The Cybersecurity Playbook

How Every Leader and Employee Can Contribute to a Culture of Security

Allison Cerra

• Publisher: Wiley
• Year: 2019
• ISBN:
  9781119442134
• Edition: 1
• Topic: Business
• Subtopic: IT Industry
• Index: Business

The real-world guide to defeating hackers and keeping your business secure

Many books discuss the technical underpinnings and complex configurations necessary for cybersecurity—but they fail to address the everyday steps that boards, managers, and employees can take to prevent attacks. The Cybersecurity Playbook is the step-by-step guide to protecting your organization from unknown threats and integrating good security habits into everyday business situations. This book provides clear guidance on how to identify weaknesses, assess possible threats, and implement effective policies. Recognizing that an organization's security is only as strong as its weakest link, this book offers specific strategies for employees at every level.

Drawing from her experience as CMO of one of the world's largest cybersecurity companies, author Allison Cerra incorporates straightforward assessments, adaptable action plans, and many current examples to provide practical recommendations for cybersecurity policies. By demystifying cybersecurity and applying the central concepts to real-world business scenarios, this book will help you:

• Deploy cybersecurity measures using easy-to-follow methods and proven techniques
• Develop a practical security plan tailor-made for your specific needs
• Incorporate vital security practices into your everyday workflow quickly and efficiently

The ever-increasing connectivity of modern organizations, and their heavy use of cloud-based solutions present unique challenges: data breaches, malicious software infections, and cyberattacks have become commonplace and costly to organizations worldwide. The Cybersecurity Playbook is the invaluable guide to identifying security gaps, getting buy-in from the top, promoting effective daily security routines, and safeguarding vital resources. Strong cybersecurity is no longer the sole responsibility of IT departments, but that of every executive, manager, and employee.

CHAPTER 1
The Time I Ruined Easter

I’ve had better Sundays.

It was Easter, April 16, 2017. I had just finished a homemade dinner with my husband. It was time to chill and finally enjoy a few hours of downtime, compliments of the latest binge-worthy craze on Netflix. Little did I know, I was about to star in my own real-life drama that was much more cringe-worthy instead.

My cell lit up and I looked down at the display. It was a text from Chatelle, our chief human resources officer (CHRO). Chatelle and I were close. We had just teamed up to help McAfee’s spinout from Intel as one of the world’s largest independent cybersecurity companies 12 days prior. Seeing a text from her on Easter wasn’t unusual, assuming it was the type of well-wishing that happens between friends on a holiday. This was not that type of text.

• You need to check out our social media page. It’s bad.

I immediately felt my blood pressure surge as I opened McAfee’s company page on a very prominent social media platform, the name of which I have redacted from this true story. I was horrified.

Someone had deliberately defaced the social profile of our newly minted, 12-day-old company with the most obscene and offensive language directed at nearly every walk of life. This would be bad for any company. But let me try to express how desperately bad this was for us.

The offensive epithets were in stark contradiction to everything our company represented. We had just relaunched our brand with a new tagline, “Together is power,” reflecting our belief that it takes all kinds to protect our world from cyber threats. We had just unveiled new values to all employees upon our company’s launch, one of which espoused inclusive candor and transparency. And we were a leader in cybersecurity. How would customers feel about our ability to safeguard their most precious digital assets if we couldn’t even protect our own company’s profile on one of the largest social media platforms? And, to top it off, my team—the marketing organization—was responsible for managing our company profile across all social channels, including the debased one staring me in the face.

I jumped into action. I had to get to the leader of our digital team to figure out what was going on. I reached her immediately and didn’t even have to explain that the call wasn’t to wish her a Happy Easter.

• “I know why you’re calling. We’re on it. Our account was hacked. We’re talking to the [social media platform company] to get it resolved.”

I started to think the worst. A hacked social media profile was one thing. What if this was a coordinated attack against McAfee with a much bigger prize at stake, with hackers diverting our attention to this fire drill while they seeped in through our company’s systems?

She immediately reassured me that our chief information security officer (CISO) was already on the case, confirming our systems were good. Relief washed over me for a moment—until I realized I needed to make another call. Our CEO needed to know what was going on. And I preferred he hear the news from me. I was about to ruin his Easter Sunday. He picked up the phone almost instantly:

• “Chris, one of our social media accounts has been hacked.”
• His response was measured. “How bad is it?”
• “Our corporate servers are fine, Chris. It’s our corporate page on a social media site that’s been hacked.”

I explained to him just what had happened. Our social media manager, Gavin, was the first to discover the attack. Gavin had been at home, doing what social media geeks do on holidays—he was online. Around 5 p.m. he saw a status update on the social media platform with a bunch of random letters in it. He figured someone on his team had butt-dialed the update. Gavin deleted the random post.

He then pinged his team to see who might have accidentally created that post. No one knew anything about it. Soon, another meaningless post showed up. This was now not random.

