Prepare To Be Hacked
In today’s digital landscape, no organisation is immune to cyber threats. This blog explores how CISOs can prepare for the inevitable, with actionable insights on building resilience. From understanding your attack surface to crafting a robust incident response plan, discover practical steps to protect your organisation and recover swiftly when the worst happens.
Assume Nothing Is Secure
The hard truth in cybersecurity is that nothing is ever 100% secure. It doesn’t matter who you are, how mature your security program is, or how large your cyber defence budget may be, there is always a high probability you will face a cyber-attack. The real question is: when it happens, what will you do?
“By failing to prepare, you are preparing to fail” - Benjamin Franklin
While Franklin wasn’t thinking about ransomware or nation-state hackers, his words ring true in today’s digital world. Being prepared is the key to resilience.
While many organisations invest in prevention, far few are adequately prepared for recovery after a cyber incident. A recent cyber-attack on Marks & Spencer serves as a stark example of how many remain inadequately prepared to recover from such incidents, lacking both robust continuity planning and the resilience necessary for swift operational restoration.
Discover What You Don't Know Early
The passage of time can be the enemy of security. Environments evolve, people move on, and critical knowledge is often lost in the process. Even in organisations with process maturity where documentation is regularly updated, shadow IT and legacy systems can still introduce hidden risks that slip under the radar.
True resilience starts with full visibility and a clear understanding of your environment. Without this foundation, building and maintaining a strong security posture becomes nearly impossible. Put simply: if you don’t know about it, you can’t protect it.
Organisations should prioritise the creation of technical documentation for their environments. When considering the level of detail think about how you would instruct a suitably skilled person to build the environment from nothing. Include visual representations such as architecture and data flow diagrams as these can really help convey a huge amount of information very quickly when under pressure.
It is also important that you understand your attack surface - essentially every way that an attacker could interact with or exploit your environment - uncovering all assets and entry points - known and unknown - that could expose you to risk.
Conducting attack surface enumeration and threat modelling exercises are extremely useful at this stage to increase visibility. Regular vulnerability analysis and penetration testing exercises should also be conducted to identify and remediate weaknesses in the environment at the earliest opportunity. After all prevention is always better than cure.
Prepare For The Worst
So now you now have a good understanding of what makes up your environment, you have removed assets that you thought had long since been decommissioned, patched vulnerable software and modelled residual threats. You are still not prepared for a cyber-attack. You need a plan.
"The time to repair the roof is when the sun is shining" - John F. Kennedy
A vital step in becoming resilient to cyber-attacks is to form an incident response team and create a detailed incident response plan to help them respond quickly, consistently, and effectively when a security incident happens. As Kennedy alluded, you don’t want to be working on something when you need it the most.
What should be included in an Incident Response Plan?
It's important that you have a detailed plan in the event of a cyber related incident, so you know how to act and what role each team member plays, here is a list of the basics to include in an Incident Response Plan:
1. Introduction
- Clearly define the purpose of the incident response plan
- Outline the goals and priorities of the plan
2. Roles and Responsibilities
- Identify response team members and their specific duties during an incident
- Establish a clear hierarchy for escalation and decision-making
3. Communication Plan
- Develop a strategy for internal and external communication during incidents
- Include prepared materials such as:
- Statements for internal use
- Press releases for media
- Customer communication templates
4. Incident Classification and Severity
- Define severity levels for incidents based on business impact
- Provide a decision matrix to guide escalation processes
5. Incident Response Procedures
- Include step-by-step guides for each phase of the incident response process:
- Preparation: Establish readiness and preventive measures
- Identification: Detect and confirm the incident
- Containment: Limit the spread and impact of the incident
- Eradication: Remove the root cause of the incident
- Recovery: Restore systems and operations to normal
- Lessons Learned: Review and document insights to improve future responses
6. Legal and Regulatory Considerations
- Define data breach notification requirements
- Outline procedures for engaging with law enforcement agencies
7. Appendices
- Provide a directory of key contacts
- Include checklists for incident response tasks
- Reference supporting documentation such as:
- Architecture diagrams
- System design specifications
How Can You Be Proactive Against Hackers?
This is of course a 50,000-foot view or a response plan and in reality, the plans complexity will correlate with that of the solutions it is created for. It should also be noted that this does not negate the need for a wider operational resilience program although it will certainly play it part.
To be effective, an incident response plan must be regularly tested through tabletop exercises, simulations, and technical drills. Testing validates that roles, procedures, and communication channels work as intended, and it exposes gaps that can be corrected in advance. Without this validation cycle, the plan remains a theoretical document that may fail when you need it most.
Preparation is the cornerstone of cybersecurity resilience. By understanding your environment, addressing vulnerabilities, and implementing a tested incident response plan, you can minimise the impact of cyber-attacks. Don’t wait for a breach to expose gaps—start building your defences today. Remember, in cybersecurity, preparation isn’t optional; it’s essential. Are you ready to take the next step?
Are you confident with you Incident Response Plan?
Here at A&O Corsaire, we working with companies around the globe to deliver security focused and innovative automation services.
+44 (0)1753 76 8800