Cyber Mayday and the Day After

A Leader's Guide to Preparing, Managing, and Recovering from Inevitable Business Disruptions

Daniel Lohrmann, Shamane Tan

• Publisher: Wiley
• Year: 2021
• ISBN:
  9781119835318
• Edition: 1
• Topic: Business
• Subtopic: Industria informatica
• Index: Business

Successfully lead your company through the worst crises with this first-hand look at emergency leadership

Cyber security failures made for splashy headlines in recent years, giving us some of the most spectacular stories of the year. From the Solar Winds hack to the Colonial Pipeline ransomware event, these incidents highlighted the centrality of competent crisis leadership.

Cyber Mayday and the Day After offers readers a roadmap to leading organizations through dramatic emergencies by mining the wisdom of C-level executives from around the globe. It's loaded with interviews with managers and leaders who've been through the crucible and survived to tell the tale.

From former FBI agents to Chief Information Security Officers, these leaders led their companies and agencies through the worst of times and share their hands-on wisdom. In this book, you'll find out:

• What leaders wish they'd known before an emergency and how they've created a crisis game plan for future situations
• How executive-level media responses can maintain – or shatter – consumer and public trust in your firm
• How to use communication, coordination, teamwork, and partnerships with vendors and law enforcement to implement your crisis response

Cyber Mayday and the Day After is a must-read experience that offers managers, executives, and other current or aspiring leaders a first-hand look at how to lead others through rapidly evolving crises.

PART I
A Leader's Guide to Preparing for the Inevitable

CHAPTER 1
If I Had a Time Machine

The real trick in life is to turn hindsight into foresight that reveals insight.

—Robin Sharma

Imagine going back in time to watch and listen and change things.

Where would you go? And to what point in time?

Do you have the knowledge, tools, and influence to change things for the better? If so, who would you interact with to alter the specific outcome(s)? What one (or perhaps two or three) things would you do differently, and why?

Yes, you can ponder these questions about virtually any area of life. However, this book specifically addresses cybersecurity incidents or other emergency situations that contain significant cyber components that have in the past, or are in the present, or will in the future, impact global organizations in substantial ways.

Stretching further, society is growing even more reliant on resilient infrastructures that demand functioning cyber protections that involve people, process, and technology components. If we fail, the consequences will be dramatic in real life.

This journey must start with the lessons from the past. We can learn from stories from global cyber leaders and practitioners who have been through cyberattacks and come out stronger. Along the way, we will point to frameworks, checklists, standards, protocols, white papers, and other helpful materials.

If we are going to be equipped for the inevitable cyber storms that are coming in the decades ahead, we must learn from each other and improve faster than the bad actors who are causing such online destruction. In doing so, we first explore what works and is repeatable regarding cyber incident response.

STARTING WITH THE UNKNOWNS – OR NOT?

“I don't want to know, and I don't care to know. If I don't know about it, it does not exist.” Shocking, but in fact, there are many business leaders who think this way.

The truth is that sometimes, some data takes only a minimal effort to discover, and when you realize the type of information that is available out there and accessible to anyone (including malicious actors), then you will have no choice but to care. As the chief growth officer at Privasec (a Sekuro company), a top-tier and agnostic cybersecurity firm, Shamane leads the security outreach strategy team, spearheading industry awareness initiatives while working closely with the CISOs (chief information security officers) in bridging their business gaps. She met Todd Carroll, a former 20-year FBI cyber intelligence leader, virtually, in a cyber security summit she organized, where he shared an intriguing story. Todd walked through one of the real-world findings that CybelAngel's data leak detection technology came across a few years ago.¹ CybelAngel detects exposed data, devices, and services outside the enterprise's perimeter, enabling remediation before the exposure is weaponized. In this instance, it detected several pieces of information that exposed a bigger issue involving several airports, their ecosystem, and exposure of their data.

