General Preparation

Proactive Cyber Crisis Management: Building Organizational Resilience

Preparation is paramount in managing a cyber crisis. Organizations must anticipate significant incidents and establish a comprehensive strategy to ensure swift and effective response. This involves preparing resources, establishing secure communication channels, reviewing insurance coverage, and fostering key partnerships.

---

1. Resource Inventory

Maintaining an updated inventory of both technical resources and personnel is essential for efficient crisis response.

Key Questions to Address

• Personnel Availability:

  • Do you have a dedicated Incident Response Team (IRT)?

  • Are backup personnel identified in case of unavailability?

• Training Level:

  • Are your team members certified and adequately trained to handle cyber crises?

  • Do they regularly participate in simulations or tabletop exercises?

• On-Call Requirements:

  • Are there any travel constraints or specialized access permissions required for team members?

  • Is there a 24/7 on-call schedule to ensure rapid response?

---

2. Communication Channels

In the event of a breach, standard communication systems may be compromised. Organizations must establish secure, independent channels for internal and external communication.

Secure Channels to Consider

• Encrypted Email Services:

  • Ensure emails remain confidential and tamper-proof.

• Secure Messaging Applications:

  • Examples: Signal, WhatsApp for Business.

  • These platforms offer encrypted messaging for real-time coordination.

• Dedicated Crisis Communication Platforms:

  • Platforms like Slack Emergency Channels or custom-built solutions for crisis management.

---

3. Insurance Review

Cyber insurance helps mitigate financial risks. However, organizations must fully understand the scope and limitations of their coverage.

Critical Coverage Questions

• Are You Protected?

  • Does your policy specifically cover cyber incidents such as data breaches, ransomware, and DDoS attacks?

• Maximum Support Available:

  • What costs are covered?

    • Ransom Payments

    • System Restoration

    • Legal and Regulatory Fines

  • Are costs for operational improvements or additional personnel included?

• Dedicated Response Agent:

  • Will a dedicated representative from the insurance provider be available to assist during the crisis?

---

4. Partnerships and Third-Party Assistance

External partners such as Managed Security Service Providers (MSSPs) or Incident Response (IR) firms can play a pivotal role during a cyber crisis.

Key Preparations

• Predefined Agreements:

  • Establish clear contracts with service-level agreements (SLAs) for rapid response.

• Escalation Procedures:

  • Define escalation paths for involving third parties during different levels of crises.

• Ongoing Collaboration:

  • Ensure regular engagement with partners to maintain readiness and improve response capabilities.

---

By addressing these critical components, organizations can enhance their resilience and ensure a coordinated response during a cyber crisis. Preparation minimizes uncertainty, enables swift mobilization of resources, and helps maintain trust with stakeholders.

Key Takeaways:

• Maintain a robust Resource Inventory to ensure readiness.

• Set up secure, independent Communication Channels.

• Conduct a thorough Insurance Review to understand coverage limitations.

• Foster strong Partnerships with external security providers.

These steps form the foundation for a proactive and effective crisis management strategy.