Hackers vs. Heroes: Cybersecurity Crisis Response Leadership Best Practices and Worst Fails

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the best practices and absolute worst fails for cybersecurity crisis response leaders. And I get to talk with Lisa Forte today. And Lisa is a partner at Red Goat Security, a specialist in crisis response. And a renowned cybersecurity trainer for crisis management. Welcome, Lisa, and thank you for coming and talking with me.

Oh, thank you for having me. I'm excited.

All right, so, you know, everyone's favorite topic, right? Crisis. Nobody wants to be in it, but everybody realizes, yeah, they may actually have to be in those shoes. And it seems like more and more, organizations are kind of facing that conundrum of being thrown into an incident, not necessarily wanting to be there, but, you know, and that can morph into a really serious crisis going from something small to potentially something really, really big. Is this really the case or is this just perception because news are talking more about cybersecurity incidents?

Um, I think it's a bit of both. So cybersecurity incidents are going up. Ransomware, for example, uh, ransomware groups have had their best ever year and seem to have their best every year, year after year. So, uh, that's not great. Um, but also I think the problem that you have in a lot of organizations is that you can have an incident and then because you haven't planned for it and you haven't prepared for it and you haven't given that thought to what you would do you make terrible decisions. Those terrible decisions then have consequences, which then have consequences, which then have consequences. And so you very quickly end up in a downward spiral of bad decision-making, poorly thought-out decision-making that makes the initial attack so much worse for the organization. So things like comms, if you haven't planned out your comms and you put out really terrible comms statements, you're going to end up with litigation, you're going to end up with bad press, you're going to end up in the media in a way that you didn't foresee or want to happen. And, you know, I've seen this, a classic example. So I was running— so part of what I do when I'm not speaking is I run sort of crisis simulations and help companies develop that resilience. And in one client that I had, probably a year or so ago, we were talking about cyber incident, we were running through this exercise, and they completely took me by surprise. All of a sudden, the executives just said, "Pull the network offline, all of it." And I was sort of looking at them thinking, "Well, hold on a minute, like, we don't know yet. We've just seen some indicators of compromise. Like, we're not at that point yet." "No, pull it all offline now. Pull it all offline." So we go with the scenario, pull everything offline.

Well, the big red button. Okay, sure, go there first.

The big red button. Totally. And then they're wondering why they can't access any of the documentation they need, which are on the G drive, which is now not online. And they also don't have access to email. I also don't have access to all these other things. So, you know, a decision like that out of panic, that's fine in an exercise. It's not that funny when that happens in real life. And ultimately, as the CISO, if your execs say, no, this is what we're doing, that's what you're doing. So, offline.

So you can be your own worst enemy. You could take— you could actually exacerbate a small problem and turn it into a catastrophe just in the poor planning and preparation. And I love your example there. You know, what other kinds of little incidents, right? You know, phishing or, you know, you had mentioned maybe a small ransomware. Have you seen snowball maybe faster or become a much worse scenario because of that poor planning, preparation, or even execution on, on the crisis team side.

So a really great example of this, there was a charity in the United Kingdom, and this charity— so in the UK, we have what we call National Trust properties, which are sort of old properties that are maintained by this National Trust organization. And this charity maintained trees on these organization— on these areas of land, you know, really no sensitive data, not an awful lot of money, not an awful lot of critical assets. They got hit with a pretty minor cyber incident and something that wouldn't have made the news at all. But the CEO of this charity, in all their wisdom, decided to go out publicly and state that they had been under attack by sophisticated Russian state actors. And this statement that probably he thought was great suddenly attracted the news all over the UK and then international news that were making fun of this statement. And so this attack that probably— and obviously, you know, this is one element of it— they kind of would have gone under the radar and really nobody would have known from a PR perspective. You made a statement that's now put it smack bang on Twitter. Everyone's seeing it, everyone's commenting on it. People who didn't even know what your charity do— did now know what they do. And this is a classic example of, you know, not thinking things through and making a statement. And once you make any statement online, you'll know, that's it, it's out there. There's no retracting it. People will have screenshotted it. It's game over. So you need to have this thought process long before.

It's on the internet. You can never pull it back.

Yeah, you can't. You can't. So it's things like that, I think, that you can make things so much worse if you make a bad decision.

So when you look at the different sectors here, because you've used a couple different examples, do you see some sectors like healthcare or government or, you know, being more mature in this space than others? Is there some type of natural trend that companies start to realize they need to look at this and be prepared?

So I would say financial services really across the, the globe are very mature, or reasonably mature, let's say, in this space. But that's largely due to regulation. The regulators have mandated this be the case. I would also say companies in the pharmaceuticals business tend to be very, very good at security and resilience. Largely that came out of COVID and the increased threat that they faced during that. And then also, I would say, look at, although not in the cybersphere, look at aviation. So aviation is a great example of readiness and readiness culture, because for a long, long time, and although they're not necessarily the most mature in terms of cyber, if you look at any sort of air crash-related preparedness, they are almost the global world leaders of thinking through a crisis and how you're going to handle it. So again, If you swap out cyber for another crisis, you can start to borrow ideas from other sectors as well.

I like this idea, right? I mean, cyber crisis response is not something entirely new in greenfield. It has a lot of ties with other types of crisis management, whether it be, you know, World Health Organization, Red Cross, whether it be FAA and other highly regulatory fields. Do you see a lot of crossovers between those being adopted by, you know, crisis teams? Do, do they look and try and purposely cross-pollinate some of those best practices?

