Cyber Incident Management Playbooks - an example?
Charlie Maclean-Bristol FBCI FEPS MCIPR
Charlie Maclean-Bristol is a multi award winning business continuity, cyber security and crisis management keynote speaker, author and consultant.
This is from my BC blog last week and I thought I would share it on LinkedIn as well. I am interested in hearing people's thoughts on my example; whether it fits their idea of what a playbook should contain, and is there anything which can be added?
A while ago, I wrote what I thought were the contents of a cyber playbook, and through my reading I thought I had a consensus of what one should contain. After having delivered a number of cyber public and private training courses, I have realised that there are a large variety of documents called playbooks, and they mean different things to different people and organisations. Some organisations are using them as a substitute description of their crisis plans, whilst others are using them to detail information on how to respond to a cyber event at a technical level.
I thought for this bulletin I would share an example of a playbook from the 'Managing and Preparing for Cyber Incidents' course.
This example would be one of a number of plays which make up the playbook, and would cross reference the organisation's strategic and tactical plans.
Play / scenario covered
- Whether to cut off our internal systems from the external environment
When is this likely to be used.
- In response to a major and sustained DDoS attack
- In response to malware which is spreading through the organisation or externally, where disconnecting from the external environment may stop the attack or it spreading internally
Options
- Keep systems connected
- Disconnect all systems
Clear decisions
- Low – If IT feel they can deal with the attack and they can withstand or contain it then stay connected
- High – If the systems are already being damaged or have started to shut down then disconnect
How long will it take to initiate the cut off
- It will take 2 hours to completely cut off the entire network
Questions the team might want to ask before making a decision
- How powerful is the DDoS attack?
- Is it just our organisation being targeted, or have others been affected?
- Do we know where the attack is coming from?
- Which systems have been affected?
- Is there any Government advice on what to do?
What are the advantages and disadvantages of disconnecting the systems
- Advantages:
- Protect our systems, some of which can take up to 3 days to recover if not shut down correctly.
- Prevent corruption and loss of data.
- Recovery after the attack will be quicker.
- The website will stay up as it is hosted outside our system.
- Disadvantages:
- We will lose all email, telecoms, and access to all internal systems.
- All company work will cease.
- We will lose all our main methods of communication.
Who will make the decision?
- The decision to cut off will be suggested by IT but must be signed off by any member of the Incident Management Team (IMT).
Who needs to carry out the action?
- Once the decision is made IT have plans in place to implement the disconnect.
Who needs to be informed of the decision?
- All members of the IMT, all staff, the board and the executive team.
Any further actions to be taken
- All further communications will be by mobile and the pre - agreed WhatsApp groups.
To me, the purpose of this is to give the facts and considerations for the team to make a decision, and to have them readily available so if they need to make a decision at short notice they are seeking minimum information from elsewhere. The circumstances are likely to be different each time, but the advantages and disadvantages may stay the same.
Your thoughts?
Enterprise Risk Manager
6yLooks good Charlie, thank you for sharing. We put together some playbooks for the water crisis here in Cape Town. In addition to the info above, we included Trigger points (and thresholds for activation) - for example: Day Zero is officially declared by the City of Cape Town or National Government; or in the absence of an official declaration we are 2 (two) weeks from planned Day Zero; alternatively activated on management discretion. We took the comms a step further an added escalation and how this would be achieved (preferred method / channel). We prepared initial "Agenda / talking points" and finally added a dependency note (people, process or tech) which sits outside the immediate team/decision-makers, and would influence their design thinking.