Israel prepares for a response to Iran's April 14 drone and missile attack.

Source: Birgit Korber via via Alamy Stock Photo

Adding fuel to speculation that Israel may wage strategic cyberattacks on Iran in response to the April 14 aerial drone and missile attack, the Israeli Defense Forces (IDF) held simulated cyber and combat warfare drills.

Israel's Northern Command forces held the drills with the nation's cyber and technology units to test the combination of cyber and kinetic warfare in preparation to the nation's response to the Iranian attack, according to The Jerusalem Post.

Earlier this week, Israeli citizens received threatening text messages purportedly from an Iranian-backed hacking team warning that it has hijacked the nation's radar systems, stating: "You have only a few hours to fix the systems."

Israeli officials had not verified the group's claims.

**About the Author(s)**

Israeli Defense Forces Hold Hybrid Cyber &amp; Military Readiness Drills

Delinea rolls out Secret Server SOAP API flaw fixes, while researcher claims the vendor ignored his findings for weeks.

Source: Phichak via Alamy Stock Photo

A critical flaw in Delinea's Secret Server SOAP API disclosed this week sent security teams racing to roll out a patch. But a researcher claims he contacted the privileged access management provider weeks ago to alert them to the bug, only to be told he was not eligible to open a case.

Delinea first disclosed the SOAP endpoint flaw on April 12. By the next day, Delinea teams had rolled out an automatic fix for cloud deployments and a download for on-premises Secret Servers. But Delinea wasn't the first to raise the alarm.

The vulnerability, which still doesn't have an assigned CVE, was first publicly disclosed by researcher Johnny Yu, who provided a detailed analysis of the Delinea Secret Server issue, adding that he had been trying to contact the vendor since Feb. 12 to responsibly disclose the flaw. After working with the CERT Coordination Center at Carnegie Mellon University and weeks of no response from Delina, Yu decided to release his findings Feb. 10.

"I sent an email to Delinea, and their response stated that I am ineligible to open a case since I am not affiliated with a paying customer/organization," Yu wrote.

After a timeline showing several failed attempts at contacting Delinea and an extension to the disclosure granted by CERT, Yu published his research.

Delinea provided an emailed statement about the status of the mitigation, but did not respond to questions about the timeline of disclosure and response.

The access vendor's silence on the issue leaves open questions about who can submit bugs to the company, under what circumstances they are able to submit, and whether there will be any process changes made to the way Delinea manages disclosures in the future.

**Vuln Volume Struggles Not Unique to Delinea**

The lack of communication about the response signals "issues" with Delina's patching processes, according to Callie Guenther, senior manager of threat research at Critical Start. But, she explains, the crushing weight of vulnerability management is taking its toll across the board.

Recently, the National Institute of Science and Technology (NIST) said it can no longer keep up with the number of bugs submitted to the National Vulnerability Database and asked the government, as well as the private sector, to help.

"This is not unique to Delinea; tech companies often face challenges in balancing rapid response with the need for thorough testing of patches," Guenther explains to Dark Reading. "This situation reflects a larger trend where the complexity and volume of vulnerabilities can challenge security protocols."

Delinea Fixes Flaw, but Only After Analyst Goes Public With Disclosure First

Quantum computing on the level that poses a threat to current cybersecurity measures is still years off. Here's what enterprises can do now to avoid future disruptions.

Source: DM via Adobe Stock

Quantum computing is being driven by applications that process massive calculations for big data. That includes developing new pharmaceuticals, performing financial modeling, developing next-generation communications capabilities for terrestrial and extraterrestrial applications, optimizing logistics, and running finite element analysis, as well as everyday applications in healthcare, manufacturing, and critical infrastructure.

But when the promise of quantum computing is finally realized, it will disrupt more than just high-performance computer systems (HPCSs); it will turn classical cybersecurity on its head. Today's unbreakable, hardware-based cryptography systems will be child's play for quantum computing algorithms, warn cybersecurity experts, who caution that the level of compute power from quantum computers will dwarf today's.

Here's some of what enterprise executives and board members need to consider when preparing for the upcoming migration to the new computing environment.

