Hope for the Best; Plan for the Worst

Author: Rob Black

This past Saturday was a big day for the Black Family – my 13-year-old son had his Bar Mitzvah.

He read from the Torah (in Hebrew!) and gave a speech on the meaning of his Torah portion (okay, that part was in English). He did it all beautifully and we were extremely proud of him.

Mrs. Black, ever the event planner, oversaw a picture-perfect weekend of elegant meals, well-executed parties, and flawless guest management. She coordinated the rehearsal details with the rabbi and cantor, stayed in close communication with the party MC, and made sure our friends and family – and us too! – had an amazing time from start to finish.

There was just one mishap…

It occurred during the Hora, a traditional Jewish circle dance typically performed at festive events during which the guest of honor – and his tentative parents – are hoisted into the air on chairs by the exuberant crowd.

The problem was that the chairs in question were somewhat flimsy and the seat cushions were not well attached. Fortunately, and thanks to the attention of the chair holders and the forearm strength of the Black family, we managed to stay airborne throughout the dance and landed safely without incident.

That one hiccup aside, the Bar Mitzvah was a resounding success!

Cybersecurity Requires Planning and Preparation

While there is admittedly less dancing involved, a robust cybersecurity program likewise depends on a well-organized mix of preparation, forethought, and rehearsal. Because here as well, once in a while, bad things happen.

With that in mind, here are three areas worth focusing on…

#1. Incident Response Planning

Like a skilled improviser (or Hora dancer), a strong incident response plan doesn’t stick to a pre-set formula.

No two situations are exactly alike; on any given day, challenges may include ransomware, phishing attacks, wire transfer fraud, or entirely new threats. It’s important to develop an adaptable plan that can perform based on whatever arises.

What you do know for sure is that certain response resources will be valuable, regardless of the specifics. This includes things such as the technical team, communication team, legal team, regular meetings, thorough documentation, and the training of key participants.

I also recommend the development of customized reference materials specific to your business. These might include notes, checklists, and reminders to make sure critical steps occur during a response (e.g., using vetted vendors, contacting your cyber insurance company).

Preparing all of this in advance is especially important. You will need to act quickly and that’s not the moment to be scrambling or weighing options for the first time.

If your organization has fewer than about 250 people, you probably don’t have the resources to create an exhaustive manual covering every possible scenario. That’s fine. Smaller companies should aim for more generalized plans, staying flexible while making sure not to overlook anything significant.

#2 Cyber Insurance

The primary purpose of cyber insurance, of course, is risk transfer. You don’t want to bear the entire financial burden of a bad event, so you buy insurance as a hedge against something unexpected and significant.

What’s less obvious are the risk mitigation benefits that cyber insurance provides. Just as a business insurance inspector might check to make sure a building has adequate fire doors, proper lighting, and safe walkways, cyber insurance companies ask lots of questions to make sure your protections – employee training, software patching, documentation, etc. – are up to par.

Large company CISOs may spend an entire day each year with their cyber insurance underwriters, just to get coverage. (For small and medium businesses, it is usually just a form that you fill out.)

Remember, your insurer doesn’t want a bad incident to occur either. They can add a lot to your preparedness by providing things such as…

A score of your outward-facing infrastructure regarding its degree of protection.
A list of “panel providers” to be used for incident remediation in the event it occurs.
A list of law firms that specialize in incident response. Typically, these are who the insurer will have you call should you have an incident.

Take advantage of your insurer’s perspective, experience, and resources.

(Note: Make sure to include your cyber insurance details in your incident response plan.)

#3. Tabletop Exercises

These drills are a valuable, risk-free way to test and refine your incident response plan before a real crisis occurs.

Start by developing a range of hypothetical scenarios, such as a data breach, ransomware attack, or network intrusion. Then, assemble your team and engage in a role-playing session during which they will use the incident response plan to navigate the various scenarios.

While it’s only a simulation, going through the communication, decision-making, and problem-solving steps involved will shine a light on gaps or weaknesses that need to be corrected. Plus, it’s a terrific way to enhance the team’s sense of preparedness and coordination, something that will be critical if a real-world response is needed.

Pay Now, or Pay Later

Planning for future events that may never happen can sometimes feel like a burden.

But believe me, taking steps to ensure you’ve got these things in place and up to date can save you a world of hurt should you ever find yourself the victim of an attack.

Speaking of which, I should probably start thinking about my daughter’s Bat Mitzvah – it’s only two years away and we need to order some sturdier chairs this time.

Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.

Rob Black, CISSP

Rob founded Fractional CISO in 2017 and has helped dozens of companies improve their security posture as a vCISO. He consults, speaks, and writes on IoT and security. Rob has held product security and corporate security leadership positions at PTC ThingWorx, Axeda and RSA Security. He received his MBA from the Kellogg School of Management and holds two Bachelor of Science degrees from Washington University in St. Louis in Computer Science and System Science and Engineering. He is also a Certified Information Systems Security Professional (CISSP).