Are you prepared for a cyber incident?
It seems like a straightforward question. What do we do in the event of a cyber incident?
Cyber incidents take many forms. These can range from ransomware attacks, through to social engineering fraud, system failures and targeted hacking campaigns. All of these can have a major impact on an organisation and lead to financial losses and damage to brand and reputation. Being unprepared will make the impact worse.
The steps to become prepared for a cyber incident are enlightening for organisations and I often find that many aspects of a cyber incident plan will already be in place.
Key is ensuring that response stakeholders within an organisation have a clear plan, as simple as a “plan on a page,” that maps out the steps that should be taken.
A productive approach starts with an Incident Readiness Assessment that will immediately bring to light the issues that can arise when an incident happens and what measures the organisation should undertake to be well prepared. This does not have to be a lengthy and complicated process and will provide immediate clarity regarding roles and responsibilities when an incident occurs.
I have spoken with many organisations of different sizes and natures of operations about their incident preparedness, and most often the answer is that the IT team is responsible for management of any cyber incident.
When we consider financial loss and damage to brand and reputation, these impacts affect the entire organisation, As with other major risks they should be broken down and risk mitigation strategies developed and tested. Whilst the IT response to an incident is a critical component of an organisation’s response, there are other key responsibilities of leadership during an incident that need to be determined, clearly articulated and prepared for.
A few examples:
a) If a ransomware attack occurs and users cannot access data, a decision will need to be made as to whether to consider paying the ransom to recover the data or revert to the latest backup which will result in a loss of any changes made since the last backup. Ransomware attacks will cause a business interruption in any case, how severe depends on the existing backup and data recovery strategy and the steps that are taken immediately after an incident. Often 3rd party service providers will be involved. Leaders must make quick decisions regarding which actions to take to minimize business impact. The IT team will be busy establishing the impact of the incident and how to most effectively return the business to normal operations. A decision like paying the ransom (which has been proven to be very unpredictable and risky) and losing a day or several day’s work, rest firmly with senior management. Someone from the leadership team, empowered to make these kinds of decisions, must be available at any time to make the call. (2024 note, the board may need to make the decision to pay a ransom, best clarified with them before an incident!)
b) If an organisation experiences a data breach, the consequences can be extremely serious. Upon realising there has been a breach, The IT team and 3rd party service providers will work together to close down the breach, understand the impact and provide the necessary information about the data lost and those affected to management. Some important decisions will need to be made:
- Should we involve law enforcement?
- Do we have to notify those affected and the OAIC (Privacy Commissioner)
- How should we communicate the incident to employees, customers, the boards and shareholders?
Making the correct decisions in these situations is the only way to minimise the brand and reputation damage, as well as the financial impact, of a cyber incident.
Please contact us to discuss your preparedness for a cyber incident.
"Boards must pay attention" The Australian 9/9/2019
On October 9, 2019, The Australian released a “special report” liftout regarding cyber security. On the front page of the report was an excellent article by James Dunn that outlined the responsibilities of the board when it comes to cyber risk management.
He points out that boards have ultimate responsibility for cyber risk and that it is often left in the hands of IT to manage. This is due to the complex and specialised nature of cyber security.
The fact that this article was situated on the front page of the report points to the need for leadership of all sizes of organisations to place this communication gap higher on the agenda.
There is no question that cyber risk is one of the top concerning risks for all organisations. The fact that cyber incidents often lead to brand and reputation damage as well as breaching customer trust, makes cyber risk one of the top risks an organisation faces.
Let’s draw a parallel with a famous Australian action that is commonly known as the Centro case (2011.) From a summary by Clayton Utz:
“ASIC argued that Centro’s directors had breached their duties under sections 180 and 344 of the Corporations Act, because its 2007 annual accounts had not complied with the Corporations Act and the accounting standards…”
Also :
“…the directors’ argument was that they could not be held to have breached their duty through failure to notice an omission that had escaped the attention of both management and the auditors.”
Clearly, this case was regarding financial risk and not cyber risk, but there is already at least one action in Australia where the directors and officers may be held responsible for a breach of privacy as a result of a cyber incident. Claiming that they didn’t know they had a risk or understand the mitigation measures in place should not be a defense. This is a parallel to directors saying that they didn’t have the financial expertise to understand accounting reports when they signed off on them.
Whilst sufficient understanding of financial risk management is a core requirement for directors, the same cannot be said for cyber risk management. This is not due to a lack of interest, quite the contrary, however there is still a culture of IT teams owning these risks.
I have seen many detailed and well written cyber risk reports that clearly explain the risks to me as I have experience in conducting cyber risk assessments and what the issues mean when they arise. They would, however, be difficult to understand for someone unacquainted with the assessment process..
IT risk assessors should be presenting reports in plain language that can be understood by leaders outside of IT. Boards and leaders should also expect to see clear regular summaries of cyber risk management controls and incidents, so that they can understand them and articulate them as required.
Bridging this gap is a key focus of the CAP’s services. Please get in touch if you have any questions.
.