JULY 2024ENTERPRISE SECURITY| | 9PREPARING FOR CYBER-ATTACKSrapid containment actions give way to long-term projects to strengthen your IS. The people involved in the crisis management system may also change functions (steering, handover, stream leader, etc.).Whatever your organisation, you will need to define your priorities: my general management played its strategic role to the full. They decided which tenders were vital for the company and which strategic activities needed to be restarted. Within the operational crisis unit, our mission was to translate these priorities into application names, server numbers and back-ups to be restored.Each team stayed in its role, and we had a single objective: to maintain or restart the company's vital functions to enable it to survive.Our teams were organised into streams: a single objective and the right experts in the team. When the project was delivered, the Stream was disbanded, and the members were dispatched to other teams. There was no hierarchy to validate deliverables: only the crisis unit decided, validated and reorganised.In a cyber-crisis, you will always find the right tool to secure your system; you will almost always find the right consultants to strengthen you. But your colleagues: the men and women in the IT department and the business teams are invaluable. You need to take care of them: you can't do it alone, and without their commitment you won't solve the crisis.On a lighter note, unlimited coffee and real hot meals are good for the stomach. Sharing encouraging messages from management is good for the spirit.However, in a crisis organisation, all points of reference are swept away: no more team meetings, no more reviews of incidents or changes. You need to recreate a battle rhythm: organise new rituals during the day and new points of reference: the moment for sharing progress on streams, the moment to request exemption from new cybersecurity rules. Your colleagues will know what to do, how to do it and when to do it!To sum up, if you want to be in a position to manage a cyber-crisis situation effectively:1. Practice and be ready to react. You won't be able to prepare for every eventuality, but you know how to organise yourself to deal with it.2. Be agile and ready to change: you will undoubtedly make mistakes, so adapt.3. Don't go it alone. Cyber is a team sport, and this is even truer in times of crisis.4. Take care of others and take care of yourself! Everyone is useful and necessary in cyber crisis management! ESONE OF THE FIRST THINGS TO DO IN SUCH A CYBER-INCIDENT IS TO LAUNCH INVESTIGATIONS: THE FORENSICS
< Page 8 | Page 10 >