I think this comes down to a big problem that we have in cyber, which is often that the CISO will own the sort of business continuity management from a cyber perspective, which won't necessarily which should really almost sit with one business continuity team as opposed to with the CISO, arguably. I think the other issue that you have with cyber, which I think for a long time, maybe even still now, to be honest, people don't realize, is that cyber issues and cyber sort of breaches, they affect every part of operations. So when we think of a cyber attack, we instantly go to the data breach scenario and we think about what data do you have and is that breached. My experience though is that actually, although that's important, that's not as important as the business-critical services that operate digitally. So most, if not all, of our business functions are digital— digitally based, especially post-COVID. We're in the cloud, we're operating remotely, um, it's very heavily digitally driven. If your cybersecurity fails and you have a cyber attack, all of those business operations grind to a halt. So yes, you've got the data exfil, you've got the data breach concern for sure. Although that can be largely mitigated by certain things you can do. The sort of downfall of your business-critical systems, I think where people are realizing that actually everything we do could be stopped. And if it's stopped, how long can our business not operate? Because for every business everywhere in the world, there is a time limit for that. And once you reach that point, you're done. It doesn't matter, you know, for an investment bank, that will be hours. For a manufacturing company, that could be weeks. But ultimately, there's a point in time where your business, my business, everyone's business could no longer function and you'd have to throw in the towel.

Interesting. So, you know, when you go around the world and you talk with these different organizations and you come in and you, you, I assume you assess them and figure out, okay, you know, just really quick, are they top tier, are they mid-tier, are they low tier, are they completely dismal? What criteria do you use in the back of your mind just for that initial assessment to understand, okay, where do they sit on that scale?

Yeah. So, we do an assessment largely of their plans and playbooks first. And I can get a pretty good feel usually from the first call of where they sit. So if they're sort of asking me questions like they don't know who should sit on their crisis management team, I'm sort of thinking, okay, we're right at the bottom of this, this end of the spectrum, which is fine, you know, at least you're recognising that you need to build this capability. And then conversely, sometimes you have organisations, and I've seen this happen, they present you with these plans and playbooks that are just enormous. They're the size of a sort of book or a Bible almost. They're like this, and you're sitting there and you're reading through it. It's the most thorough document you've ever read in your life, beautifully written, beautifully referenced. But I know in a crisis, when you're panicking, you're not going to be able to do that. There's not a single checklist. It's completely unusable if you're in this sort of chaotic moment where you realize everything's going wrong. So again, you know, people sometimes think everything's set up and it's working really well, but unless you've tested that, you don't realize whether that's actually fit for purpose or not. And that's— I think there's a lot of organizations that probably overestimate their level of readiness. And then when you sit through an exercise, they think, ah, there's quite a lot of things missing here that we ought to maybe address.

So on the one hand, you've got the lack of preparedness, very little documentation, very little ownership. Um, you know, hierarchies, controls, uh, predictability. But then on the far end of the scale, you've got too much, right? During a crisis— and I've been in, I've led many of them, right— you can't be so prescriptive. Um, the situation never follows the script. It just doesn't, right? And you need instead somewhere in the middle where you've got a set of tools and capabilities that are well-oiled that you can reach out, grab, and turn on or implement very, very quickly. And that gives that crisis team the ability to be dynamic. And as they're being fed more information and getting more understanding and things are evolving, they can then use those tools to be able to address it in real time or near real time. So yeah, I guess, you know, poor planning versus overplanning and you want to be somewhere in the middle, I would assume.

And I think you also need to appreciate that, and this is especially true more of your executive teams, the people who aren't in cyber, so your CFO, CEOs, people like that, that they are going to have to make very, very critical decisions of almost no information. Because at the beginning, as you will, you will know, at the beginning of a crisis, you don't know. There's a lot of big question marks, but you still have to make decisions. And therein lies the really big the really big issue that you're going to have to make really critical decisions quickly based off of not an awful lot of information. So you have to actually get them to a point where they feel confident in knowing what the company does and what it looks like from a digital perspective so that they can make those decisions quickly and accurately. And if they— if you've done no cyber awareness with them and they have no idea what cybercrime is and what cybersecurity is, you are going to be in for a fun ride during that meeting because that's going to be hard.

Fun, fun. Your definition of fun is a little bit different than my definition of fun. Do you ever run into, and it's almost tough to ask this, do you ever run into organizations that seriously question you? Why do we even need this kind of crisis management? I mean, we haven't run into a big issue. You know, it's just networking. I mean, we've got an IT team. Fix it if something bad happens. Why should we spend all this time and energy in these, these, you know, tests and, and walkthroughs and table— why would we even do that, Lisa? Do you, do you run into organizations like this?

So usually the CISO is well aware. I have yet to encounter a CISO who honestly thinks that they don't need to prepare for a cyber attack. Maybe he or she exists, but I have not met that person. What I would say is the executives usually have that pushback initially. Within about 10 to 15 minutes of being in that exercise, they are full of concern, and they are the most receptive group of people to funding any project the CISO wants at that moment in time. I can tell you that if you have anything you want to push through, that's your moment, because they are incredibly receptive to not having this happen in reality. So no, I haven't had that, but what I have had is some interesting discussions, shall we say, that generally involve the general counsel, or if you've got general counsel within your, within your organisation. So typically the GC will have a place on the crisis management team, the sort of strategic management team, which is appropriate. And I've had a couple of organisations where I've really felt that that GC is pushing the limits of what we can get away with. So they're sort of saying things like, "Mm, you know what, I don't think we have to declare this to regulators yet 'cause we're not actually aware of an attack." And you're sort of looking at it and you're like, "Well, you've got ransomware splash screens all over your desktop, so I think you are." And they're like, "Well, no, hold on a minute. Hold on. Is that really attack? I don't know if that is." And you're sort of listening to this and you're thinking, "This only goes one way 'cause I have seen this play out and this does not go in a positive way." ever. If you try and hide that you've had a cyberattack, this does not end well. And anybody who's ever been on InfoSec Twitter will attest to the fact that this will not end well.

