How do you make informed decisions in uncertain cybersecurity situations?

Governance is key to everything , engaging right people at right time and at right place is critical . I have been involved in incidents where the solution created bigger problem than the problem itself. Breaking down every problem into smaller parts and then start building up from there is a good approach. Cybersecurity is like a complex web which will have far fetching repercussions to the business operations in long term. A really good and detailed risk, incident and problem management can definitely make one more prepared for such situations .

Having a clear framework for governing and executing your cyber program is key. When you have this in place as a foundation you are empowered to apply clear critical thinking in the context of your cyber program "BAU" and make a clear determination of where the problem is. Without a clear problem statement (e.g., what is it that had arisen which is falling outside of our normal risk appetite?), you can and often will end up spinning your wheels to solve problems that may not even exist, and potentially create new problems that did not exist before.

In the dynamic world of cybersecurity, informed decisions during uncertainty are vital. This involves assessing the situation, involving stakeholders, and risk evaluation. Legal and compliance aspects are considered, along with a clear communication plan. Swift containment, evidence preservation, and incident response activation are critical. Technical analysis informs decision-making, followed by compliant notification and recovery efforts. Post-incident reviews foster ongoing improvement, with training ensuring readiness. This comprehensive approach enables effective response to cybersecurity challenges.

In uncertain cybersecurity situations, informed decision-making requires situational awareness, comprehensive risk assessment, and agile strategies. Gather information from sources like security feeds, system logs, and industry reports, using SIEM tools for deeper insights. Prioritize risks by impact and probability. A multidisciplinary team approach ensures varied perspectives, including technical, legal, and business factors. Continually update your incident response plan to be flexible for evolving threats. Prepare for various scenarios and maintain clear communication for quick, effective actions against arising threats.

First step refer to the cybersecurity policy document, check if the uncertain scenario or use case has been mentioned or highlighted , if yes then act accordingly. If not then, reach out to the local information security officer to highlight and discuss on the same. Do’s and Don’t’s Do’s Reach out to local information security officer Communicate clearly on the problem at hand Don’t Don’t panic in the situation Don’t haste to reach any conclusions Don’t try to explore by trying to solve the problem without analysis or expertise

Collect Logs and Network Data: Gather logs from relevant systems and network devices to identify any suspicious activities or anomalies. Analyze network traffic data to understand the extent of the potential threat and its impact on the network. Conduct Forensic Analysis: Perform a thorough forensic analysis of affected systems to identify the source of the security incident, the extent of the compromise, and any data breaches or unauthorized access. This analysis can provide critical insights into the nature and scope of the cybersecurity threat.

A broad guide to decision-making in an emergency or incident: - Set a timer 5 minutes, 1 hour, 1 week, etc as appropriate. - Use this time to gather information and context. What is the scope of the incident, the risk of the threat? Who is the internal SME on this topic, what is their assessment? Continue for the majority of the time. - Consider the confounding variables; is there something no one understands or knows about this? Are there external regulations, pressures or parties that could affect the decision-making process?

Engage Threat Intelligence Sources: Consult reputable threat intelligence sources, such as industry-specific threat feeds, cybersecurity forums, and government advisories, to gather information about known threats, vulnerabilities, and attack patterns relevant to the incident. Utilize Security Information and Event Management (SIEM) Tools: Leverage SIEM tools to aggregate and analyze security events and logs from various systems and applications. These tools can provide real-time insights into security incidents and help identify potential indicators of compromise.

Engage Incident Response Teams: Collaborate with the organization's incident response teams, cybersecurity experts, and relevant stakeholders to gather their insights and expertise. Leverage their knowledge to gain a comprehensive understanding of the cybersecurity incident and potential response strategies. Consult Security Policies and Procedures: Review the organization's security policies, procedures, and incident response plans to understand the established protocols for addressing similar cybersecurity incidents. Ensure that the response aligns with the organization's established security guidelines and compliance requirements.

Evaluate System and Network Configurations: Assess the current system and network configurations to identify any vulnerabilities or misconfigurations that may have contributed to the security incident. Understanding the existing infrastructure can help determine the root cause of the incident. Analyze Security Controls and Tools: Evaluate the effectiveness of existing security controls, such as firewalls, intrusion detection systems, and antivirus software, in detecting and mitigating the identified threats. Determine whether any security tools need to be updated or enhanced to better address the current incident.

Start with a clear understanding of the priorities to achieve and identify alternatives that meet most of your priorities. Consider how well each alternative fits into and advances your technology roadmap. Once you have a shortlist, pick the best-fit alternative and run a POC.

It will be relevant to assess risks based on the most critical asssets and their potential impacts, without foretting that cybersecurity is not only about Technical Measures, therefore, assessing the legal and contractual requirements will be important to insure that all the suppliers in the cyberspace are implementing measures that maintain the externalized risk at an accepted level.