**What Is the Quantum Computing Threat?**

Jérémie Guillaud, chief of theory at French quantum computer manufacturer Alice & Bob, says companies should identify which systems and data eventually could be vulnerable to an attack. He suggests planning to have to defend against an attacking machine with 1 million qubits. That provides a starting point: setting a goal to migrate vulnerable systems to a quantum computer with more than 1 million qubits.

To put this in perspective, in December, IBM's Condor quantum computer had 1,121 qubits. That baseline offers organizations somewhere to start their planning. Despite the progress made in the past 15 years of quantum computing development, the threat to enterprises is likely still a decade away, Guillaud estimates.

While qubits, like classical bits, are either positive or negative, superpositioned qubits, called cat qubits, can be both positive and negative, existing in two quantum states concurrently. Today there are no defenses against a cat qubit attack, although various organizations are experimenting with new approaches.

"Things that we don't do today can have a massive impact on the future, particularly around the concept of organizations that are harvesting data today, data that's in transit, with our idea of being able to be decrypted at a later stage," says Trevor Horwitz, founder and CISO of TrustNet, a provider of managed security, consulting, and compliance services. "It's not just about the risk of things happening today; it's being able to predict what risks we're going to be facing."

The effort, commonly called "harvest now, decrypt later," makes current highly secure data not as secure in the long term as the enterprise thinks. Boards need to begin their efforts now to secure data for a future that effectively is still unknown.

**The Board's Role With Quantum Computing**

If boards wait until quantum computers are in commercial production, it will be too late to start planning network and system upgrades, which could take up to a decade to fully implement, says Lisa Edwards, executive chair of Diligent Institute, the governance think tank and global research arm of Diligent Corp.

"The way that I think about it is this has moved from being a physics problem to being an engineering problem, and it's very rapidly becoming an operations problem," she notes. "I do think it's the appropriate time for boards to start becoming more knowledgeable about it, becoming conversant about it. The role of the board is not to tell the CISO which lattice-based encryption they should use. The role of the board is to ask the question: 'What are we doing? Are we prepared if this were announced tomorrow? What would happen?'"

Tom Patterson, managing director of emerging technology security at Accenture, agrees. Corporate boards should recognize that while the threats are real, they do not need to be quantum physicists to develop defenses — although they will need to listen to those who are in order to succeed, he says.

While boards have other cybersecurity concerns, they need to start planning for the future, Patterson adds. For example, boards can require that new infrastructure device purchases, such as routers and firewalls, have quantum-resistant or upgradable firmware. Since these purchases are often already scheduled as part of network maintenance, there are no unanticipated purchases.

As Patterson notes, one major vulnerability of classical computing is that firmware is hard-coded. That means hardware needs to be replaced rather than upgraded, since the firmware is permanent. As attackers find new ways to breach systems, new approaches are needed to improve firmware.

One approach, called cryptographic agility, allows organizations to update and rewrite firmware by automatically rotating algorithms at the press of a button. Such a system was demonstrated on low-Earth orbit satellites in 2023. Crypto agility could kill the need for hardware replacements when firmware is compromised, which would make a board look smart indeed.

**About the Author(s)**

Stephen Lawton is a veteran journalist and cybersecurity subject matter expert who has been covering cybersecurity and business continuity for more than 30 years. He was named a Global Top 25 Data Expert for 2023 and a Global Top 20 Cybersecurity Expert for 2022. Stephen spent more than a decade with SC Magazine/SC Media/CyberRisk Alliance, where he served as editorial director of the content lab. Earlier he was chief editor for several national and regional award-winning publications, including MicroTimes and Digital News & Review. Stephen is the founder and senior consultant of the media and technology firm AFAB Consulting LLC. You can reach him at \[email protected\].

How Boards Can Prepare for Quantum Computers

PRESS RELEASE

Woburn, MA – April 16, 2024 – Today Kaspersky introduced its new flagship product line, Kaspersky Next, combining robust endpoint protection with the transparency and speed of EDR (Endpoint Detection and Response), alongside the visibility and powerful tools of XDR (Extended Detection and Response). Customers can now choose one of three product tiers tailored to their business requirements, the complexity of their IT infrastructure, and their available resources.