So, so, so let's then talk, because this is a perfect segue into some of the biggest mistakes that you've seen, right? You've touched on a few. One, if you don't have senior leadership buy-in, right? If you don't have that, you're not going to get resources. You're not going to get the time necessary to build all this or test it. Another one, which is my absolute favorite you mentioned, right? If, and I've seen this unfortunately, if legal or I'll even throw in marketing, if legal and/or marketing are leading your crisis response, you tend to get a completely different, very unfortunate outcome, a lot of which is in denial and hiding things and not necessarily communicating and trying to spin it and all sorts of bad things. So I've seen both of those happen. What other kind of big mistakes have you seen either in your experience that maybe didn't come to light or especially those that we have seen come to light very publicly, you know, where organizations just did not do the right thing for their customers or partners or so on? Suppliers.

I think we've seen some really good examples of, of some tragic what-not-to-dos, um, in the last year or so. So one of the classic examples— I'm not sure if they're so big in the US actually, but they are in the UK and Europe— is Capita, who are an absolutely enormous company. They provide lots of services into UK gov, into different European institutions. Huge, huge company. They had a cyber attack, and what they decided to do was talk— basically, they denied it at first. And I know a lot of this because some of my clients use Capita services for various different things. So all their services were down, and they decided to say that they was having some IT issues, nothing serious. That carried on, people started getting a bit more concerned. The ransomware group in question announced it on their blog. They was— Capita was still denying it, still saying that there was no cyber attack, no evidence of cyber attack. Okay, then what happens in the UK is because they are a, um, a listed company, so they're traded on the London Stock Exchange, they have to report this to the London Stock Exchange. So what they didn't know was that when they reported this, which they did, the London Stock Exchange publishes that breach notice on their website. So their com state— their com status was still, we're not attacked, we're not breached, everything's fine, it's an IT problem. They'd declared this to the London Stock Exchange, who posted it on the website, and everyone was like, hold on a minute, what's this? And that's got to be arguably the worst situation to be in, when you've literally denied hours beforehand that anything's happened, and yet there's this notification. Then they went down the route of saying that no data had been stolen. It turns out all of the data had been stolen, and so on and so forth. And this is where we went. And the interesting thing was, uh, one of their senior leadership team had come out during this exercise early on and decided it was wise, I presume, to make the statement that they were going to be seen as world-leading in incident response. And this was as this was playing out. And it was just absolutely terrible. And this comes back to your point, you know, whatever's going on behind the scenes in the cyber and tech teams, I'm sure was bang on. I'm sure they were doing everything they could. The problem was the comms that were going out did not match any level of honesty or transparency. And instead of that, then everything you said, even if it was true, people treated with skepticism and were thinking, "Eh, that's probably a lie." So, you sort of shoot yourself in the foot essentially then because if you're caught lying, that's the end of it.

Yeah. You've lost credibility at that point in time. Definitely. And then regulators start looking at you going, "Wait a second." And that's what we're seeing in the US with the SEC who governs all the publicly traded companies here in the US with their new rules that just came into effect. We're a little behind, but it just came into effect in December where people have to report it. That's intended to inform the shareholders of important things, meaningful events. But you start saying one thing where it's not true. And, you know, one that comes to mind here in the US, a password management company that I shall remain nameless, you know, kind of did the same thing where there was the breach and they said, no, there's no breach. Well, yeah, there is, right? And when all that information starts popping up, okay, well, there's a small breach. Right? And in the background, they know, they know, yes, it was an administrative account that was compromised and bad things are going on. And again, it's just, you know, the public and then the attackers and researchers are coming out with data and then the company has to admit, okay, yeah, yeah, yeah. Okay. There was, yes, it was sensitive. Okay. Yes, there were keys. Yes, our critical infrastructure.

Okay.

Yes, everybody's affected. Right? And at that point, this is a security company that you're supposed to be trusting with your credentials and passwords, and they're making at that crisis meetings, right? Which are happening probably hourly. They're making this decision. And I can just, and I wasn't in the room, but I just, I know what was going on. It was the legal and marketing team going, no, no, no, deny, admit, 'No, let's spin this. No, let's talk about how other companies are bad with passwords and not us.' And you're just— you're destroying— you're destroying your credibility.

So, and look, I think there's also a balance. Like, nobody is asking you to overshare. We're not asking you to come out and tell every little detail of what's going on until you verified it. That's fine, we get that. But you can't lie. You can't lie and you can't deny. You have to be honest. And yeah, be, you know, fine, be restrictive with what you put out. No one's asking for detailed sort of maps of your network and what's gone— that's fine. But you do need to have— and this comes back to planning. You see these organizations in this situation and they usually just don't know what to do. The ones that are really well prepared— and I'll give you an example of a company that did really, really well— is actually Ferrari. So they had a breach, and they've actually had quite a few breaches, which might be why they're so well prepared for this one, who knows. And they had a data breach and they handled it. The comms in that case was just masterful. They did such a good job. And I actually say to a lot of clients and, you know, when I'm talking and stuff, go and read the comms they put out because those statements were absolutely perfect and they did a really good job. So, you know, this information is out there. You can see the letter that got sent out to clients. Go download it, copy it, adapt it to your organization. Use it as a good template. It's not that you have to reinvent the wheel. There are some good examples out there. You've just got to plan and be ready for it and start putting those things in place first.

