“The idea here is to tie together security, IT, and business insights as the team looks at the technical evidence in front of them,” said Montenegro during an actual incident.
To prepare a new cybersecurity team for a crisis, it is important to define and rank what the business would consider a security “crisis.” This includes non-cyber events such as natural disasters, product recalls, accidents, and public relations debacles. John Pescatore, director of emerging security trends at the SANS Institute, emphasizes that not all crises are cyber-related. For example, he recalls a Boston-area hospital being bombarded with attempts to access data after the Boston Marathon bombing because the bombers went to that hospital.
Once the cybersecurity team understands what constitutes a security crisis for the company, playbooks should be created for the top handful of them. These playbooks should outline defined roles and responsibilities. Pescatore suggests conducting an internal tabletop exercise at the next cybersecurity team meeting to further refine the playbooks. Additional guidelines and best practices can be found through resources like the Forum of Incident Response Security Teams.
In addition to creating playbooks, it is crucial to develop an incident response plan for the cybersecurity team. This plan provides step-by-step guidance for responding to and mitigating any security incident that could trigger an enterprise-level crisis. Unlike a crisis management plan, which takes a strategic approach, an incident response plan focuses on tactical actions to mitigate an incident. Christopher Hallenbeck, CISO, Americas at Tanium, advises ensuring that the plan addresses the impact on operations, data loss or exposure, and the need for external assistance in investigating and recovering from the incident.