Sharing After the Storm: Fostering Transparency in Post-Ransomware Response

Ransomware attacks are a harsh reality of the digital age. But what happens after the dust settles? While the focus is rightfully on recovery, a crucial step often gets overlooked: Sharing Post Incident Response (PIR). This blog post, inspired by a talk given by Claire Patterson from the University of Kent, at the Impact Conference in London earlier this year, https://www.theimpactconference.com/impact-uk/delves into the complex world of information sharing following a cyber attack.

The Paradox of Transparency: Sharing vs Secrecy

Companies face a dilemma - should they be transparent about cyberattacks? Sharing valuable insights with peers can strengthen collective defences. However, legal concerns and reputational damage fears often lead to secrecy.

Benefits of Sharing PIR Data

Collective Defence: Shared knowledge on attack vectors, malware strains, and attacker tactics equips everyone to better prepare.
Improved Response: Learning from others’ experiences can expedite response times and minimise downtime.
Trend Identification: Recognising common attack patterns helps security professionals anticipate and pre-empt future threats.

Downsides of Sharing PIR Data

Legal Concerns: Data breaches may trigger regulatory reporting requirements, and sharing sensitive information could complicate investigations.
Reputational Damage: Public disclosure of a cyberattack can erode consumer trust and damage a company’s image.
Internal Resistance: A culture of secrecy within an organisation might hinder information sharing within teams or with external parties.

Fostering a Culture of Sharing

Building a culture of information sharing necessitates a shift in mindset. Here are some key steps:

Clear Reporting Structures: Establish well-defined protocols for reporting cyber incidents internally and to relevant authorities.
Regular Updates to Reporters: Keep stakeholders informed throughout the incident response process and share post-mortem reports with insights.
I am a firm believer that the definition of integrity, is doing the right thing, even when no one is looking.

Who to Share With?

Strategic information sharing is critical. Consider the following:

Trusted Peers: Collaborate with industry partners who have faced similar attacks.
Suppliers: Early engagement with critical suppliers ensures a coordinated response that minimises supply chain disruption, and can in fact build trust.

Post-Incident Review: Learning from the Breach

A thorough post-incident review is vital for effective PIR. Key participants include:

C-Suite Executives: Their involvement demonstrates leadership commitment to cybersecurity.
Security Teams: Sharing their experiences on the frontline helps identify areas for improvement.
Legal Teams: Lessons learned how legal decisions can effect the wider response of a company.
Media Teams: How was the incident managed and how can it be improved for internal and external communications.

Identifying Themes and Learning Lessons

The review should focus on identifying:

Themes: Recurring patterns in the attack that highlight vulnerabilities in the existing security posture.
Lessons Learned: Actionable insights that can be translated into concrete steps to address identified risks and prevent future attacks.

Learning from the Wider Community: Insights from ICO Data

The Information Commissioner’s Office (ICO) in the UK collects data on cyber incidents. Analysing this data can reveal broader industry trends in cyberattacks and inform collective responses.

Conclusion

Sharing PIR data is a double-edged sword. While legal concerns are valid, the benefits of collective defence and improved preparedness outweigh the risks. By fostering a culture of transparency and collaboration, organisations can emerge from a ransomware attack stronger and better equipped to face future threats.

Remember, knowledge is power. Sharing the right lessons learned from a cyberattack can empower the entire cybersecurity community to build a more resilient digital landscape.