No, I agree. You know, the example I always use is, as a company that I respect in what they did during a crisis was actually FireEye. When, you know, they discovered the SolarWinds, right? They immediately came out and said, hey, we have a breach here, we're researching it, but we know there's a breach, standby, right? And that was very early on. They notified their customers and partners and they had spun 20, and I was talking with their CISO at the time, you know, they had a 24/7 crisis team working and the engineers and they had it all just working really, really well. And they were doing great communications out to their customers and partners. They were working with Microsoft. They had grabbed some code and they were tearing it apart and working with Microsoft and they brought in those partners. Hey, can you help us, right? Reverse engineer this code. And they were doing everything right behind the scenes because again, communication is kind of the tail end of this crisis response process. It isn't the heart of it. It's what you're communicating. But you know, FireEye did such a great job and they went back once they figured out, okay, it's actually SolarWinds. They went to SolarWinds immediately and said, hey, you know, we know what compromised us, it's this, we tore apart your code, sorry about that, but we found the problem. And it actually highlighted a fact that SolarWinds knew of these issues and then they were then forced to come public with them, even though this was like the third major company that had reported it to them, but FireEye did such a great job. So, you know, in communications, Again, I'm hearing that spectrum. Don't undercommunicate and certainly don't lie, right? But on the other hand, you don't wanna overcommunicate and provide way too many details. Yeah. I don't see this as often, but I have seen it in the past where companies come out and say, hey, we have an incident and it's the bad guys are taking advantage of this particular vulnerability and using this exploit And we're not fully patched yet. We'll be fully patched in, you know, 48 hours. And that just opens the door, right? Oh, really? That vulnerability is exploited? You're not prepared yet? Okay, a little overcommunication there.

They've accessed a system. Yeah, we believe the attackers have accessed a system that processes all our credit card information. End of communication statement. No, that's not good. That's not good. Don't say that. So yeah, there is definitely, you know, there's an oversharing thing that can happen as well. Um, I think the other side of it that you see is people saying, oh, we'll just say that they can't access credit card information, they haven't accessed this, they haven't accessed that. And sometimes people put out those statements and I'm like, wow, you worked that out very fast, or you haven't worked it out at all. It's one or the other, and I'm not sure which.

Okay, okay. I do want to get into a couple of other organizational kind of mistakes about, you know, these teams and how they operate. But before that, recently I saw another company, and again, it shall remain nameless, and they had basically a data breach, or they had a lot of the accounts breached, and they turned around and came back as part of their crisis response and said, it's not our problem, it's actually our users. Our users didn't secure their passwords. And even though we had a vast number of our clients and our accounts and our data, very sensitive health-related data, you know, get compromised, it's not our problem. It's really theirs. From a communications perspective, would you say that's a best practice to turn it around and blame your customers? Or what would you say?

I think that's probably never the best solution to start blaming the customers that you want sympathy from is probably a very, very difficult play in my opinion. But you see it with cloud a lot, actually. People who have been breached who try and put it on the cloud, and they say, well, it's actually them, it's their responsibility. And it's like, right, but it's your data that you've got and you've taken ownership of. They may have some responsibility, but you don't have none. And so, you know, again, it's, it's one of these things that I think you have to look at, at what you're saying. And I personally feel that all comm statements in an incident should not come under the heading of blaming anyone. Whether that's an internal person, an intern, your cloud provider, whoever it is. It's just not appropriate. It's not a good look. It doesn't make you look like you've got everything under control. It starts to look a bit desperate, to be honest.

I agree. I agree. If that's your focus, it means you have nothing tangible to say how you're dealing with this or how you're protecting or how you're responding. Or how you're on the side working very, very hard to protect your partners and your customers. And it seems very desperate, to be perfectly honest.

Yeah.

Okay, so other mistakes, and I guess the biggest ones in my mind, I mean, comms, that's very, very, very unfortunate. But what about the organization of the crisis team itself? Whether it's you don't have a structure, you don't have a means to communicate, or those wonderful plans are on the server and that's what's crashed, right? And the—

Well, you've taken it offline and—

Right, because you didn't decide to print it out in a binder, right? What are some, from an organization perspective, would you say are the biggest mistakes?

So, I think, Couple of that come to mind. So I used to be in the police in the UK, in the cybercrime unit here, and in the emergency services community in the UK, and this is something that a lot of other countries have adopted, we apply something called gold, silver, bronze structure to our crisis team. So gold is strategic, silver is tactical, and bronze is operational. So typically when I work with companies, I'm sort of maybe not calling them that, but that's the structure I'm basically implementing— strategic, tactical, and operational teams. To handle a crisis. Everyone's got their own role, they kind of feed back into each other. One of the biggest problems I see almost every single time is lack of deputies. So you'll have your CFO, for example, sitting in your gold team. There's no deputy finance person. So if this CFO happens to be on a plane, happens to have had an accident, or has left the organization, you have nobody to stand into that role. Same for HR, same for comms. Every single role that you have that's critical enough to be on that team needs to have a deputy who can step in, and that deputy has to be trained in the same way. They have to do the exercises, they have to have the same investment, because if your primary person isn't there, who is going to do that role? Because it's not the case that cyber attacks only happen on a convenient time on a Thursday. Like, that's not going to—

yeah, let's schedule those. Let's work with the attackers and schedule them.

