A cyber crisis? Don’t just prepare your IT – prepare your entire organisation
#cybersecurity #businesscontinuity #crisismanagement
Two recent cyberattacks in the retail sector demonstrate how quickly a digital incident can escalate into an operational crisis.
At Ahold Delhaize, a cyberattack caused problems at Albert Heijn and Delhaize, amongst others. After suspicious activity was detected, various IT systems were taken offline as a precautionary measure. This had an immediate impact on operations: online orders were disrupted, distribution was affected and certain digital services were temporarily unavailable.
That same week, supermarkets in France, including Intermarché, were also hit by a cyberattack, but with very different consequences. Hackers remotely manipulated the systems of refrigeration units, resulting in the loss of large quantities of fresh and frozen food. According to VRT NWS, an Intermarché in Haguenau lost its entire stock of frozen products, amounting to an estimated 50,000 euros in damages.
Two different attacks, but the same conclusion: a cyber incident doesn’t stop at IT.
A cyber incident doesn't stop at IT
When IT systems fail, the consequences are rarely limited to the IT department. Logistics, production, sales, communications, customer service and other critical processes can also be affected.
At Ahold Delhaize, taking systems offline as a preventative measure was a drastic step with operational consequences. At Intermarché, the attack directly affected a physical business process, resulting in the loss of products.
A cyber incident can thus escalate into a company-wide crisis in a very short space of time. The general crisis management plan, the Cyber Security Incident Response Plan and the Disaster Recovery Plan each have their own function, but come together when a serious cyber disruption threatens business continuity.
Don’t just prepare your IT – prepare your entire organisation
Tip #1: Link cyber security to crisis management
Make sure it is clear when an IT incident should be escalated to the crisis team. IT can deal with the technical attack, but decisions regarding business continuity, stakeholders and reputation require a multidisciplinary approach.
Tip #2: think about business continuity in advance
What if critical systems suddenly become unavailable? Or if technology that is essential for storage, production or logistics is affected? Determine which processes absolutely must continue to run, what temporary alternatives are available, and which activities you might deliberately suspend to avoid greater damage. A business continuity plan helps to establish priorities and emergency procedures in advance, so that no valuable time is lost during a crisis.
Tip #3: don’t wait until you know everything before you communicate
In the event of a cyber incident, full details are rarely available straight away. That does not mean you should remain silent. Communicate what you do know, what the noticeable consequences are, what measures you are taking, and when stakeholders can expect the next update.
Exercise in the spotlight: Table Top Cyber Security
Test your crisis team when they are faced with a (simulated) cyberattack
During the Cyber Security tabletop exercise, we’ll put your crisis management team through their paces with a simulated hacking attack. How do they organise the team when systems go offline? What contingency plans are in place, and how much support can they provide? How do they tackle the crisis, and how does the team communicate?
Learning points
Crisis communication: develop reflexes, not thick books
Are you really ready to tackle a crisis… or do you just think you are? Many organisations rely on detailed plans, but under pressure these often prove worthless. In a world of...
Extortion and internal threats: is your crisis management up to the task when faced with criminal acts?
The recent extortion case at baby food manufacturer HiPP shows that deliberate contamination is a real risk. However, criminal acts are not among the top priorities for food com...
4% affected, 60% unprepared: time for cyber resilience in the food sector
Food companies are therefore an attractive target, 60% of which do not have a Cyber Incident Response Plan. Moreover, warfare today takes place largely online. How can you bette...