By Clarence Beukes, GM: Commercial Sales and Operations, at CYBER1 Solutions

In today’s digital age, savvy organisations understand that security breaches are an inevitability. They know that it’s no longer a question of ‘if’, but rather ‘when’, and even ‘how often’. This is why having a well-thought-out incident response plan in place is key to business survival.

Digital transformation has changed our lives dramatically and brought about many innovations and efficiencies. It has changed the way we do business, helped companies to become far more agile, and has introduced new revenue streams. Unfortunately, it has also ushered in a lot more risk, and as such, incident response plans need to adapt accordingly.

Yesterday’s tools are no longer effective, and much like everyone updates security at their homes and has moved past using a Gorilla lock to secure their vehicles, Cyber Security needs to adapt too.

The art of cyber war

Today’s attackers are highly advanced. They have grown in sophistication as well as the speed at which they can attack. They are well-funded, particularly those with nation-state backing, and are more determined than ever. What we see now, is a constant war between defenders and attackers, and too often, defenders are playing a catch-up game.

The great Chinese war general Sun Tzu said in The Art of War: “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

The Cyber Security industry can take a leaf out of this philosophy to help bolster preparedness in its defence systems and mechanisms. If we have visibility into what needs protecting, visibility into our weaknesses, and visibility into our adversaries, we can limit the blast radius as it were, and mitigate the damage in the event of a breach.

People, processes, technology

It is also important to note that incident response is not just about technology, although understanding the tools that the business has in its cyber arsenal is an important part of incident response. It is about people, processes, and tools. It establishes who is responsible for which actions in the event of a breach, and ensures that all stakeholders understand the processes in place that need to be followed to mitigate the fallout.

One of the things that we have found is that although a lot of organisations have incident response plans in place, too few of them test and rehearse these plans. In fact, not too long ago a customer asked us for help with strengthening and reviewing their incident response plan. However, although the plan was documented, it contained way too much content and was packed full of out-of-date information that had not been reviewed in years.

We did what is known in the cyber world as a Tabletop Exercise (TTX), which is an activity that involves testing the processes outlined in an incident response plan. We get all parties around a table and run an attack simulation to ensure incident response team members understand their roles and responsibilities, and whether these are adequate, in response to a given attack scenario.

These exercises are not only aimed at the propeller heads or technical resources. The incident response team needs to include top executives as well as the chief communications officer, for example, to communicate with the media and other stakeholders in the event of a breach, to manage market sentiment.

The team needs to be looked at holistically, and incident response needs to be a combination of people and processes, and then tooling on top of that, as it helps businesses to strengthen their posture. This is particularly key, given how the digital attack surface has expanded alongside digital transformation, and we have to implement new ways of protecting our attack surfaces.

Augmenting human intervention

Concurrently, we have also seen some key advances in technology out there. For example, one of the biggest buzzwords we hear today is artificial intelligence, and we need to consider how to augment human intervention with some of these amazing tools because we do have a massive gap in skills.

The enormous deficit in Cyber Security skills has been well documented, and it is far from a South African problem alone, it’s a global problem. We need to use every advanced method and mechanism at our disposal to shore up our defences, while still bearing the human factor in mind.

Unfortunately, incident response can be very overwhelming, because while we are all in the same storm, we are not all in the same boat. The largest corporates, for the most part, have clearly defined incident response teams. These might be made up of an incident manager, a communications manager, an AI forensics investigator, and many others. However, most companies, especially smaller entities, don’t have these resources.

Elevating the internal team

Fortunately, smaller businesses can reach out to external parties to assist them with these competencies, be they people or technologies.

Outsourcing incident response to a trusted partner can be a highly effective way to elevate the internal security team with highly-skilled external experts who can help the business respond to cyberattacks, mitigate the impact and recover more rapidly.