Amid the constantly evolving cyberthreat landscape, it is vital for companies to have a comprehensive cybersecurity solution they can trust and rely on for effective protection. According to Enterprise Strategy Group’s XDR and SOC Modernization Report, businesses are still struggling to find information security tools that can detect and investigate advanced threats on time. As a leading innovative and technological company, Kaspersky is continuously developing its solutions to address all of the cybersecurity requirements of businesses, helping them build up reliable cybersecurity frameworks.

Kaspersky Next is a new line of cybersecurity products that includes robust endpoint protection powered by AI capabilities, and goes beyond the classic EPP (Endpoint Protection Platform), bringing together EDR and XDR for corporate customers of any size and industry. As the most advanced and effective cybersecurity solutions, EDR and XDR help companies to withstand the more prevalent, evasive, and sophisticated attacks, providing businesses with total visibility, control, rapid response and proactive threat hunting.

Kaspersky Next is deployment-agnostic and allows for both cloud and on-premises installations. Companies can manage it either through a streamlined console to perform core cybersecurity tasks quickly, or via an enterprise-grade console with more granular controls and advanced monitoring.

The new product line helps companies build crucial cybersecurity functions to provide robust protection against multiple types of threats that business face the most, such as ransomware, malware and data breaches, and avoid infrastructure penetration through Business Email Compromise, supply chain attacks, exploits and other vulnerabilities. It protects personally identifiable information (PII), such as social security numbers, employer identification numbers (EIN), and driver's licenses in files uploaded to Office365. This function also informs administrators of potential security issues or compliance conflicts with data protection laws.

Kaspersky Next includes multiple automation features such as cloud monitoring and blocking, vulnerability and patch management, IoC scan and playbooks that help businesses not only to support the effective detection and remediation of complex and new threats, but also to significantly reduce the burden on cybersecurity teams by minimizing the number of routine cybersecurity tasks.

Kaspersky Next currently comprises three product tiers:

Kaspersky Next EDR Foundations provides powerful endpoint protection that identifies and neutralizes threats before they can harm business processes. Flexible, straightforward security controls and built-in IT scenarios enable hands-off operation and let companies customize their security policies to suit their unique needs. 

This solution is recommended for companies where information security is performed by IT departments.

Kaspersky Next EDR Optimum provides strong endpoint protection with essential EDR functionality, advanced controls, patch management and cloud security. Threat visibility, investigation and response are guided to help businesses deflect attacks rapidly and with minimal resources.

This solution is recommended for companies with small information security teams. 

Kaspersky Next XDR Expert aggregates, analyzes and correlates data from various sources across an organization’s IT infrastructure, providing real-time visibility and deep insights into evolving cyber risks to deliver advanced threat detection and automated response. It’s a robust cybersecurity solution that can also integrate with third-party vendors. 

This solution is recommended for companies with experienced cybersecurity teams or Security Operations Centers (SOC).

Kaspersky Next is a part of the company’s B2B product ecosystem and it is designed to be directly compatible with other Kaspersky solutions and services. With the growing demand for more comprehensive cybersecurity protection, companies can also easily migrate from one tier to another, depending on their current cybersecurity requirements.

“Today we are launching our market-leading XDR and reinventing our corporate product offering, as we embark on a new chapter of our history as a B2B vendor,” said Claudio Martinelli, managing director, Americas at Kaspersky. “Kaspersky Next makes EDR and XDR simpler for companies and organizations of all sizes. We are bringing top protection powered by unique expertise to all customers – from those with zero cybersecurity officers to those that have experienced cybersecurity teams. Our goal is to allow companies to build reliable and cost-effective information security systems of the highest quality for their specific requirements.”

To learn more about Kaspersky Next, please visit this website.