Gavin logged into the social media platform and went to the account settings area. All the names were familiar of the people who had administrative privileges for the account. Even so, to be on the safe side, Gavin started to delete all other admins.

As he was doing that, his page refreshed, and Gavin was locked out.

There was now no doubt that this was malicious. In a moment, Gavin realized that his deleting the weird posts had alerted the hacker that McAfee was aware of the defacement. It was like the classic race in tech crime dramas with fingers flying on keyboards, spinning icons as processes complete and messages flashing as only Hollywood can bring to the screen. Gavin and our hacker were racing online to do the same thing. Even without the pulsing soundtrack, the tension was every bit as fraught with drama. Gavin said, “I was trying to delete all the other admins, and the hacker was doing the same thing. He beat me.”

Before I hung up with our CEO, I had one more piece of disappointing news to share.

• “Oh and Chris, when you go to our social profile page, you’ll now see not just the offensive posts, but also our company logo has been replaced with an image that looks like a bird. Look closer. It’s not a bird at all. It’s. Um. It’s body parts.”

It’s common in the hacker community to deface sites with obscene drawings to indicate that someone got “pwned,” hacker slang for being defeated in a humiliating way—for being “owned.” Now that the hacker knew we were locked out and he was in control for the time being, he added an obscene image to replace our new company logo, just for good measure.

My team frantically engaged the social media platform company to remediate the issue. But . . . things don’t happen quickly on holidays. And since this was now later in the evening, we were relegated to working with the company’s Asia-Pacific (APAC) group, making it seem as if time itself had to physically cross the ocean separating us and the support team. Minutes slowed to a crawl.

We waited for what seemed like an eternity. Because it was not our servers that were hacked, there was no big team from McAfee I could put on the third-party problem to fix it. We could only check in with the company’s support team every few minutes, only to be told they were “on it.”

After about 30 minutes, we received news that the social media company had locked out all admins from our company page, and only they had access now. That was the good news—at least no more damage would be done.

The bad news? They did not have a means to simply roll back the page to what was there 30 minutes before. Their procedure was to lock the page, so no further changes could be made, and then to follow a validation and analysis procedure: For validation, they wanted to make sure that we were who we said we were, and not a hacker calling up pretending to be McAfee (How ironic!). Then the analysis part kicked in, where they wanted to study the extent of the hack before taking any further action.

But what about the obscene image? It was still up on our corporate page. To make matters worse, the way this social media provider worked was that all employees who had personal pages on this platform and who said they worked for McAfee—their personal pages now sported the obscene image in place of our logo, too!

Including mine.

On the next update I received, the support team said they weren’t yet done with their “procedures.” They said the only way to roll back the page was first to reactivate the account—unlock it—and they were not going to do that until they finished their security review.

Seriously? How was this happening? Nothing could be done about our company page until they were done with their review. We were at their mercy. The most our employees could do was to delete any mention of McAfee on their own personal pages, which some who were aware of the event did.

But that wasn’t sufficient. I continued to ruin Easter Sunday for others as I alerted our executive team of the event. We had ensured our company’s servers were safe, but that didn’t mean McAfee wasn’t under attack through other social channels. And we certainly didn’t know whether our own executive members—and their social profile personas—weren’t the next target.

I took to email and group texts to sound the alarm, instructing our executive team to enable multifactor authentication on their personal profiles immediately on all social networking sites (more on multifactor authentication in a moment).

I followed my own advice and began frantically enabling the security feature on my personal profile pages wherever I could, that is, until I hit a very popular social networking platform where I became stumped. I’m not sure if my body was in the full throes of fight-or-flight (where the body redirects blood flow to major muscle groups to help one flee a threat or stand ready to combat—in other words, not the prefrontal cortex) or if the social media platform could have done a better job of not obscuring the safety capability. It was probably a bit of both. In either case, panic consumed me, and I resorted to a desperate measure: I deleted my personal profile—and all its history—on the social media platform altogether.

An hour stretched to two, then three, then four. I was regularly calling our CEO with the requisite, but annoying, status updates about our increasingly embarrassing vandalized company profile page. Calls that went something like:

• “Chris, we’re still working with them. They haven’t finished their security review. We’re hoping it will be resolved in 30 minutes.”

Lather, rinse, repeat—every 30 minutes.

It was on one of these calls that our CEO pulled a rabbit out of his hat.

• “Allison, I know of someone at the company and I’m tired of waiting on them to take action. I’m calling him.”
• “Excellent, Chris. We’ll keep the heat on the APAC team in the meantime.”

Chris made the connection and pleaded our case. Within 30 minutes of the call, the page was restored to its original state. I don’t know whether Chris’s call mattered, or whether the investigation simply had run its course and was completed. I just knew that the situation was now contained.

On Monday morning, we posted an article on our intranet site, letting every employee know what happened over the wee...