In this presentation, Matthew Rosenquist emphasizes that cybersecurity leaders must continuously integrate evolving global political crises—such as the recent Iran strikes and the ongoing Russia‑Ukraine war—into their corporate risk posture. He outlines three core risk domains—worker safety, operational continuity, and data integrity—including third‑party supply‑chain considerations. Rosenquist then proposes five concrete actions for leaders: (1) develop a collaborative, executive‑level risk assessment and recommendation set; (2) operate with heightened vigilance by expanding telemetry, accelerating patching, and tightening incident‑escalation processes; (3) prepare for worst‑case scenarios by updating incident‑response playbooks, confirming vendor contracts and backups, and conducting focused tabletop exercises covering limited/degraded operations, ambiguous “fog‑of‑war” conditions, and full compromise situations; (4) continuously monitor the geopolitical situation while safeguarding team morale and preventing burnout; and (5) keep senior leadership informed with brief, calm, and professional risk updates. The talk stresses ethical and legal duties to protect personnel, the need for rapid operational response to combined cyber‑kinetic attacks, and the importance of clear communication to maintain confidence during international conflicts.
Chapters
The recent attacks involving Iran in the Middle East are a good reminder that cybersecurity leadership must continually incorporate global politics into their risk posture and preparedness. Every crisis that elevates to military engagements between cyberactive participants changes the risk landscape of businesses for people, operations, and data. This includes the company and its suppliers, partners, and customers. Gaging the risk requires incorporation of factors that are vague at best, but understanding the enemy can provide a much clearer picture to help cybersecurity and executive leadership in making good decisions. Like the current Russian-Ukrainian war, the participants in the Iran strikes are very active in the cyber world. The US, Israel, and Iran all have significant cyber offensive capabilities. That when used may have direct or indirect consequences on enterprises, their critical infrastructures, and global trade. Corporate organizations, including cybersecurity, should conduct an open risk assessment that is updated as the situation develops. The outcomes should highlight recommendations to mitigate unacceptable risks of loss. The first concern should be for worker safety. There is an ethical and legal responsibility to make sure people are safe. It's just the right thing to do. So understand if any worker or their families are at risk of harm and take appropriate steps in alignment with corporate and government direction. The second is to understand the risk to operations. Cyberattacks, potentially in combination with kinetic damage, may have an impact to operations. So direct attacks against corporate assets or critical infrastructures that they depend upon, such as the electrical grid or communication networks, may cause interruption, damage, or instability of operations. Supply chain risks must also be included in assessments, as such attacks occurring against third-party suppliers and vendors can have material impacts. The last aspect is around the data. Kinetic damage is a risk, but most specifically, cyberattacks can have widespread impacts of disruption or destruction or corruption of business data. Again, third-party risks are also very relevant to that. Now, I recommend 5 steps to prepare and manage these risks. First, understand risks and collaboratively develop recommendations for business partners and executive review. Second, be safe, lead with focus and calm, operate cybersecurity functions with extra focus and attention, consider temporarily turning on more telemetry and logging, and explore accelerated patch patching and security operations incident escalation processes. Third, be prepared for the worst. Dust off the incident response playbooks for operations, crisis response, and recovery. Make sure they're up to date. Verify contact information, the roles and responsibilities. Now is the time to figure out that someone critical is on vacation and to then designate a backup. But make sure everything there in those playbooks work. You want to validate incident response and digital forensic vendor contracts and verify backups, the recovery capabilities, and those supporting processes to make sure they work. Take a new data snapshot if you can as well. That's not a bad idea. You really want to plan for 3 scenarios, and this is a great time for a quick tabletop walkthrough. Not a 2-day whole event, but something quick and dirty just to get everybody up on the same page, to elevate the consciousness and get everybody to kind of work as a team, realizing that they may be called in during heightened situations. So first, you want to address limited or degraded operation scenarios. Or data availability is not quite there, not trustworthy, or you've got a partial outage, right? Those kinds of things could be indicative of system exploitations or corruption or limited damage. And that should lead to acceleration for specific responses to limit the damage based upon the likely attackers and their intentions. And keep in mind, for situations like this, it's probably not going to be digital extortion ransomware. It's probably going to be damage, destruction, burning things down kinds of situations. So keep that in mind. The second scenario you want to roleplay is really about ambiguity. And believe it or not, this can be really stressful. It's kind of the fog of war situations where communications or telemetry are interrupted and they go down and dealing with that fear of unknown. Was it just the internet? Was it just the cloud service or are my systems actually destroyed? Data is down. You don't know. There's a window there of uncertainty. And do you wait? Do you respond? Do you engage failovers? And exactly what threshold should management then be informed? All those things should be answered in that tabletop. The third tabletop area is what happens when something is unavailable, damaged, compromised, something of that sort. And that should lead to rapid incident and crisis response activities. So walk through that process just so everybody understands their role, the responsibility, the timelines. Good decisions, what they're automatically authorized to do and what they're not. Very important. And for all these scenarios, understand the challenges. If specific people or services, let's say a cloud provider, are unavailable, then how do you respond? Who do you call? What do you do? How does that change your response time or intentions? Okay, the fourth thing you need to do is to monitor the situation. This isn't a one-time activity. It has to continually be assessed. So keep the teams calm, focused, healthy, and positive. Don't overwork people, especially in, in early phases. You're going to need their energy and focus if something bad really does happen. So don't overwork people unless an incident actually warrants it, because burnout is a real threat. And the fifth and last thing, update executive leadership of risk changes, impacts, preparedness, and future communication when it's appropriate. That really kind of keeps them well-informed and gives a certain amount of confidence to them. That the risks are being actively and professionally managed. Report-outs should be brief, meaningful, calm, and professional. Cybersecurity leadership plays an important role in crisis management for companies that rely on digital technology, vendors, online services, and global communications. Incorporate global political crisis events into the corporate cyber risk posture and showcase how the company can be prepared even for extreme situations like international warfare.
