Cyber Threats Have Evolved. It’s Time Our Preparedness Does, Too.

We’re living in an era of increasingly sophisticated cyber threats. Every organization, regardless of its size, stands in the crosshairs. Conventional reactive measures, while essential, are no longer enough.

Plan. Prepare. Protect.

Why We Partnered with Crowell & Moring

We collaborated with the esteemed international law firm, Crowell & Moring because, like us, they recognize that there is no better tool than preparedness. We believe making this guide publicly available to a wider audience is vastly more valuable than any short term monetary gain.

What’s Inside: Real-World Scenarios, Real-Time Solutions

Our guide delves into three curated scenarios based on real-life events. For each, the guide offers a multi-faceted overview of areas that need to be considered — spanning incident response, business continuity strategies, legal risks, out-of-band communications, and post-incident responsibilities.

A Peek Into the Scenarios:

• • When disaster strikes: A ransomware attack occurs and a demand is coming.

• • Staying alive: Threat actors access privileged credentials and may still be in company systems.

• • Rogue executive: Potential loss of sensitive information upon an executive’s departure.

Why Now? A Look at Current Trends

The urgency for bolstering cybersecurity preparedness is driven by:

• • Regulatory Push: Bodies like the New York Department of Financial Services (NYDFS) and the U.S. Securities and Exchange Commission (SEC) are emphasizing cybersecurity preparedness. For instance, the NYDFS has proposed rules that require incident response plan testing. Simultaneously, the SEC has issued rules that will prompt public companies to engage in incident response tabletop exercises. Notably, sectors like energy aren’t left behind, NERC has mandates on cybersecurity drills for certain assets, which can be done through tabletop exercises. Finally, the U.S. Cybersecurity and Infrastructure Agency (CISA) also strongly recommends organizations conduct tabletop exercises.

• • Communication Challenges: The recent CSRB report underscores the inadequacies of existing communication tools during a cyber crisis. CISA noted, “Organizations that maintained and followed their established incident response procedures significantly mitigated impacts. Highly effective organizations employed mechanisms such as out-of-band communications that allowed incident response professionals to coordinate response efforts without being monitored by the threat actors.”

• • Discovery Delays: Despite monumental investments in cybersecurity, the mean time required to discover cyber adversaries lurking within your networks is not being reduced. According to IBM Security’s Cost of a Data Breach Report 2023, the mean time to identify a breach has taken place is still more than 200 days.

Our Vision: A Collaborative Cyber Resilient Future

This guide isn’t just about cybersecurity. It’s about fostering a culture of preparedness, resilience, and collective defense. In this collaborative spirit, we’ve released the guide to the public, governed by a Creative Commons (CC-BY-NC) license. This license ensures free use, distribution, and modification, provided due credit is given to ArmorText and Crowell & Moring.

Final Thoughts

Cyber threats may be relentless, but with the right tools and mindset, organizations can stay a step ahead. Cyber Resilience: Incident Response Tabletop Exercises 2023 is our contribution to this effort. We hope it empowers organizations to elevate their cyber resilience game.