Why it is important to have a backup plan for cybersecurity breaches

Mike “MOD” O’Donnell is a professional director and facilitator. This column is MOD’s personal opinion but for full disclosure its noted that MOD is chair of the Cyber Security Advisory Committee.

OPINION: I was contemplating the benefits of buying a smart fridge online recently when I got an email alert from Kirsten Patterson, the CEO of the New Zealand Institute of Directors (IOD).

I don’t know Kirsten personally but, like me, she’s picked up a marketplace moniker based on her initials “KP”. So I’ve always felt some degree of good affinity for her.

But the content of the email wasn’t good. It told me that the IOD had experienced a security breach the previous day. Some nasty buggers had committed some sort of hack and they had got hold of some credit card information and were likely to have a go at using that information to undertake fraud.

READ MORE:
* Government websites inaccessible after being affected by privacy issue
* The future of Aotearoa’s economy depends on startups
* NZ at increased risk from pro-Russian cyberattacks, hackers, CyberCX says

The note went on to explain the guts of the breach and that the IOD had suspended all credit card facilities. And that they did not believe any other personal details had been accessed.

It also made clear that the IOD had connected with both the Office of the Privacy Commissioner and the state-run Computer Emergency Response Team (CERT) run out of MBIE.

It’s not the first time that the IOD has been the subject of cyberattack. Back in 2019 they were forced to shutter their web presence after a Brazilian hacker defaced their website.

The defacing included messages to “join the revolution” and encouraged visitors to tell the Government to f..k off. Not something the IOD would normally advocate…

KP’s note to me – both the speed of it relative to the attack time and the content in terms of telling me succinctly but not overly dramatically what had happened – was a useful datapoint on a few things.

First they were fairly quick off the mark letting people know.

Second they were in touch with the officials they should be when the cyber poop hits the fan. CERT to hopefully get some help on fixing the problem. The Privacy Commissioner to alert her that potentially privacy had been infringed and what they were doing about it.

Third they had taken what steps they could to ensure the stolen information couldn’t be harnessed for nefarious purposes (well hopefully not).

Standing back a bit further what the note showed is that it was likely that in the time between the IOD getting hit back in 2019 and this attack, they had prepared a cyber incident response plan.

Typically, part of a larger cybersecurity methodology, an incident response plan is a document that gives the organisation blow-by-blow instructions on how to respond to a serious security incident, such as a data breach, data leak or ransomware attack.

The United States National Institute of Standards and Technology (NIST), reckons decent incident response plans have four phases: preparation, detection, eradication and post-incident activity.

Customer communications – like the one IOD sent to me – typically fall into the recovery phase but also form part of the post-incident activity.

They are particularly important when the hack involves credentials harvesting or malware attacks, of which there are vast numbers every day.

According to CERT statistics, malware and credentials harvesting accounted for about 77 per cent of the 3977 reported cybersecurity incidents in Aotearoa over the last three months.

Mind you that’s just reported attacks. If you are generous and say half of all attacks are reported, that’s 8000 attacks in Aotearoa a quarter which works out to close to 50 every day. But its probably more.

So it’s not a matter of “if” you will experience a cybersecurity attack, but “when.” And nobody storing sensitive information is too secure to be hit. Just ask any of the banks (including the Reserve Bank).

Organisations don’t need to reinvent the wheel on this stuff. The Victorian State Government in Australia provide a useful free template for an incident response plan on their website. For smaller companies there are handy templates on GitHub.com .

The great thing about having a cyber incident response plan in place is that while you are putting it together you have the luxuries of time and calmness. It’s a hell of a lot harder to do that when your website is down, you’re staring down the barrel of a ransom demand and your customer support team are drowning in concerned customers.

Even if you’ve got a cyber incident response plan in place, it’s not a bad idea to update it as technology changes allow new attack vectors. A recent report from tech research gurus Gartner found the number one risk in 2022 to be the expansion of attack surfaces.

That’s just a flash way of saying that as the internet starts controlling everything from your refrigerator to your vehicle fleet and open-source code becomes endemic in cloud-based corporate infrastructure; there are a hell of a lot more ways to break into your system.

As a result we’ve seen Coke Machines at the CIA, baby monitors of public officials and corporate Jeeps being targeted by hackers. Its just a matter of time until there is a major breach via an Internet Of Things (IOT) back door.

Speaking of which I’m giving up on the idea of a smart fridge.