The thing is, data is always being shared. The aviation industry, like other industries, works with third parties. The moment any organization shares information with a third party, it loses visibility or control over what is done with the data, despite their best efforts or intentions.

In this case, when CybelAngel performed a search and monitoring on keywords related to airport security, they detected nearly 10,000 servers that were publicly available, on which over 400 blueprints of airports worldwide were identified, sitting on unprotected third-party connected devices, or in misconfigured cloud storage.

Some of these blueprints were extremely detailed, including the location and angle of the security cameras, revealing which were motion activated or had facial recognition capabilities and even precise information on how to access and take control of them. In addition, these blueprints contained the location of the detention rooms that are hidden from the public, runways, and the position of the fuel lines from the tanks leading to the runway where fuel is pumped into the wings of the aircraft.

There were blank signed templates of security application access forms that, if compromised, would have allowed access into the airport facilities. There were also completed security badge application forms with official stamps and signatures, and over 300 files describing safety procedures and policies. Those procedures included instructions on how to bypass the whole security system, and how to deactivate it.

There were also identity details of air marshals and departure and arrival dates, as well as the list of weapons they are allowed to carry on planes. Such intricate information can easily serve as a blueprint for a terrorist attack.

The frightening part of all of this is that the data was found on third-party servers in many countries, including the United States, France, the UK, India, Spain, and others.

It was fortunate that the findings were reported to the impacted organizations in time and the FBI and Interpol worked on closing the thousands of open servers around the globe. Imagine the terrorism disaster that could have occurred had this information not been discovered due to a lack of interest and blind obliviousness.

As the world continues establishing even more interconnectivity, it becomes more critical than ever to position industry leaders to have better foresight before a crisis even happens.

AN ISOLATED PERSPECTIVE HAS MANY LIMITS

John Yates, QPM, is a former assistant commissioner in the London Metropolitan Police Service. He retired in November 2011 after a 30-year career. In his last role, John was the UK lead for counterterrorism and the most senior advisor to the prime minister and home secretary on law enforcement issues relating to terrorism. In this role he was also responsible for protecting the royal family and senior government ministers as well as the Houses of Parliament and Heathrow Airport.

John is currently the director of security for Scentre Group, which owns and operates Westfield Shopping Centres in Australia and New Zealand. He shared his lessons for the cyber industry from his counterterrorism days:

“One of the key roles of leaders is to keep out of the weeds and be constantly looking up, thinking broadly and identifying trends. I want to talk about a relatively little known case in London in 2010. It was a case that should have been examined in much more detail because it was one of the principal precursors to a deadly and murderous shift – the radicalization of predominantly young people – that plagued the efforts of those seeking to counter terrorism for many years and, indeed, continues to do so.”

In a time where radicalization was little understood, particularly by young vulnerable people, Roshonara Choudhry, a final-year student at King's College, London, and from a good Bangladeshi family, brought two knives to Beckton Globe Library, where MP Stephen Timms was conducting his constituency clinic. Choudhry stabbed Timms twice in his abdomen.

“She missed his life organs by two millimeters. He nearly died.” John further explained that Timms was the most popular MP in the country at that time, and he represented a community with a large population of Muslim residents. Yet Choudhry targeted him because he voted for the Iraq war. Despite Timms's work in the community, Choudhry had been radicalized online.

John continued, “This case was initially dealt with by the local homicide squad. It took us over 24 hours to realize that this was in fact a terrorist attack, being that it clearly fit the long accepted definition – the unlawful use of violence and intimidation for political or ideological aims.

“It was actually the first successful terrorist attack in London since the July bombings in 2005. So at the time, the case was taken over by the counterterrorism command and Choudhry was convicted and sentenced to life imprisonment.

“But we stopped there. For two years, we didn't really do anything, and then suddenly the whole problem of people being radicalized began to play out in developed countries, particularly in the Western world. ISIS emerged and the online community became an effective vector to radicalize people.

“What happened in 2010 was a significant event. What we failed to do was to identify the broader implications – that Al Qaeda...