Yeah, I mean, who knows? It's never going to be completely beyond the realms of possibility that that's where cybercrime goes, but it, it's not like that. And so I think that's the biggest problem that I see, that there's just no redundancy in anything. So it's like, well, like you said with the plans, yeah, we've got the plans, but we've got no hard copy of the plans. Okay, so if that goes wrong, you've got nothing. Email. If email goes down, how are you going to communicate to your staff? Do you have another platform? No. Okay, well, now you can't communicate to anyone. So at all points, it's thinking about redundancy. If this fails, what comes— backs it up? What do we do to fill that gap? Um, and this is where aviation and the space sector are really good, and there's lots of really cool ideas that you can borrow from those sectors. For example, in aviation or in the space sector, Any sort of flight-critical system has to have redundancy. If this fails, this process kicks in. If that fails, this process kicks in. That's the sort of mentality that you have to start thinking about, especially for your really critical business services and functions. How are we going to do this? Um, one of the examples, just quickly, I worked for a law firm and, um, they were one of my clients. They're a big international law firm. We were running some exercises for them and one thing we realized was One of their critical functions was the ability to submit court documents digitally. So I'm not sure how it's done in the US, but in the UK, it's all online. And there's deadlines, and these deadlines are not flexible. They're not, "Oh, we're having a cyberattack. Would you mind if we didn't submit the documents on time?" No, that's not okay. So we were talking with them, and we're like, "Okay, so if everything was down, you wouldn't be able to submit any court documents." So you'd miss deadlines, which means your clients would lose the ability to sue or whatever it was, which is a huge, huge problem for a law firm. So they actually had to write a process whereby lawyers could print off the documents, fill them in, and walk them down to the courthouse to submit them. How would you do that? It's that kind of thing that we're talking about. How are you going to do that if you have no digital estate at all? That's what you need to get out of this.

I love that concept of redundancy because it is so important. And you covered a couple different spots, right? You covered the redundancy of the people on the crisis team itself. Who's your primary? Who's your backup? Who covers while you're on vacation so you still have a primary and a backup, right? So there is a human element that is crucial in managing the crisis. Because there's certain expertise. Your lawyer doesn't know marketing, your marketing doesn't know, you know, technical operations, and your technical operations doesn't necessarily know cyber risk and all of these things. So you need to have that human redundancy. But then you also talked about process. Again, if your document is all on a server electronic, it's not printed out, and that goes down, right? Or you've got one process, we always send it via electronic electronic mail or FTP and that goes down, do you have a process for fax machine? You know, go to paper, print it out, walk it over there. And then the other aspect is that technology. You know, if email goes down, what's your secondary mode of communication, right? If the cell powers go down, can you actually communicate and call people in, right? And that's been a problem before. Great. Hey, we've got this great call tree, but the cell, cellular service went down. Now we can't get a hold of them. Right. And so, yeah, we've got all the process and the people are out there, but we can't actually communicate because the tools are down. So, you know, having that redundancy across people, across process, across technology to make sure that your crisis team can come together, they can understand what's going on, they can make decisions, and then they can act on those. To actually manage it. So I love this concept. What about— and this is one that I always hammer on— what about failures in leadership if you don't have well-trained or experienced incident commanders, right? Or, you know, well-trained section leads. You know, I can remember, and I did this at Intel, I was their first incident commander for the company. You know, the first couple times we assembled the team and my section leads were still trying to look in a manual and go, okay, what are my responsibilities? What do I do? What? Oh, I can call all these other people in. Yes, yes, yes, yes. Right. And so it took a little while, but without proper leadership, it seems like you can get a whole bunch of great people together and they just chat. They just talk, right?

And I think, I think for me, where this is the most evident is the chair. So I always advocate for each of the 3 teams that you have, you have a chairperson. Obviously, you have a deputy chair as well. Now, the problem often is the person on the strategic team that takes that role is usually the CEO or the CFO. And that's a kind of hierarchical decision more than it is personality. It's not always the best person because the, the issue is to lead that team, actually what you need is leadership skills under pressure, which is unique. And that may well be your comms person, could be HR, it could be facilities, it could be whoever. The, the roles in that team need to be personality-driven as well as role-driven. So yes, you need your CFO on your crisis team for sure, but he may not— he or she may not be the best person to chair that team and to run it and to organize it. And that's quite a difficult conversation to have because you've got to have it with some big personalities that think they ought to be the chair. Um, but I think sometimes when you're in the exercise, you're like, this is just not working. This person is just not— they're not managing this team correctly. One of the things I see happen a lot— so one of the things I sort of assess teams on is this ability to challenge decisions, because actually really good decision-making is when someone in the team goes, hold on, I disagree. I don't think this is going to work, and this is why. That's, that's actually a sign of a lot of maturity within that team. Um, what you often get though is you get this— so in, in aviation they call it a cockpit gradient, which is where the, the captain is really senior and the first officer is really new, and the, the latter can't feel like they can challenge the decisions of the captain. You get the same thing in a crisis management team. You get the very senior people and then the newer people perhaps who are less senior in that team feeling completely unable to say, this is a really bad decision, this is why. So often a job of the chair is to actually say, does anyone disagree? Do we have anybody who has any dissenting views and why? And sort of chair that sort of healthy decision-making. If you've got someone who wants to have their own way, that's fine so long as their own way is correct, but it won't always be correct, and that's where the problem comes.