Kaspersky Unveils New Flagship Product Line for Business, Kaspersky Next

PRESS RELEASE

Atlanta, GA - April 16, 2024 – BeyondTrust, the worldwide leader in intelligent identity and access security, today announced a definitive agreement to acquire Entitle, a pioneering privilege management solution that discovers, manages, and automates just-in-time (JIT) access and modern identity governance and administration (IGA) across the entire cloud estate. These capabilities enhance a customer’s ability to provision user access to sensitive data and cloud resources on a time-bounded and “as-needed” basis. While regulations and industry best practices are moving towards zero-standing privileges (vs. permanent privileged access as provided by traditional PAM offerings), companies have struggled to implement JIT with existing tools, particularly in cloud and hybrid environments; Entitle solves this issue with its automated provisioning workflows, self-serve access requests, and 150+ integrations across IaaS/PaaS platforms and SaaS apps.

This acquisition includes all Entitle products, employees, customers, partners, assets, and intellectual property.

BeyondTrust further solidifies its industry-leading Privilege Identity Security platform with the acquisition of Entitle, expanding beyond traditional privileged access management (PAM) to encompass dynamic, just-in-time access management across cloud, SaaS, and on-premises environments. Adding Entitle to its product portfolio enhances the capability to address the sophisticated challenges of PAM and cloud infrastructure entitlement management (CIEM) in today's cloud-centric landscape, with a unified orchestration approach that enriches the platform with advanced identity governance functionalities.

“The BeyondTrust acquisition of Entitle signifies a crucial evolution in our fight to ensure customers can protect all paths to privileges, focusing on identity-first security across all IT environments,” says Janine Seebeck, CEO of BeyondTrust. “Adopting a unified, orchestrated approach that incorporates dynamic, just-in-time access is critical for safeguarding our customers' ever-changing paths to privilege. This strategy not only reduces operational friction, but also enhances the security of the entire identity infrastructure more effectively.”

"Entitle’s JIT Access and Cloud Permissions Management solution is an emerging leader in the Identity Security market,” says Ron Nissim, CEO of Entitle. “This acquisition allows Entitle to continue to grow through BeyondTrust’s years of expertise and dominance in the PAM market - offering significant opportunities for Entitle’s team.”

“BeyondTrust’s acquisition of Entitle adds comprehensive permissions and entitlements management across cloud and SaaS platforms to the BeyondTrust Privileged Identity Security platform,” states Paul Fisher, Senior Analyst at KuppingerCole Analysts.

The Entitle solution is immediately available to all BeyondTrust customers. For more information, visit www.beyondtrust.com/products/entitle.

About BeyondTrust

BeyondTrust is the worldwide leader in intelligent identity and access security, enabling organizations to protect identities, stop threats, and deliver dynamic access. We offer the only platform with both intelligent identity threat detection and a privilege control plane that delivers zero-trust based least privilege to shrink your attack surface and eliminate security blind spots.  
BeyondTrust protects identities, access, and endpoints across your organization, while creating a superior customer experience and operational efficiencies. We are leading the charge in innovating identity-first security and are trusted by 20,000 customers, including 75 of the Fortune 100, plus a global ecosystem of partners. Learn more at www.beyondtrust.com.

BeyondTrust Acquires Entitle, Strengthening Privileged Identity Security Platform

PRESS RELEASE

Copenhagen, Denmark, April 16, 2024 – Keepit, a global leader in SaaS data backup and recovery, today announced Kim Larsen as new Chief Information Security Officer (CISO). With more than 20 years of leadership experience in IT and cybersecurity from government and the private sector, the new CISO’s areas of expertise include: business driven security; aligning corporate, digital and security strategies; risk management and threat mitigation; developing and implementing security strategies; leading through communication; and coaching. Larsen's deep government and broad private sector experience will position him to bring Keepit’s security advisory capabilities and development of future services to the next level.  

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards. 

“It's a real pleasure to welcome Kim Larsen to the team — his deep government and broad private sector experience is exceptional, and perfectly positions him to bring Keepit’s security advisory capabilities and development of future services to the next level. Our current growth trajectory and go-to-market strategy has us engaging in conversations where his expertise is highly valuable,” says Morten Felsvang, Keepit CEO.

