How can you lead a team during an information security crisis?

The most important thing in leading a team in a security crisis is to have a plan in place before the SHTF. Table top exercises covering a wide range of situations can help you develop plans and learn who you need on your contact lists with names, emails and phone numbers. It is not just IT, security, BC/DR, legal, PR, upper management, vendors and possibly human resources. Set up communication bridges with key resources. Have multiple alternative communication channels in case one goes down. Remember this is a team process and not a finger pointing exercise. Either the team wins or loses depending on everyone's joint actions and solutions.

Incident Response starts long before the Crisis hits. 1) Have a plan 2) Ensure this plan is often rehearsed against real threats 3) Adapt plan frequently to include new capabilities, new threats, and new personnel If you find yourself in a crisis position and have no playbook, you will almost certainly need outside help. Stay calm, don't make any rash decisions, trust your experts and please, don't fire security people just to scapegoat. It's worth mentioning one of the most important things you can have is immutable, totally segregated DR backups. Disaster Recovery is very rarely tested, even in mature environments. However, DR is often the only thing between you and paying a potentially multi-million dollar ransom.

In my experience, in leading a team through an information security crisis, it’s crucial to act swiftly and decisively. - Form a rapid response team encompassing IT, legal, communications, and customer service to ensure a comprehensive approach. - Establish centralized communication lines, both written (Slack, Teams) and verbal (Google Meets, Zoom). - Remove noise by limiting the participants to only those individuals who can directly contribute to successful analysis, containment, and eradication of the incident. - Define specific roles and responsibilities to avoid overlap and confusion. - Throughout the crisis, maintain a solution-focused mindset to keep the team morale high and ensure effective problem resolution.

From my experience: - establish a permanent “war room” with the top experts(engineers, ops) - contain the issue as fast as possible - then deep-dive on root cause & Co - initiate remediation as soon as containment and initial defence works - communicate frequently along the journey with the established bodies

"Management is doing things right, leadership is doing the right thing" -Peter Drucker. Step 1: acknowledge the problem, own it on behalf of the team. Blame is toxic and unproductive. Step 2: communicate and follow the plan (fingers crossed you have one and tested it), assign clear roles and timeframes, document everything. Step 2.5: immediately escalate anything you can't handle yourselves, bring in outside DFIR or negotiation experts, incidents cost more per minute - hesitation will aggregate that cost. Step 3: as the fog lifts, and systems get restored - do so in stages of quarantine - red, blue, green. Attackers come back, esp if your creds were ever "for sale" on Darkweb forums. Rebuild, don't restore, AD. Keep your guard up ;)

Roles and responsibilities should be assigned and rehearsed long before a crisis hits. Important to not only look at your organization but at your ecosystem. Look at both the hard and softskills for each role.

In managing an information security crisis, form cross-unit task forces for diverse perspectives and skills. Allow flexible role allocation, adapting to changing situations. Emphasise continuous skills development, keeping the team abreast of evolving threats. Ensure easy access to necessary resources, promoting seamless interdepartmental collaboration. Implement clear performance metrics and establish regular feedback loops for accountability and improvement. Involve strategic leadership in the incident response team for alignment with business goals and swift decision-making. This approach ensures robust security, business continuity, and a culture of collaborative learning.

Given the nature of information security crises and the dependency on technology it is important to include key business stakeholders in war room activities. These individuals will change over time as more information comes to light. Legal and HR representatives are often overlooked which can lead to issues downstream if employees were found to be involved, negligent etc. Legal advisors are key to being able to assist with regulatory enquiries, law enforcement involvement, insurers and various other stakeholders. Incident response plans should allow for this and also include deaft holding statements to enable quicker responses by the organization.

Roles and responsibilities should already be assigned. The key to this is cross train your team. This way, everyone has the same skillset and naturally some will be better than others at any given role, that's just human nature. During a security crisis, pretend its the World Series, you want your best and brightest doing the work they're best at. You want your A team working the critical issues they excel in.

During a security crisis, it is crucial that the leader has distributed the roles clearly beforehand. Any uncertainty when making critical decisions can be fatal. The role of a good leader will be evident here when the assignment of roles for each team member is efficient in terms of their knowledge and expertise.

Analyzing the root cause and impact of a security breach is a critical step in understanding the incident and developing a comprehensive response. 1. Identifying Root Causes - Software Flaws - Weak Authentication** - Insufficient Network Security - Lack of Employee Training - External Attacks - Insider Threats - Advanced Persistent Threats (APTs) - Risk Assessment - Compliance Failures 2. Impact Assessment - Operational Disruption - Financial Losses - Intellectual Property Loss - Data Exposure - Trust and Reputation - Liabilities - Regulatory Compliance 3. Collection Methods - Logs and Audits - Forensic Analysis - Penetration Testing 4. Recommendations - Mitigation Strategies - Enhanced Security Measures** - Continuous Monitoring**

In analysing a security breach, conduct a thorough root cause analysis (RCA) with a cross-disciplinary team. Utilise advanced forensic tools and AI for efficient pattern recognition and anomaly detection. Assess the breach's impact on business, customer trust, and reputation, quantifying financial and reputational losses. Develop a transparent stakeholder communication strategy to maintain trust. Quantify risks and prioritise mitigation plans based on business impact. Foster continuous improvement through cross-unit collaboration, integrating lessons learned into company-wide security policies. This approach aligns technical response with business objectives, ensuring a proactive, collaborative security posture.

