Savvy organisations understand that security breaches are an inevitability. They know that it’s no longer a question of “if” but rather “when”, and even “how often”. This is why having a well-prepared incident response plan in place is key to business survival.
Digital transformation has changed our lives dramatically and brought about many innovations and efficiencies. It has changed the way we do business, helped companies to become far more agile and has introduced new revenue streams.
Unfortunately, it has also ushered in a lot more risk, and as such, incident response plans need to adapt accordingly. Yesterday’s tools are no longer effective, and in the same way that everyone updates security at their homes and has moved past using a gorilla lock to secure their vehicles, cybersecurity needs to adapt too.
The art of cyber war
Today’s attackers are highly advanced. They have grown in sophistication as well as the speed at which they can attack. They are well-funded, particularly those with nation-state backing, and are more determined than ever. What we see now is a constant war between defenders and attackers, and too often, defenders are playing a catch-up game.
The great Chinese war general Sun Tzu said in his book, The Art of War: “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”
The cybersecurity industry can take a leaf out of this philosophy to help bolster preparedness in its defence systems and mechanisms. If we have visibility into what needs protecting, visibility into our weaknesses, and visibility into our adversaries, we can limit the blast radius, as it were, and mitigate the damage in the event of a breach.
People, processes, technology
It is also important to note that incident response is not just about technology, although understanding the tools that the business has in its cyber arsenal is an important part of incident response. It is about people, processes, and tools.
It establishes who is responsible for which actions in the event of a breach and ensures that all stakeholders understand the processes in place to mitigate the fallout.
One of the things that we have found is that although a lot of organisations have incident response plans in place, too few of them test and rehearse these plans. In fact, not too long ago a customer asked us for help with strengthening and reviewing their incident response plan.
Although the plan was documented, it contained way too much content and was packed with out-of-date information that had not been reviewed in years.
We did what is known in the cyber world as a tabletop exercise: an activity that involves testing the processes outlined in an incident response plan. We get all parties around a table and run an attack simulation to ensure incident response team members understand their roles and responsibilities, and whether these are adequate as a response to a given attack scenario.
These exercises are not only aimed at the propeller heads or technical resources. The incident response team needs to include top executives as well as the chief communications officer, for example, to communicate with the media and other stakeholders in the event of a breach and to manage market sentiment.
The team needs to be looked at holistically, with incident response a combination of people and processes, and then tooling on top of that, as it helps businesses to strengthen their posture. This is particularly key, given how the digital attack surface has expanded alongside digital transformation. We have to implement new ways of protecting our attack surfaces.
Augmenting human intervention
Concurrently, we have also seen some key advances in technology out there. For example, one of the biggest buzzwords we hear today is artificial intelligence, and we need to consider how to augment human intervention with some of these amazing tools because we do have massive gaps in skills.
The enormous deficit in cybersecurity skills has been well documented and it is far from a South African problem alone – it’s a global problem. We need to use every advanced method and mechanism at our disposal to shore up our defences, while still bearing the human factor in mind.
Unfortunately, incident response can be very overwhelming, because while we are all in the same storm, we are not all in the same boat. For the most part, the largest corporates have clearly defined incident response teams. These might be made up of an incident manager, a communications manager, an AI forensics investigator and many others. However, most companies, especially smaller entities, don’t have these resources.
Elevating the internal team
Fortunately, smaller businesses can reach out to external parties to assist them with these competencies, whether people or technologies.
Outsourcing incident response to a trusted partner is a highly effective way to elevate the internal security team, using highly skilled external experts who can help the business respond to cyberattacks, mitigate the impact and recover more rapidly.
About CYBER1 Solutions
CYBER1 Solutions is a cybersecurity specialist operating in Southern Africa, East and West Africa, Dubai and Europe.
Our solutions deliver information security, IT risk management, fraud detection, governance and compliance, and a full range of managed services. We also provide bespoke security services across the spectrum, with a portfolio that ranges from the formulation of our customers’ security strategies to the daily operation of endpoint security solutions. To do this, we partner with world-leading security vendors to deliver cutting-edge technologies augmented by our wide range of professional services.
Our services enable organisations in every sector to prevent attacks by providing the visibility into vulnerabilities they need to rapidly detect compromises, respond to breaches and stop attacks before they become an issue.
- The author, Clarence Beukes, is GM of commercial sales and operations at CYBER1 Solutions
- Read more articles by CYBER1 Solutions on TechCentral
- This promoted content was paid for by the party concerned