As if a global pandemic weren’t enough to contend with, cyberattacks are also on the rise. Since the start of 2020, we’ve seen an unprecedented surge in attempted hacks. In the first quarter alone, there were 854,000 confirmed phishing attacks, and 240 million COVID-19-related spam messages are sent over Gmail every single day.
The chaos created by the pandemic just illustrates the need for organizations to have a global playbook to help their IT departments navigate the cybersecurity landscape. Just as in football, a cybersecurity playbook can help define your team’s roles and responsibilities and lay out a framework to respond to potential threats.
Having this comprehensive, step-by-step manual in place will allow your team to:
1. Orchestrate perfectly coordinated responses. You can think of your IT department just like a football team: Every game is won one play at a time, and a play doesn’t work if the quarterback suddenly decides that he’d rather play defense than move the ball.
In the same way, everyone in your IT department should have defined roles and clear responsibilities. The best way to facilitate this is by creating a cybersecurity playbook. When everyone is operating from the same set of instructions, nothing ever gets overlooked because each person on your team knows what he or she is responsible for.
2. Get better insights from your SIEM software. If your organization relies on SIEM security software, a global playbook can simplify the process of sifting through notifications and taking action on alerts. Today, one of the greatest pain points for IT departments is alert fatigue. Thirty-one percent of IT security professionals admit to ignoring security alerts due to false positives, and 40 percent say the alerts they receive lack actionable intelligence.
It’s the classic boy-who-cried-wolf scenario, but organizations like SIEM-as-a-service provider StratoZen are committed to tackling this problem head-on. Rather than getting a generic one-sentence alert after an incident, the integration of enhanced notifications into global playbooks give enterprise clients enhanced notifications with the possible cause of the incident, an explanation of the alert, and actions the IT department should take to remedy the issue.
3. Respond more quickly to threats. When it comes to minimizing the cost of a data breach, time is money. According to a 2020 report, the average cost of a data breach was $3.86 million, and the average dwell time was 280 days. But the same report found that cutting the dwell time to under 200 days saved organizations $1 million on average.
Ideally, your team would be able to stop a breach the second it occurred. But that’s simply not going to be possible unless you’ve laid out a clear framework for how your team should respond to threats and drilled the actions they need to take.
Consider this scenario: At four o’clock in the afternoon, your SIEM system alerts the team at your New York office to a potential attack in progress. The team takes action to contain the breach, but they’re unsure which data may have been affected. It’s critical that they reach out to the London team to perform a full investigation and notify the appropriate people, but it’s nine o’clock in the evening there.
Luckily, your team has a global playbook for exactly this type of scenario. Every person in your department knows which steps to take to minimize the damage, and the plan unfolds with military precision. The New York office reaches out to the data protection officer in London, and all necessary personnel from legal to PR are notified within the hour.
4. Stay compliant with regulatory frameworks. Having a clearly defined incident response plan is especially critical when your organization does business globally. Your customers may fall under the protection of the EU’s GDPR, which means that your company may be in serious legal hot water if your team doesn’t follow the appropriate steps in the wake of a breach.
The European Union isn’t the only entity that has such regulations. The state of California signed its own consumer privacy act into place in 2018, and that same year, Brazil passed the General Data Protection Law. Hong Kong, Serbia, and Jersey have amended their data-protection laws, as well, and it won’t be long before we see even more regulations across the globe. Having a formal process in place ensures that every I is dotted and every T is crossed with regard to notifying the appropriate people and assessing the scope of the breach.
Tom Brady never won a Super Bowl all on his own. Likewise, defending your organization from cyber threats requires a coordinated team effort, and the best way to ensure your IT personnel are all on the same page is to create a global playbook. When every employee knows the role he or she will play during and after an incident, your team will have no trouble intercepting any threat that comes their way.
