The strong alliance and seamless collaboration between Information Security and Legal teams can make or break an organization's effectiveness during a security incident or breach. While these teams lead the response, success depends on good communication and involvement of all key stakeholders to ensure swift action, regulatory compliance, and the protection of company interests.
Committee Panel
It's no surprise that cybersecurity and incident breaches have come to the top of executive plates and organizational priorities, particularly in the last decade. The spillover of financial, liability and repetitional impact is now a concern for the company's legal department and counsel. Perhaps the best approach is a panel of attorneys, insurers, PR, IT, forensics specialists, and the CISO. Regulatory requirements have a tremendous amount of weigh in the decision-making making so the advice, decisions, or tone set by the general counsel are critically important in a crisis. This model is often practiced for other critical areas in a corporate board so security breaches should be no different.
Incident Response Plans (IRP)
The rigor of incident handling can best be outlined and evaluated through a detailed IRP that sets expectations, specific roles, functional descriptions, and lockstep timelines that cover identification, containment, and eradication efforts. This will also include the necessary Privilege Communication as an added level of legal confidentiality.
Of course, full dress rehearsal is a must and really needs to be performed frequently and by all parties (over time) that would get involved from the leadership team or panel described as fellas the specialists that would participate.
• During a cyber incident, the CISOs are the cyber incident response experts and are expected to be prepared for activities associated with the response and mitigation. Coordinating activities, analysis, and recovery measures in the main objectives.
• The General Counsel's (GC) role is to understand the legal implications for their company and the panel of do's and don'ts as well as advise the board accordingly. As advisor of communication strategy, (GC) advises stakeholders which include customers, regulators, media, and corporate boards.
Expect and Anticipate
The security breach attack path I've shared before reveals patterns albeit technical specifications is left to the creativity of the threat actor. Conversely, the alignment of processes, leveraging templates, and collaboration between other key stakeholders help surround the security investigation completeness — business relationships, technology integration, and coordination of logistics.
Refer to the diagram for the pattern — reconnaissance being the early stage, exposing user credentials which shifts to privileged access and opportunistic approach leading to the latter movement; deposit of malware or tapering of data or infrastructure, and then, disruption of services, interruption of processes or normal interactions, as well as data egress and/or extortion with financial implications.
Shared Dilemmas
Decision-making on how much and when information or progress is revealed can be challenging at the moment and can strain known processes or unreasonable expectations. At times a breach coach and external legal counsel can aid in this moment of decision-making during periods when data is not fully known and particularly when information changes due to new events or non-static and unpredictable scenarios.
CISOs are rooted in technical defenses and recovery which complements the GC handling the legal ramifications, compliance issues, and overall communication, particularly with other entities. In the end, trust is pivotal and some things can only be strengthened by having gone through an actual situation when tensions are high, external factors become real, and the impact is business and/or life-threatening. Hence, we're all in it together, and makes us all stronger.
No comments:
Post a Comment