Category: Insights

The reality is that penetration testing provides no guarantees of security and does not address the weaknesses in an organisation’s ability to detect and respond to a sophisticated attack; or its ability to manage a cyber crisis and take the timely decisions to enact cyber defence or system continuity plans. Consequently, there is a need for more sophisticated and technically based crisis exercises to identify causes of failure and to provide training, education and awareness.

To most firms, a real-world attack simulation is as much a ‘game changer’ as actually being targeted. In both cases, firms can expect to learn hard lessons, but the war game process ensures that the organisation is ready to absorb the lessons and identify the benefits without the pain or damage of an actual breach. This point cannot be underestimated. In a real event there is invariably a catalogue of human and management failures consistent with the inability to think clearly under pressure.

In reality, most lessons are only learnt after a real event, even when the overriding climate is negative or less orientated towards learning. A cyber attack war game, which simulates a prolonged attack, aims to provide lessons before a real event, and enables learning during an attack. In short, it can develop a firm’s ability to interpret and apply experience into real-time learning.

Cyber security war games derive significant learning across multiple levels of decision-makers, and can be structured specifically to bring together the C-suite, security leadership team, security operations centre and incident response, as well as the forensics, risk and crisis management teams. War gaming is an excellent and effective way for large organisations to identify the weaknesses in communications and coordination between these groups. In times of crisis, the cascading effects of an attack and the impacts are often exacerbated by the decisions taken, and the process of decision-making by these groups. Learning how these groups take certain decisions when faced with uncertainties, or adapt and enact response plans when tackling ‘unknowns’, is vital to a successful response and the successful building of cyber resilience within an organisation.

How do cyber attack war games work?

A well-crafted cyber security war game incorporates both a ‘fundamental surprise’ that the organisation had not anticipated and a number of ‘situational surprises’ – known cyber risks for which the organisation has little or no advanced warning. Much of the pre-exercise planning should aim at developing appropriate knowledge and intelligence in order to define the exercise in a manner that can be controlled and developed over time and tests the different capabilities.

The ‘storyline’ can commence with a technical event to kick off the assessment of initial implications, and the event would then be developed through situational feeds from the directorate. The initial objectives should be to test detection: by the systems; by the incident response team; and the analysis of the forensic team. More can then be provided by the directorate including intelligence, such as analysis of the threat community, IP information, and pieces of a malware. The exercise can then examine the fundamentals of communication and decision-making, specifically:

• who is taking decisions and on what basis?
• what is the process of taking alerts/indications and deriving useful information from then?
• how is information then transformed into knowledge throughout this first technical phase?

At this point, a major new technical event may be introduced, or the original event may be taken in a new direction to trigger a new cycle of detection and decision-making. Evaluation may focus more on how the new event affects the decisions previously taken, the need for additional resources, and whether a new risk assessment should take place. With a second-phase escalation of the attack, the evaluation can examine who is assessing the risk throughout the event, who is involved in the process, what indicators are in place, and how they conduct a timely assessment of the possible implications from the new event.

Using this approach will allow escalation towards the involvement of the crisis management team, and an examination of their team, what stage they were involved and how they receive the relevant information. The exercise can also test the team’s communication effectiveness, who precisely was involved and how they supported the whole process.

Building cyber resilience

The more significant element in the learning process is the incorporation of observation, decision-logging, and mentoring as part of the war game process, while a full debrief and post-exercise workshop should establish lessons learnt, capability gaps and the modifications required in technology and processes.

The ‘learning by doing’ opportunity that war games provide identifies failures in breach incident response as well as failures in security. This should ensure a balance between security and implementing the appropriate response, but also offer a list of immediate tactical priorities for remediation, as well as short-term changes. It can also pick up previously peripheral issues that had not been addressed or prioritised specifically because they may have been proven to be more critical to the overall security apparatus than previously recognised. Often these are ‘human’ aspects known to be weaknesses, though not recognised and addressed at an organisational level.

By establishing the right cyber attack war game framework, the learning objectives are set at the top of the agenda if the organisation is astute enough to accept that a breach will occur, and the success is measured by how it deals with this.