Document the Incident: Document all aspects of the cybersecurity incident, including the response measures taken and the lessons learned. This documentation will be valuable for post-incident analysis and for improving future incident response procedures. Remember that cybersecurity is an ongoing process, and proactive measures, such as regular security assessments, staff training, and robust security protocols, can help prevent or minimize the impact of future incidents.

Assess the Situation: Understand the nature and severity of the cybersecurity threat. Identify the potential impact on data, systems, and operations. Consider the scope of the threat and its potential to spread. Gather Information: Collect as much data as possible about the situation. This includes analyzing logs, conducting forensic analysis, and gathering intelligence from various sources to comprehend the nature and origin of the attack. Evaluate Risks and Impact: Assess the potential risks and impact of various response options. Understand the implications of each choice on the organization's assets, operations, and reputation. Consider the short-term and long-term consequences.

Consult Experts: Seek advice from cybersecurity experts, consultants, or professionals with relevant experience. Their insights can help in understanding the nuances of the situation and evaluating different courses of action. Consider Legal and Compliance Issues: Ensure that any response aligns with legal requirements and industry regulations. Failure to comply with these standards can result in legal consequences and damage to the organization's reputation. Prioritize Response Options: Rank the available response options based on their effectiveness and feasibility. Prioritize those options that can contain the threat, mitigate the damage, and restore normal operations in the shortest possible time.

Communicate Internally and Externally: Establish clear communication channels within the organization and with external stakeholders. Keep all relevant parties informed about the situation, the actions being taken, and the potential impact. Implement a Response Plan: Execute the chosen response plan effectively and efficiently. Coordinate with relevant teams, such as IT, legal, and communications, to ensure a cohesive approach to addressing the cybersecurity incident. Monitor and Adapt: Continuously monitor the situation and the effectiveness of the implemented response. Be prepared to adapt the response strategy based on new information and developments.

The ability to make informed decisions is fortified by a commitment to reflection and continuous improvement. Cybersecurity landscapes are inherently dynamic, and professionals understand the necessity of adapting strategies in response to evolving threats. Regularly reflecting on past incidents, analyzing the effectiveness of implemented solutions, and identifying areas for improvement contribute to a robust decision-making process. By fostering a culture of continual refinement, professionals not only enhance their own skills but also elevate the resilience of their organizations. This reflective approach enables proactive adjustments to security measures, ensuring a more adaptive response to uncertainties.

A important aspect of decision making is utilizing the lessons learned principle. If you experience an outage or conduct testing exercises it's always good to have a follow-up discussion with your peers or collaborate with your involved third-parties. Too many times we look for a quick resolution, but if we reflect on lessons learned we could potentially prevent or minimize the impact of a similar situation if it reoccurs.

You will make mistakes. Things will go wrong during implementation. That's life in a complex and uncertain world. Don't waste energy finding someone to blame. To a decent post-mortem and identify how the issue could have been prevented, how to improve and distribute the knowledge through your team. Not only will you have less stress berating yourself, but your team will also be more relaxed and confident.

Do not just look at cyberspace, understand financial and then business uncertainties. Following this, understand exactly what cybersecuruty liabilities you hold. Knowing all the zero days published recently is laudable, but pointless if only 15% apply to your infrastructure. Then understand the businesses critical risks. Put this together and then make a decision. Which almost certainly will require focussed research to stay up to date with cybersecuruty. It may still be uncertain, but it will certainly align with the business strategy. Then, when the circle is complete with mitigations in place, go back to the beginning. Most of our environments are uncertain. So constant vigilance and change are the watchwords.

1. Follow an Established Principle-Based Framework: Depend on foundational principles integrated into your business strategy and supported by your security strategy. Examples include "security-first," "Zero Trust," and "Privacy-by-Design." This approach ensures that all security decisions and considerations are aligned with the overarching business strategy. 2. Engage with Stakeholders and Onboard Feedback: Collaborate with all relevant stakeholders to gather diverse insights and feedback. This provides a broader perspective and helps to identify potential downstream impacts of security decisions.

Involve Experts: If you have a cybersecurity team or access to experts, involve them early on. Their experience and expertise can provide valuable insights into the situation and guide your decision-making process. Include those who challenge the status quo and are good at looking problems through multiple lenses. There folks are valuable because it can open up insights into how the attackers are working, prevents groupthink, enhances decision quality, and encourages open dialog. Remember that each cybersecurity situation is unique, so flexibility and adaptability are key. In uncertain situations, decision-making may involve some level of risk, but a well-informed approach can help you minimize the potential impact.

The most important aspect is take decisions quickly based on information available. Also documentation of actions taken, and use that information to teach Incident responders, and use the same for information for taking decisions in future.

Choice is the one path you take on a certain situation, but when you face very incertain situation, listen your body and guts. In decision there is always a part of risk : trust your gust, your brain is using all the datas you met till the crisis. Maybe future will show it was not the best choice : keep humility and learn from that for your next strong decision.