You Play Like You Practice: Cyber Incident Response

In sports or any type of consistent competitive event, the importance of purposeful and diligent practice can’t be understated.  Ask professional athletes or competitors, and you will likely get a consensus on the importance of practice to achieve consistency and maintain a high level of performance.  Military, law enforcement, and first responders train constantly to be prepared for anything that they may face during their careers, so when those particular situations arise, they are confident, efficient, and knowledgeable about how to deal with and resolve the incident.

Cyber incident response is no different. With rapid innovation in technology, threat actors are poised to attack, and financial institutions are a prime target. In a type of perpetual digital battle, malicious cybercriminals aim to attack without concern about the impact on you, your family, your employees, and your customers, so preparation and practice are key components to success in thwarting these attempts.

When a breach or major cyber event happens, it’s devastating to an organization on multiple levels.  It can be the end of a company or business in some cases.  How often do we train to handle those events, given the severity of cyber attacks? How many hours a week, month, or year are being spent on making sure that when the time to jump into action is here, the response is efficient, calculated, and competent?  If we evaluate ourselves, our response, is the skillset efficient? Once a year is just not enough.  That yearly scenario you walked through may not even be applicable to the Applicable Persistent Threats (APTs) that are causing the most damage throughout the year, not to mention the 100+ other scenarios your FI may encounter.  Reevaluation, at a minimum, should be four times a year- but every other month is even better!

In 2021, VMware stated that roughly 50% of organizations are deficient in the tools, personnel, and experience necessary to identify or address cyber threats. Practicing and regularly testing your incident response plan will help identify gaps and deficiencies in your plan and address those before an incident occurs.  It will help make sure roles are filled, responsibilities are kept up to date with turnover and staff changes, and mitigation efforts are kept current, along with practicing for the most recent and common attack scenarios.  Regular practice and testing of your cyber risk management plan will make sure that responders are calm, prepared, and efficient during an incident.  These are just a few of the benefits of regular practice and testing!

The reoccurring theme in a vast majority of the sessions at a recent security conference was preparedness for cyber incidents.  Nearly every session touched on this in some form or fashion.  It was an excellent reminder of why regular training and practice is paramount to cyber resilience. Similar to how athletes couldn’t practice once a year and maintain their abilities, your cybersecurity team must regularly prepare and hone their response skills.  If you train poorly and infrequently, when the time comes, that’s likely how the response will be. You will play like you practice!