Kim Larsen started his career in the Danish National Police and subsequently spent nine years with Security and Intelligence Service (PET) where he served as delegate for the Danish government in both NATO’s and the EU’s security committees.

Moving into the private sector to act as strategic advisor on government, public and financial sector matters, and developing security organizations and partnerships in companies such as Verizon, Huawei and Systematic, he has served on the information security board of the Danish Industry confederation (DI) and Danish Council for Digital Security for 10 years. 

Backup and recovery critical components to cybersecurity

With this background, Kim Larsen has a holistic take on cybersecurity and a profound understanding of what is required and desired in organizations bolstering their IT infrastructures against cyber threats:

“I am very happy to join Keepit: Backup and recovery are critical components of a solid cybersecurity posture, and the unique Keepit solution is the answer to so many compliance and security challenges. It’s a great opportunity to work with organizations on how to retain access to their data in the face of any malign or arbitrary threats to their infrastructure,” says Kim Larsen.

The CISO points to compliance, cyber resilience, and disaster recovery best practices as three of his favorite subjects and reasons for choosing Keepit as his new stomping ground: 

“If there’s one thing we can be sure of, it’s this: We don’t know the threats we will be facing in the future. But we can make educated guesses. And based on those, we can make sure to cross the t’s and dot the i’s that we do know about. That’s why the Keepit solution is a future-proof solution: With its vendor-independent tech stack that keeps data physically and logically separate from the production environment, it’s a guarantee that customer data is always available. And with local data centers keeping data in the same regulatory regions as the organization, full compliance is assured. It really is quite unique,” states Kim Larsen. 

About Kim Larsen

Kim Larsen is Chief Information Security Officer at Keepit and has more than 20 years of leadership experience in IT and cybersecurity from government and the private sector.

Areas of expertise include business driven security, aligning corporate, digital and security strategies, risk management and threat mitigation adequate to business needs, developing and implementing security strategies, leading through communication, and coaching.

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards.

Find Kim Larsen on LinkedIn.

Kim Larsen New Chief Information Security Officer at SaaS Data Protection Vendor Keepit

The two allegedly sold the Trojan on Hack Forums, allowing other threat actors to gain unauthorized control, disable programs, browse files, record keystrokes, and steal credentials.

Source: imageBROKER via Alamy Stock Photo

Edmond Chakhmakhchyan, also known by the screen name "Corruption," was arrested last week by the FBI on federal charges alleging that he intended to market and sell malware that would allow a threat actor to take control of a victim's device.

Chakhmakhchyan, who is from California, pleaded not guilty to his two-count indictment and will stand trial on June 4.

According to the Justice Department, Chakhmakhchyan and the creator of the malware, an Australian national, struck a deal requiring Chakhmakhchyan to advertise the Hive remote access Trojan (RAT) on a website called Hack Forums, accept payment in bitcoin for licenses to use the malware, and provide assistance to the malware customers if needed.

Once deployed, Hive RAT customers were able to gain unauthorized control, disable programs, browse files, record keystrokes, access communications, and steal credentials without the victim's knowledge.

"The indictment specifically charges Chakhmakhchyan with one count of conspiracy — to advertise a device as an interception device, to transmit a code to intentionally cause damage to a protected computer, and to intentionally access a computer to obtain information — as well as one count of advertising a device as an interception device," the press release stated. If convicted, Chakhmakhchyan faces a maximum penalty of five years in federal prison for each count.

The Australian Federal Police (AFP) have charged Chakhmakhchyan's counterpart, who was allegedly involved in the creation and sale of the malware. They face 12 charges, each of which has a maximum penalty of three years in prison.

**About the Author(s)**

Global Cybercriminal Duo Face Imprisonment After Hive RAT Scheme

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

The enemies are always getting closer, using the same advanced technologies as security pros are employing to protect their networks. So perhaps it's time for a back-to-basics approach? Come up with a clever cybersecurity-related caption to describe the scene above, and our favorite will win a $25 Amazon gift card.

