Responding to Cyber Crisis in a Novel Way

Business leaders must be prepared for anything that may affect the economy, including a global pandemic. Their ability to adapt is just as vital as their leadership skill. While most leaders are focused on preparing for the “worst-case” scenario in the broader business environment, the chief information security officer (CISO) shoulders a huge chunk of the responsibility for protecting customer and partner data.

According to a 2020 report from Navisite, even after the pandemic restrictions are lifted, 83% of C-level executives and IT professionals expect to continue with remote work guidelines.

Many executive leaders, particularly CISOs, have had to rethink their strategy to secure their organizations, including how cyber crisis training is conducted.

Previously, teams would gather in a room to practice crisis exercises and responses. However, in the new world of fully remote workforces, this traditional strategy simply does not work, leaving teams unprepared and exposed when a true crisis strikes. Despite the fact that many security precautions have been put in place to protect crucial information across the expanding attack surface this year, CISOs are unable to address how they will tackle cyber crisis training today and in the future.

Also Check: Introducing the TOUGHBOOK S1 Developed to deliver all the features you want, and all the rugged you need

The current cyber crisis should not be neglected

The new risks that businesses face today are significant, and they cannot be categorized using previous attack strategies and responses. The need for a modern alternative to out-of-date, irregular table-top exercises has always existed; the pandemic has just heightened the urgency.

The move to a distributed workforce, along with the advent of modern cyber threats, the repercussions of inadequate crisis response training have become more costly. Large corporations are disproportionately impacted.

According to an IBM 2020 research report on the subject, the cost of a breach is amplified by so-called “mega breaches.” Breach costs of one million to ten million records are more than 25 times higher than the average. A trend toward destructive attacks with the ability to grind operations to a standstill amplifies this increase in impact. Customer turnover, lost revenue, reputation damage, and system downtime contribute to 40% of the average total impact of a data breach, hence cyber crisis response plans need to be prioritized.

Not just security teams, but the entire company should be trained

When it comes to preparing their firms for a real cyber crisis, CISOs need to adopt a holistic approach. Organizations can build a unified response to a breach by going beyond the security team and training multiple departments. When crisis response is viewed as a strategic business issue rather than a technical one, improved information sharing across legal, communications, and finance teams occurs, ensuring that all stakeholders are aware of the financial implications of a breach.

According to Osterman Research’s 2020 survey of 400 CISOs, table-topping is failing, with 40% admitting to having little confidence in response teams. And if tabletop exercises were conducted, communications teams (80%) and customer service teams (87%) were frequently omitted. This leaves substantial gaps in a modern cyber crisis response, which is an all-consuming brand and customer issue.

Also Read: Future of Security Lies in Quantum Technology

Regularity and punctuality are essential

The only way to guarantee that the company is prepared when a true crisis strikes is to ensure that crisis response training is current and reflects the modern threat landscape. Another important aspect of improving the organization’s crisis response skills is to practice them on a regular basis.

Given the rate at which new threats emerge, it is evident that a change is required. For instance, if an organization’s most recent crisis response exercises were held in November 2019, it would now be well behind the curve in terms of the lessons gained from the slew of cybersecurity incidents that have occurred so far in 2020. Keeping up with attackers is critical for keeping the company safe, secure, and prepared for the worst.