Step 5: Recover

The growing severity and frequency of cyber-attacks show no sign of letting up which means true cyber resilience must include comprehensive recovery planning. Formalized and tested plans enable rapid recovery from incidents, helping to minimize the impact and ensuring effective communication to both internal and external audiences – a vital element of the long-term protection of a business’s reputation.

NIST states that recovery needs to address three critical outcomes:

• Recovery planning: recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cyber security events.
• Improvements: recovery planning and processes are improved by incorporating lessons learned into future activities.
• Communications: restoration activities are coordinated with internal and external parties, such as coordinating centers, Internet Service Providers, owners of attacked systems, victims, other Computer Security Incident Response Teams, and vendors.

Preparing for the expected requires detailed planning for the recovery from a cyber-attack and having that plan as part of your information security program. The plan should document system dependencies and identify key personnel including their specific roles in incident management. The plan should also provide for back-up to regular communication services and tie into your organization’s overall Business Continuity Plan (BCP).

Having a documented playbook allows you to consider various scenarios that evaluate impacts, responses and recovery processes before an actual cyber-attack takes place. Remember that many such attacks are launched and remain undetected for an average of 206 days, underscoring the need to build playbooks that quickly restore critical business functions after detection and response.

NIST provides helpful advice in terms of developing playbooks in its “Guide for Cybersecurity Event Recovery” including recovery scenarios and checklists for what should be included. The playbook is divided into three sections: pre-conditions required for effective recovery; tactical recovery phase; and strategic recovery phase. For example, NIST recommends in the tactical recovery phase that there is an ‘initiation’ step that includes receiving a “briefing from the incident response team to understand the extent of the cyber event” and informing “all parties that the recovery activities have been initiated.”

Scenario planning also plays an important role in the testing of current incident recovery capabilities. This aspect usually requires outside assistance from Incident Response (IR) experts who have experience in responding to real world incidents and can advise on the necessary recovery process to have in place. They can help simulate a real breach and stress test your response plan. Reality-based tabletop exercises are also invaluable in getting ahead of impending attacks especially when conducted with an after-action debrief document, helping to identify gaps and delivering reports that prioritize results and recommendations for improvement.

The evolution of digitization means the risks from cyber are only going to increase as hackers find new ways to exploit system vulnerabilities and disrupt organizations. Consequently, cyber insurance has a central role to play in how a business manages and mitigates the risk. Cyber insurance can protect an organization’s balance sheet by providing a financial pay-out after things have gone wrong, but it also offers expert consultancy to improve security and on-the-ground incident response support during a crisis. Two of the key benefits of cyber insurance are pre-loss prevention to try and stop an incident from happening in the first place and post-loss services to help organizations recover more quickly.