I know I sound like a vinyl record that has a scratch in it, but I write it as I see it. And right now, I am seeing that the companies hit with cyber-attacks, ransomware attacks, double extortion attacks, and data theft are unprepared to respond because they either don’t have an incident response plan or haven’t tested it.
A cyber-attack is going to happen. Waiting until it does to figure out how to respond is not the best strategy. Most companies know what they would do if the electricity should go out or there is a snow storm; very few companies are prepared to respond to a cyber-attack.
Cyber-attacks are more frequent and more sophisticated than ever before. Even a company that has an incident response plan and has completed table-top exercises and simulations finds that it to be a chaotic time. If they haven’t prepared at all, it is even more chaotic.
As a first step, figure out who should be on your incident response team and make sure they have each other’s cell phone numbers. Figure out whether you have appropriate insurance and who you would call to assist with the incident and quarterback the plan. Get your counsel and vendors pre-approved so you can make one call and not miss a beat. Planning the details before an incident occurs will save valuable time during the incident, allowing you to concentrate on responding instead of addressing now-necessary administrative tasks that could have been dealt with in advance.
Take the time to plan and prepare for a security incident. It will save you valuable time and resources and you will recover faster and less painfully.