
You need to know what a cyber-attack looks like and what happens when a business’s gold mine – its confidential client or customer data – is severely compromised.
This is stating the obvious and the unavoidable. In a state of panic induced by the attack, decisions are made in a rush. Facts aren’t communicated clearly with key stakeholders and too many times businesses that have been under attack have failed to inform regulators in time, leading to hefty fines and loss of business reputation. All of these mistakes cannot be avoided because your incident response team is made up of humans and human beings make mistakes when under pressure.
But what can be avoided is the Headless Chicken Syndrome that often manifests itself in the chaos and confusion that follow an attack.
The most common problem that emerges in incident response is the deletion of evidence. Vital evidence of the attack and how it took place is often deleted – either on purpose or accidentally. Integrity of evidence is sacrosanct to effective incident response. It helps the IT and security team understand the attack methodology, figure out what can be done to control it from spiralling out of hand and also for preventing similar situations from recurring in the future. Evidence is also essential to regulatory compliance for reporting the attack correctly. Evidence, therefore, must never be tampered with, under any circumstances. The only way to achieve this is to have regular training that makes preserving evidence second nature in times of a crisis and having a Cyber Incident Response Checklist that every member of the response team is so familiar with that it becomes a part of their muscle memory.
In the aftermath of an attack, everyone is clamouring for FACTS but NONE are usually available. It is debilitating to not be able to know the impact on the business and/or not being able to rapidly identify the impact on the data subjects (ref. GDPR and breach notification). It is also essential to know if the data was encrypted and who has access to it.
Inconsistent communications are another oft-seen byproduct of a cyber-attack. Due to the charged emotions, the mayhem and the chaos, communication threads in a crisis start to be coloured and corrupted with prejudices and personal notions. This must be avoided at all cost as apart from further adding to confusion, unclear communications can have legal repercussions.
The only solution to this challenge is a clear-cut crisis communications strategy. This strategy shouldn’t just enlist what steps to take and whom to communicate with, but it must also lucidly define the taxonomy to be used and ban words that create further confusion and are misleading. Crisis communications is an imperative and very essential aspect of cyber incident response training. Any staff member who will play the lead role in crisis communications with stakeholders and the media must be thoroughly trained in this aspect, while all other team members must also be given basic orientation.
It’s easy to forget that a crisis for the business is also a crisis for the staff – a serious mental and emotional challenge that can have far-reaching ramifications. Remember that when your employees are at their most vulnerable that they’re also most likely to make mistakes.
If the above scenario sounds intimidating. It is. Our team of experts has seen the above and more. To be honest, it's inevitable. However this mayhem can be avoided. How?
About the Author: Amar Singh is the CEO and founder of Cyber Management Alliance. He is an industry influencer and cybersecurity thought leader. Amar has served as CISO for various companies, including News International (now News UK), SABMiller, Gala Coral, Euromoney and Elsevier. He is the creator and trainer of CM-Alliance’s flagship course, the NCSC-Certified Cyber Incident Planning and Response training. Amar also facilitates Cyber Management Alliance's highly successful Cyber Tabletop Exercises, apart from delivering specialised internal consultancy on Crisis Management, Incident Response Playbooks and Media Communications.
The CIPR course is the perfect stepping stone for those who want to understand the basics of cybersecurity, cyber resilience and for developing core competencies in planning, detecting and responding to a cyber-crime.
Not only is the course delivered by one of the most renowned cybersecurity trainers in the world, Amar Singh, it comes with a great reference material pack including worksheets, checklists, mind maps and free templates. It is the easiest and most effective way to enhance the efficiency and cyber-resiliency of your staff and make your business more compliant with data breach response regulations.