So I'm going to say something controversial here, which is it's different than the structure that you've been talking about. I don't like other C-suite people in the core crisis team. Okay. And I've kicked off my CIO from my bridge and said, nope, nope, there is a process. You will be communicated right and at the right time with the right information and you can make certain decisions. But having those very strong personalities in there can often take a very wrong turn. And you're right, it can also really quash the ability from others to be able to say, "Hey, I think that's a bad idea." Nobody's going to tell the CIO in a crisis, "Hey Bob, hey Sally, that's a really bad idea." Nobody's going to do that, right? Tensions are already high. Everybody's already worried they're going to get fired. Right? And I really like the system where you have an incident commander, and there has to be a, a ton of forethought with that incident commander. There are certain goals. These are your goals, right? This is what your prioritization to accomplish is for any crisis, all right? And these are the list of things that you can do. You already have under your authority, once a crisis has been declared, you can do all of these things. And as part of the process, you're going to go through that. You're going to bring the right people together to make those decisions, to enact what you need to enact. And you're also going to obviously communicate typically on an hourly— we did it on an hourly basis— back to the executives. And the information you're giving to the executives is not the random data coming in or the partial data, right? You don't want to give that because that will definitely lead you down a wrong path. It is the sanitized version of that where you're helping to fill in the gaps or to let them know there are gaps, but to say, okay, this is a situation we have, this is what we think, this is what we're going to, this is the goals that we're achieving, this is what we've already done, you know, we believe we're on track, this is— but it's more of an informative and a directional check for the executives, but they have to have faith. They have to have faith and confidence in the crisis team to be able to manage that and understand what they know and what they don't know. And in that scenario, that has always worked well. I'm telling you, if you've got that kind of structure that's mature and the confidence from the executives, they know they're gonna be communicated, they know they can set different directions if need be. But when that incident commander comes in with the comms person and say, okay, this is what we have, this is what's going on, this is our process. It tends to work better. I can't even imagine having a CEO or CIO join that bridge with the incident commander who has partial information and knows they have partial information, right? Knows it's gonna be coming. It takes time, right, to get some of the, okay, well, how many systems are vulnerable? Where are they at? It takes time. And I would not want those executives to automatically make a knee-jerk reaction and a decision, a directional decision at that point. Am I completely off the wall here? Am I? Tell me I'm crazy.

I don't know. I think I've seen it work in both ways. It very much depends on the organization. It depends on the personalities. It depends how much training they've had. I've seen some CEOs and CFOs make great decisions who are really great at triaging facts and brilliant. I've seen some awful ones. I've seen some absolutely awful tactical teams. I've seen, you know, I've seen it all. So it very much depends on your organization and the culture of it. And in fact, I'd say that there's a lot of organizations where you'd never be able to have that conversation because they would say, no, this is what we're doing. So again, it just really depends on, on your organization and the culture within it and how you manage it. But the key thing to take away from it is you need— they need to understand what their roles and responsibilities are. And they also need a good leader of that team. And that person isn't always a specific role. It's a personality-driven thing.

Yeah, I agree. Okay. So other best practices, what should these organizations be aspiring to when they look at their crisis team or potential crisis response team? What are those things they should, they should have in their mind?

I think you just need to make sure that you have good plans and playbooks. I would say You need plans and playbooks for specific threats. I've seen general cyber attack playbooks. I personally think they're rather useless. There's a massive difference between the response to a ransomware attack and the response to a DDoS attack. They're not the same. So if you have a playbook that supposedly covers everything, it's probably just good for nothing. So I would say you need that. You need checklists. And this is especially true with your execs and your strategic team because they're not cyber people. They're not techies. So you need to have checklists that are really obvious for them, that are written in a way that they can understand, written in business language. And you need to make sure that whoever's briefing those teams understands they're not cyber people. Don't use acronyms, don't use the term TAs or IOCs. They don't know what that is. Tell them what it means, explain it. And it seems so obvious, but it doesn't happen. And there's this sort of, um, this disconnect that happens. And then you're expecting someone to make a really good decision on acronyms they don't understand. If someone came to me from the nuclear science world and started using words and acronyms and then said, Lisa, you need to make a critical decision on this now, which one? And I'm like, I don't know, that one maybe, I don't know. Like, it wouldn't be a good decision. Blue!

I like blue! Let's go with that. Yes!

Blue, I guess. I don't know. So it just wouldn't be a good decision. So you've got to set them up to win. You really have. And that means you need to give them the tools, the training, the checklists to do that because they're not going to be able to make brilliant cyber decisions with no information.

What about that next step beyond the checklist as a, you know, setting things up in advance, if you will? And I'm thinking more capability. So you know, in your vulnerability playbook, right? You're definitely, if you're IT, you're going to be asked, "Hey, do a scan and, you know, we need a list of all systems that are vulnerable, right, to this attack or this exploit." You know you're going to ask your IT department to go look that up, maybe in partnership with the SOC. You know, it's great to have, okay, I'm going to be asking you, but if they actually don't have a tool that can do that, or they don't know how to access it, or they don't know how to write the script to look for specific indicators. It's great that you've asked them. And now in a crisis, they're scratching their head thinking, how do I accomplish this? Wouldn't it really be nice to give them that checklist ahead of time and go, hey, in the future, when something bad happens and there's a system vulnerability, I'm going to ask for this. So develop a tool, a process, a capability, make sure people are trained. So when I ask for this, You can turn this around in 35 minutes, right? Or an hour.