The iterative process of this type of workshop can offer a forum for planning that integrates investment, and priorities between prevention, defence, and a shared understanding of the converged nature of cyber risk. This pre-emptive approach to developing effective cyber defence and identifying causes of future failure identifies priorities for response training, and the development of a response doctrine that can provide an organisation with agility and options.

Conduct a cyber war game

At ESA Risk, we can design and run a cyber war game specific to your business. If you would like to learn more about cyber security, war games and/or building cyber resilience within your organisation, please contact us.

Graeme McGowan, Cyber Risk & Security Consultant at ESA Risk, reveals the biggest cyber security threat posed to businesses in the UK.

It’s the leading cause of reported data security breaches, according to the Information Commissioner’s Office (ICO), and arguably the largest enabler of malware infections and cyber attacks.

He also outlines ways the risks posed by this threat can be minimised.

What is the biggest cyber security threat?

While many people might expect the answer to be the latest malware in circulation or an organised group of hackers, the actual answer is more simple and closer to home…

Human error is arguably the largest enabler of cyber attacks and malware infections. Many people are not aware of the tell-tale signs or preventative measures to take when it comes to cyber security.

The ICO has reported human error as the leading cause of reported data breaches, highlighting a need to amend this. In turn, it is now handing out fines to organisations following data breaches, as a reverse incentive to push companies to educate their staff and thereby avoid potential breaches in future.

Businesses are not fined if they have a sufficient protocol in place guarding against human error, but small companies are being particularly hit hard because of gross negligence and a lack of staff training leading to employee mistakes.

A simple example:

Firm X sent out personal data in respect of an individual and their family via email and post. A lack of security meant that unconnected third parties, who had no way of knowing the sensitivity of the content of the post and emails, then unintentionally had access to the sensitive personal data. The unconnected third parties were accidentally included on the email and therefore received the data, most likely by the fault of the sender who seemingly did not check the recipient/s they were sending the email to.

A complaint was made by the individual concerned following the unauthorised disclosures and an investigation into the incident revealed that repeated human error was to blame for the breach, resulting in a £10,000 fine being handed to the firm.

Why was the fine so large?

The ICO has noted that the fine is reflective of the firm’s disappointing response to the complaint and its failure to engage appropriately or show an understanding of the impact of the breach on the individual. The lesson here is that, in itself, a breach of data protection rules will not automatically incur a penalty. However, inadequate safeguarding measures followed by a delayed or obstructive (or even just negligent) response to a breach may lead to investigation and subsequent fines from the ICO.

Human error will always be a risk, but the response to that error is what is important both in terms of limiting any sanctions and maintaining a positive relationship between a business and the individuals with whom it deals.

Where does the risk lie?

Lack of understanding or awareness may mean:

• A subject access request goes unanswered or is delayed.
• Misuse of personal data, e.g. it is used to contact individuals without consent.
• Personal data is used for purposes outside of the purpose for collection of that data.
• Personal data is inadvertently provided to unconnected parties.
• Delayed or no action following a security breach.
• Failure to update records or delete records.

All of the above would be breaches of the General Data Protection Regulation (GDPR) and may require immediate action or even reporting, depending on the circumstances.

How do we prevent or minimise the ‘human error factor’?

In three words: training, education and awareness.

Compliance with GDPR cannot rely just on software systems and one data protection manager.

All individuals within organisations from the cleaner to the CEO need to be aware of how data protection compliance impacts on their role and what their responsibilities might be. In a few cases, there may legitimately be none, but it is important for the knowledge to be there and for staff to be alert and aware of cyber security protocol.

In order to combat this risk and employee lack of awareness, training should be provided to staff at induction and at regular intervals, especially if their role and responsibilities change. It is also crucial that staff know what to do if an error occurs and a cyber security threat appears. Communication at the earliest point is key in handling a breach, so creating a culture of trust is critical.

Once the training and understanding is in place, investment in the technology to support good data protection procedures will enhance those procedures and allow easy management of the various tasks and obligations.

Cyber security services from ESA Risk

We’re here when you need us. We provide both passive and reactive support services, which are scalable and quick to deploy in crisis situations, giving you precious additional time at critical moments. Contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form to find out more.

Develop your cyber security knowledge with 1 of our cyber security courses, provided by the Global Cyber Academy.