Here are four convenient ways to submit your ideas before the May 13, 2024, deadline:

*   Via social media: X, Facebook, and LinkedIn. (If you win, we'll respond to you on the same platform, requesting your email address.)
    

**Last Month's Winner**

Great Dark Reading readers' minds think alike! Several captions submitted for last month's contest, "Bridge the Gap," played on the same theme of air gapping. They all made us chuckle, but in the end only one could win. So a round of applause, please, for Bill Cote, a cybersecurity engineer at Leidos. And big thanks to all who submitted an idea!

**About the Author(s)**

John Klossner has been drawing technology cartoons for more than 15 years. His work regularly appears in Computerworld and Federal Computer Week. His illustrations and cartoons have also been published in The New Yorker, Barron's, and The Wall Street Journal.

Name That Toon: Last Line of Defense

Recent analysis shows that enterprises need to think about the impact on security budgets and resources as they adopt new AI-based applications.

Source: Absolute Security Cyber Resilience Risk Index 2024

Enterprises assessing their readiness for artificial intelligence (AI) transformation have to ensure they have devices capable of running AI-enabled applications. A recent analysis by Absolute Security found that the majority of organizations need to update or replace their systems to be AI-ready. Deployments of this size can have significant implications on their cybersecurity risk and resiliency, Absolute Security states.

"Absolute Security Cyber Resilience Risk Index 2024" assesses the state of cyber resilience for global enterprises. The index is based on telemetry from millions of mobile and hybrid PCs running Absolute Security's firmware-based agents. To determine AI-readiness, Absolute Security analyzed over 4 million devices running Windows 10 or 11 to determine how many of them had a minimum of 32 GB of RAM. According to the index, 92% didn't meet the basic requirements needed to efficiently handle modern AI applications.

Absolute Security based the assessment on whether enterprise PCs are capable of supporting AI applications on the recommendation that PCs should be equipped with a minimum of 32 GB of RAM and have either a stand-alone graphics processing unit (GPU) or an integrated neural processing unit (NPU).

"Huge investments in AI-capable endpoint fleets have the potential to divert budget and human resources away from critical IT and security priorities that can leave gaps in security and risk policies," Absolute Security says.

The concern isn't just about diverting resources; Absolute Security notes that new devices being added to the environment can also add complexity. Organizations are already struggling to keep up with patching and making sure the right security controls are in place. New devices could mean defining new controls or adjusting workflows to make sure they are being patched.

While there is a marked improvement between 2023 and 2024, Absolute Security found that organizations are still lagging behind with patches. Most industries continue to run weeks or months behind in complying with their own patching policies, although Windows 11 devices seem to be faring better than Windows 10, the company said.

**About the Author(s)**

Enterprise Endpoints Aren't Ready for AI

Many teams think they're ready for a cyberattack, but events have shown that many don't have an adequate incident response plan.

Chris Crummey, Director, Executive & Board Cyber Services, Sygnia

April 16, 2024

5 Min Read

Source: Yee Xin Tan via Alamy Stock Photo

COMMENTARY

The new Securities and Exchange Commission (SEC) rules on cybersecurity risk management, strategy, governance, and incident disclosure recently went into effect, and organizational approaches to cybersecurity incident response are top of mind for stakeholders at both public and private companies. While most executive leadership teams and corporate board members assume their organizations are ready for a potential cyberattack, recent events have shown that many are ill-prepared to handle what will be their worst day on the job.

A company's response to a crisis is a direct reflection of its preparedness. Rather than focus solely on what happens during and after a cyber incident, executives and leadership teams must first understand that the period preceding an event is most critical. Organizational remediation efforts can and should be developed, tested, and implemented before an attack happens. It is imperative for those at the top to use this time to evaluate how well their teams will respond when thrust into a dire situation and take the necessary steps to ensure cyber readiness.