Exactly.

Instead of come up with something or go start, you know, browsing vendor web pages to see what you can potentially install, right? That doesn't work. So there's got to be that next layer down. Wouldn't you agree?

Yeah. And I think that's where exercising comes in because you run the exercise, you realize, ah, we haven't got that. Ah, we don't have this. Ah, they're going to ask for that. Okay. And this also extends beyond sort of technical tooling to things like your insurance policy. The number of exercises I've run, no one knows what their insurance policy even says. They don't know when they need to notify the insurer. They don't know what sort of coverage they have, what they have to do. Same thing for like bringing in external legal counsel, bringing in external PR support, forensic support. Have you onboarded these people? Yeah, probably. Well, you know, have you or not? It's binary. It's yes or no. You haven't, probably onboarding someone.

Go and how do you engage them?

How do you engage them? How long is it until boots on the ground, until someone actually comes to help you? Understand this because this matters. And one of the— one thing that comes up time and time again, especially with ransomware, is backups. The executives and the people on the strategic team believe that somewhere in the cyber office there is this button and you press the button and you restore from backup and everything's fine. And that's because for years they've been told that. They've been told, oh, we've got backups, it's fine, we've got backups, it's fine. So understandably they're thinking, well, we've got backups, it's fine, that's what we've been told for years. Oh, that's going to take 2 months. Well, that changes a lot for a business. So do they understand what— firstly, have you assessed what your limitations of your backups are? How long will it take you to restore, do a complete restore? And do the executives understand that? Because actually everything has its limitations. And one thing we're guilty of in cyber is we kind of try and sell things a little bit as a silver bullet, and we're like, well, look, it's fine because we've got this. We're sort of sewing ourselves into a trap there because they now believe this is this catch-all bullet that solves everything. So you have to make sure that, that— and, and to be fair to the executives, if I thought they genuinely— there was a button that just restored everything, the decisions I made would be very different to the ones if I didn't think that button existed. So you've got to make sure that whatever they're thinking and they're making their decisions based off of is reality, whether that's good or bad. And if you have to make those backups better, then that's what you have to focus on. But let's be more realistic.

Yeah, and this is a great example because there's a lot of nuance around that. And IT does say, oh yeah, we've got backups. Okay, let's tear that down a little bit. How long does it take to back up one PC, one server? That, that's one thing. What about a cluster of them? What about your entire infrastructure, right? Those are different time frames. Oh well, we can restore a backup of your laptop in an hour. Hey, that, that's That's pretty good. What about if I ask for 20 laptops? Oh, well, that's 20 hours. Well, whoa, wait a second. That doesn't scale, right?

Yeah.

And what happens if your backup server is the one that's on the subnet that went down? Oh yeah, we can't do any backups then until we get— Oh, okay. And let's also talk about failures of backups because just because you have a good backup doesn't mean you're actually going to be able to restore it. There will be a percentage that fails. I had one IT manager during a crisis, okay, we need to backup or restore from backup on these servers, and they couldn't. And they couldn't do it. And I said, wait a second, we have bad backups? And the backup person stood up and said, no, our backups are great. We only have a restore problem. And I said, that's a differentiation that does not matter, right? Okay, that's great. You get an A and they get an F, but we still go down. Okay, no, we're in this together. If you can't back up and restore, it doesn't matter, people. Stop differentiating this. It's about an overall capability. And a lot of times until you actually get into that scenario, And you believe you've drank the Kool-Aid. Oh, we've got great backups. We've got great backups. That doesn't necessarily mean you're going to be able to restore. Right. And when they turn around and come back and go, yeah, yeah, we can do a restore. It's only going to take 3 months.

Okay.

That's about 2.5 months longer than this company will be in operation.

Yeah.

Right. Yeah.

So, and you see that as well. The other thing, the other time you see that exact mentality is with DDoS attacks. And I've had loads of clients where I've spoken to people in the IT team, oh no, well, we've got DDoS protection, so we're fine. We don't need a playbook for DDoS. I'm like, okay, well, Killnet and Anonymous Sudan have taken down Microsoft. They've taken down numerous EU financial institutions. They're pretty good. And they all had DDoS protection. I would think Microsoft would have DDoS protection. I could be wrong, but I'm pretty sure they're gonna have some good stuff. So it's not an argument that we've got this thing, so we're fine. Anytime you see yourself or hear yourself making that argument, I would say to you, stop, check yourself. That's a big vulnerability, because if you think you've got something that is 100% foolproof coverage, everything, you are in big trouble.

Yeah, and we've seen attackers know, okay, you've got data backups, you've got DDoS protection, they go after those too, right? I've seen an attack go after data that was actually in cold storage, tapes sitting in there and able to do it. It was amazing. We can talk about this. They created a network shim. And so actually when the data was being backed up, it was being encrypted and decrypted and with their private keys and fun, fun stuff. But the attackers are not stupid. Right? They are in many cases as savvy or more savvy than you, and they may actually know more about your network at the point that they decide to attack. It's scary to think that, oh no, they don't know our network. No, they've probably spent a lot of time looking at it, right? And if they're, you're a big player and they're gonna come after you for $40 or $100 million, yeah, they're gonna have backdoors, they're gonna have their contingency plans, they're gonna go after your backups, they're gonna make sure that your typical response plans aren't going to work. Yeah, 100%.

Because where are your response plans? They're on your network. Yeah. So they've probably found them.

