Building capability and community through cyber-incident response exercises

Area of Science:

• Cybersecurity
• Organizational Resilience
• Incident Management

Background:

• Organizations face inevitable cyber attacks, necessitating robust preparedness.
• Traditional incident response (IR) exercises can be infrequent and resource-intensive.
• Business continuity management (BCM) and resilience teams possess relevant expertise.

Purpose of the Study:

• To propose a strategy for enhancing organizational preparedness against cyber attacks.
• To highlight the benefits of integrating BCM/resilience staff into IR exercises.
• To demonstrate how frequent, lightweight IR exercises improve response capabilities.

Main Methods:

• Advocating for lightweight and frequent incident response (IR) exercises.
• Leveraging established relationships between information security and BCM/resilience departments.
• Analyzing the impact of BCM engagement on IR effectiveness.

Main Results:

• Frequent IR exercises build capabilities and community through a recurring cycle.
• Collaboration with BCM/resilience staff streamlines IR exercise facilitation.
• BCM engagement demonstrably improves incident response time and reduces costs.

Conclusions:

• Involving BCM or resilience departments in IR exercises leads to more effective responses to actual cyber incidents.
• Proactive collaboration between information security and BCM is crucial for cyber resilience.
• Lightweight, frequent IR exercises are key to bolstering organizational defense against cyber threats.