Are you confident that your organization is well-equipped to handle a cyber crisis? Watch the recording of the webinar to discover the role people and technology play in executing an effective crisis management procedure.
Our CSIRT Investigations Manager, Robinson Delaugerre, and Solution Architect, Mathias Caluwaerts, will share their insights on minimizing downtime and maximizing recovery. Don't miss out on this opportunity to learn from the best.
1. On what security standard/model is this crisis management based?
This model is based on Orange Cyberdefense’s internal knowledge base, as no mature and internationally recognized standard exists for cyber crisis management. It is, however, in line with ISO 22361:2022.
2. What type of backup do you suggest as a replacement for having an external backup?
3. I found it interesting that when a backup is 'immutable,’ it is unusable to recover the systems. How was that possible?
It is intriguing that an immutable backup, despite its nature, can actually be rendered unusable for system recovery. This is because immutability is just one aspect of a comprehensive backup solution. In many backup architectures, there are multiple components that can be targeted by adversaries, potentially compromising the usability of the backups. As a simple example: there have been instances where backups were stored in an immutable manner on a NAS solution. Yet, the adversaries managed to gain access to the NAS system and completely wipe the entire volume. Or the indexing database got encrypted. Or tempering with the time protocol expired the backups prematurely. And the list goes on. While immutability is an essential feature, it is not a foolproof solution or a guaranteed safeguard on its own.
4. How do you look at backups for SAAS solutions? How far do you have to go here? Purely based on the SLAs of the provider, or do you go further?
When considering backups for SaaS solutions, it is essential to evaluate beyond just the SLAs (Service Level Agreements) provided by the SaaS provider. Ideally, if the SaaS provider offers capabilities for third-party backup vendors to perform backups, it is advisable to utilize those options. However, if such capabilities are not available, it becomes crucial to thoroughly review the SLAs and understand the details and provisions related to backup and data recovery. Going beyond the SLAs, it is recommended to assess the overall backup strategy and consider additional measures, such as implementing your own backup solutions or working with trusted third-party backup providers to ensure comprehensive data protection and recovery.
5. How often should we update our incident response plan?
Updating your incident response plan should be done regularly to ensure its effectiveness. As a best practice, it is recommended to review and update the plan at least annually or whenever there are significant changes in your organization's infrastructure, processes, or threat landscape. This means creating processes to ensure your risk management team is aware of those changes. Additionally, you should conduct regular tabletop exercises to test and refine the plan.
6. What are common challenges organizations face when testing and validating backups?
Organizations often encounter various challenges when testing and validating backups. One primary challenge involves guaranteeing the integrity and completeness of the backed-up data. Conducting regular test restores becomes crucial to verify the successful recovery of data. Additionally, managing the complexity of backup systems, addressing compatibility issues between backup solutions and the target environment, and ensuring proper protection of backup data against unauthorized access or loss are also common challenges faced during the testing and validation process.
7. How can we effectively train employees on incident response procedures?
Training employees on incident response procedures is vital for effective cyber resilience. Some effective approaches include conducting regular training sessions, workshops, and tabletop exercises. These activities should simulate realistic scenarios and involve different roles and departments within the organization. Consider leveraging interactive and engaging training materials, such as online modules or gamified exercises, to enhance employee understanding and retention of incident response procedures.
We also recommend that you use pre-production environments to test out data collection, system isolation, and rebuild from backup on systems as close to production as possible.
8. How can organizations ensure ongoing evaluation and improvement of their cyber resilience strategies?
Ongoing evaluation and improvement are key to maintaining robust cyber resilience. Organizations should regularly assess their cybersecurity posture through vulnerability assessments, penetration testing, and security audits. Incident post-mortems or lessons-learned exercises should be conducted after any cyber incident to identify areas for improvement. Additionally, staying up to date with the latest threats, technologies, and industry best practices through continuous learning and engagement with the cybersecurity community is vital.