**Develop and Implement an Incident Response Plan**

Far too many organizations find themselves in the middle of a cyber crisis without a formal response plan in place. Companies make critical errors that can compound the financial and reputational damage associated with a cyber incident due to the simple fact they do not have established roles or responsibilities or a documented chain of command to handle this sort of situation. Within the first hour of the crisis, we see the most instances of job bias emerge and lead to a significant number of mistakes. During that "golden hour," people are unsure of what to do, but they inject themselves into the crisis because they believe it is their job to do something. This lack of understanding ultimately slows down the recovery and remediation process.

There isn't a single blueprint on what an incident response plan should look like, because each crisis is different. However, executives, board members, security teams, and others involved must know who takes the lead in responding, what each person's responsibilities are, and what steps should be taken to communicate internally and externally. The formal incident response plan should include an identified incident commander who works across lines of business and divisions within an organization to ensure each person and department understands the situation and handles their duties as assigned. The incident response commander will also be charged with contacting the company's third-party experts, such as legal, incident response firms, ransom negotiators, and public relations, to ensure they are aware of what has transpired. The cyber incident response protocol should be incorporated into the broader organizational crisis response plan, frequently reviewed and updated as necessary.

**Stress Test the Response Plan in an Active Simulation**

Planned actions can easily be lost in the chaos during a real cyberattack because of the natural psychological response employees have to a crisis. Leaders must understand that those involved in the attack will experience a rush of cortisol, the stress hormone that creates a "fog of war" during turbulent times, and it can lead to additional issues. The most common problem is the inability to validate and verify information. A person's interpretation of what has happened or what has been shared with them can differ significantly from the facts of the incident. The result can escalate a single piece of information about a potential event and turn it into a full-blown crisis.

The best way to evaluate how teams will react to a cyberattack is to put the formal incident response plan to the test. Tabletop and wargame exercises are immersive experiences, conducted in a controlled environment, that prepare enterprises to face and mitigate a potential attack. This gives every person within the organization the opportunity to feel, act, and behave as if they are in the midst of an attack situation. These training exercises allow teams to experience that rush of cortisol, learn how to handle and manage it, and develop the necessary discipline to execute the response plan. This also provides leadership with visibility into how an individual's response impacts the holistic approach to remediation.

**Evaluate the Plan's Efficacy and Improve it **

Once the organization and its cyber incident response plan have been put to the test, the next step is to evaluate the efficacy of the plan and identify opportunities for improvement. It is important to note where the fundamental breakdowns occurred and what can be done to address them. For example, if the communication cadence faltered, why was the team unable to contact the appropriate stakeholders? Was it procedural or did the incident commander not fulfill his or her duties? Leadership should know if it is a matter of committing additional resources to enhance security posture or if they need to incorporate different organizational leaders to spearhead response efforts.

Executives and board members must consider how prepared their team is before the attack happens and how it behaves during the crisis, and understand that the challenges from the wargame exercise are going present themselves when a real attack occurs. It is imperative for leadership to be involved in the evaluation process, as the final decisions will have a widespread impact on key stakeholders. The ability to comprehend how each choice impacts and improves security posture and coverage will boost employee engagement, which is paramount to successfully defending an organization.

Cybersecurity has become a board-level issue in recent years, and it must remain a priority moving forward. It is incumbent on executive leadership to be well-informed about their organization's security response plan and how people respond before, during, and after a cyber crisis. By proactively evaluating their response protocol before an attack begins, board members and executives can shore up their defenses against emerging risks and ensure cyber readiness.

**About the Author(s)**

Director, Executive & Board Cyber Services, Sygnia

Chris Crummey is the Director for Executive and Board Cyber Services globally at Sygnia. For the past eight years, Chris has prepared and advised thousands of companies, SOCs, executives and Boards of Directors on cybersecurity best practices before, during and after a cybersecurity crisis. These best practices focus on the intersection of cybersecurity, risk-based decision making, crisis communications, leadership under pressure and the role human beings play in cybersecurity. As a keynote speaker on these topics, Chris is also a cybersecurity faculty member of “Competent Boards,” which is the original and premier creator of online of ESG training programs for board directors and senior business professionals. Prior to this role, Chris was the Executive Director for the IBM’s X-Force Command Centers globally and specialized in tabletop exercises and cyber wargames.

Source

DARKReading