They've read your response plans before you have, more recently than you have. Maybe they've even modified them. Who knows? Okay. So the ugliest topic that I've ever had to deal with, especially with crisis management, cyber crisis management, was the discussion that when something bad happens, and we tend to get activated when something bad— you don't have a root cause, but you know things are going down, bad things are happening, and that's when crisis gets called and you're assessing it. The ugliest conversation and mentality change that I've ever had to deal with was talking with people and going to my team and going, tell me if this is an insider. Because of course, nobody in the company would do something bad. It can't be one of us. It's gotta only be an external bad person in a hoodie. You know, you've seen them on the internet. It's only them. It can't be an insider. And just changing that mindset took so long that yes, disgruntled employees, untrained employees may hit that red button accidentally.

Right.

But do you see that as an open discussion with modern-day cyber crisis teams, that they are actively looking at root cause being an insider or an insider being somehow an either knowingly or unknowingly participant as part of the root cause?

So I would very much differentiate. I've always been very sort of um, adamant on this, that there's a massive difference between someone who clicks on a phishing link and someone who creates an admin account, sells on the dark web. The former is not an insider. The former is just someone who's made a mistake. So if you start labeling them insiders, that's toxic. So, um, US-CERT actually, they actually specify 3 types of insider. They have fraud, theft, and sabotage. Sabotage happens largely within cybersecurity teams and tech teams because you have the ability to sabotage an organization due to your job role. Fraud tends to happen with low-level admin data entry roles, and theft tends to happen with people who handle intellectual property for the most part, or that kind of business-sensitive information.

Yeah, financial.

Totally. It's very, very difficult as a threat to manage. Um, there are— there's a— we could do a whole other podcast, maybe this is something to do another time, on insiders, because there's tons of really good information on it.

Yes.

But I think the, the takeaway from a crisis management perspective is it's pretty much your worst nightmare because from a comms perspective, from a PR perspective, this is going to look absolutely awful. And it's— there's no ifs or buts about it. That's the reality. It's much better to be attacked by this sort of faceless adversary that lives far away than it is to have someone who you allegedly vetted and worked with and gave access to compromise the organization. However, we are seeing this happen with increasing frequency, especially in the United States. With issues regarding China and other countries that maybe have an interest, especially in the manufacturing processes and so on and so forth within the US. But even within Europe, we're seeing this go up. So in the United Kingdom, MI5, which are one of our intelligence agencies over here, they, along with another organization, actually created an app that you can download. I'm not sure if you can get it on the US App Store, but you can in Europe. Um, which trains you to look for sort of odd profiles on LinkedIn and things like that who might be offering you money to sell your login details and stuff like that. So it's a huge problem. If you're not considering this when you are triaging an incident, I think you're making a big mistake because we have seen an uptick in it, especially with ransomware groups, for instance, contacting people and offering them very sizable sums of money to sell their login credentials or to click accept on the MFA app, things like that, right? And we're in a time now where, you know, times are hard for a lot of people around the world. There's layoffs, there's cost of living crises that are happening all over the place. If someone offers you $100,000 to give your username and password and click accept on an app That's gonna be tempting for a lot of people, especially in places like the lead-up to Christmas and things like that where it's even worse. So I think you've got to accept that times have changed and it's not about changing the culture of your organization to be suspicious, but in a crisis, I think you've got to have those awkward conversations of, is there any way this could have come from the inside? And I think that has to happen with HR because HR I'm presuming you call them HR in the US as well. They typically would have a lot of information about what you can and cannot say, what you can and cannot question these people, because it's not the case that you can just go and do whatever you want. You can't march around to someone's house. So I think, again, you need to have these conversations and again, have these playbooks, because what do you do? Who do you contact? Who's the HR person? How do we have the conversation?

And it's not just, you know, your employees. It could be a trusted vendor. That's an insider as well, right? You've given them credentials. And if somebody is malicious or intentionally malicious, that can undermine your ability to get ahead and recover and get where you want to be. Okay. Last question.

Especially if they're on your team and they're seeing your response.

I've never had that. I've never had an insider on my crisis team, but I can only imagine. Okay, so last question. How do you think if we roll time forward, how do you think customer sentiment and regulatory expectations are really gonna change around this space, around crisis response for companies and organizations?

I think that customer base has, we typically used to argue that if you had a cyber attack, you would lose customers, you would lose market share. That hasn't typically been evidenced. We haven't seen a lot of evidence of that. Troy Hunt actually argues that he would rather be a client of a customer that's had a cyber attack, been through it, learned from it, than one that's never had one. And actually, it's quite an interesting point because certainly, you know, that company's gone, oh, we need to improve on this, we need to do this, we need to do that. There's a chance that the others are being a bit complacent, possibly. And I think in terms of regulators, it's a difficult one. I think there is increasing regulation on a number of things. I still think globally supply chain due diligence is really poor and the regulation of that supply chain is really poor. There are some big steps in the EU to change that. There's a regulation called DORA which is coming in for the financial services Services sector in the EU, which is about resilience of your supply chain. But it's a first step. And I think the problem we have now is that for a lot of organizations, they don't know what their supply chain looks like. They don't know what their resilience is. They don't know how much access they have or what they're doing. You're basically flying blind and hoping that somehow you found the airport.

Well, you know, properly managing these cybersecurity crisis events, you know, it's just becoming more important as we're embracing digital technology and it has such an impact. And every significant attack is showing that, yeah, it can be a problem. We have to— we see the difference between organizations that are not prepared and that are. So Lisa, thank you so much for sharing your insights today.

Loved it. Thanks for having me. It was really good fun.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Lisa here to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.