El líder debe guiar al equipo en un análisis detallado de la causa raíz del incidente. Esto implica no solo identificar cómo ocurrió el incidente, sino también entender por qué sucedió. Este análisis debe ir acompa?ado de una evaluación continua del impacto, que puede evolucionar a medida que se dispone de más información. Comprender la causa raíz es fundamental para evitar incidentes similares en el futuro.

A key consideration while investigating the root cause is whether you have found the actual root cause. Often the analysis stops at the first cause found; a configuration error, a human mistake, a faulty/inadequate process. In reality, these causes, while contributing to the incident in a significant way, are often not the root cause and tend to overshadow the underlying issues. To make it easier to actually discover the underlying root cause a responder need to ask themselves two questions: 1. Is there another issue that may be giving rise to the cause identified? 2. If the mitigations specific to the cause at hand were to be implemented, would it prevent the same incident from happening again? If the answers are yes and no keep digging.

In my experience organizations sometimes move too quickly to close the incident by identifying a root cause and concluding. Before concluding on a root cause organisations should attempt to determine the breadth of the incident and obtain evidence confirming the extent. For example during a cyber incident lateral movement of the attacker is key to confirm the scope of response, as such evidence from servers, networking devices, security monitoring tools etc should extend to areas beyond the immediate systems which appear to be affected.

During an infosec crisis, transparent communication is key. Lead with clarity, outlining the situation and the steps being taken. Collaborate closely with your team, prioritize tasks, and foster a culture of vigilance. Swift action, continuous updates, and a united front will instill confidence and resilience in navigating the crisis.

One thing I've found useful is cyber security is being Honest. This is because every person deserves to know if their data has been breached or compromised in any of the recent incidents that may have occured. But when companies try to cover this information and not relay the communication to the customers and general public, thinking that it would hamper their reputation is the wrong way to go about this. Reputation can be hampered by an incident, but rebuilding that reputation and trust with the correct mitigation and communication is the key to always keep up to your customer's trust.

On this point specifically, one of the things that I've found to be most useful in crisis response of any form is a really good decisions log. I'd even go so far as to advocate having a specific role in your response team(s) which does purely this - recording decisions, consensus. This can be particularly powerful when overlaid with your communications flow as it can show and highlight instances of "what was said" being different from "what was heard".

Implement an integrated audit framework for incident response, encompassing IT security and business outcomes. Use cross-departmental teams for a comprehensive review and benchmark against industry standards for compliance and improvement areas. Focus on actionable insights for continuous security enhancement. Ensure transparency in sharing audit findings and engage stakeholders for business alignment. Regularly update policies and provide ongoing training based on audit outcomes. This approach promotes a proactive, collaborative security culture aligned with business objectives.

Essential also is not just to focus on the findings in that individual case but also go on a higher Level and identifying processes and systems where similar things might be affected and to learn to from that to improve the overall security also for other systems and processes. Essential for that is information sharing in the organization.

Adjusting strategies and practices is crucial to preventing or minimizing the recurrence of security breaches 1. Implementation of Recommendations -Patch Management -Network Security -Encryption -Access Controls -Phishing Awareness -Security Policies -Incident Response Training -Continuous Monitoring -Forensic Readiness 2. Process and Policy Updates -Review and Update -Testing and Simulation -Regular Audits -Third-Party Assessments -Periodic Reviews -Scenario Planning 3. Continuous Improvement -Promote a Security Culture -Reporting Mechanisms -Industry Collaboration -Information Sharing Platforms -Stay Current -Emerging Threats 4. Stakeholder Communicationy

Advocate for dynamic strategy adjustments in cybersecurity, incorporating emerging threats and technological advancements. Emphasise cross-business unit collaboration to align security strategies with overall business objectives. Prioritise continuous risk assessment and adapt strategies accordingly. Integrate advanced technologies like AI for enhanced threat detection and response. Implement comprehensive, ongoing staff training and awareness programs to bolster the first line of defense against breaches. Establish a feedback loop for continuous improvement, ensuring security practices remain effective and efficient. This approach fosters a proactive, collaborative security culture in tune with business goals.

After the crisis, debrief. This isn’t about blame but learning and realigning as a team. Remember, acknowledging the team’s hard work, perhaps with pizza, can be as crucial as any strategy in maintaining morale and unity.

One the crisis is over do a proper postmortem in a trusted environment where everyone can share their experience and perspective without consequences. Evaluate what kind of training and coaching each ‘role’ would need to do it better next time. Also, reevaluate your strategic cyber security risk in both likelihood and magnitude.

There is no shortcut. InfoSec leadership demands experience, knowledge, skills, exercising authority, keen eye and ears for valuable suggestions / feedback and accepting responsibility. Due to evolving nature of InfoSec incidents, innovation by threat actors and sophistication of attack vectors, the InfoSec team leader needs to be agile, be able to understand zero days vulnerabilities and thinking out of box for undocumented situations. InfoSec leadership requires well-orchestrated balancing act among many disciplines.

One thing which we generally oversee is the ability of a Security leader to be able to improvise. Every attack is not the same and while the basic principles stay the same, a leaders ability to pivot quickly as per need is paramount.

Be open and create a focused but creative work atmosphere that allows for alternative views and ideas from your team. This also helps to identify out-of-the-box attack methods. Take care of yourself and your team and take breaks and sleep so you can work efficiently and don't burn out during a very intense time.

You are leading a group of humans, who need to rest, sleep, eat, etc. Make sure people are taking breaks. Getting up and having the eyes focus on something other than a terminal. Sometimes you can forget to keep doing "life" things during a crisis, and those will affect the results and capabilities of the people doing the work. I jokingly tell people, "Don't worry, the crisis will still be here after you eat and rest a bit."