By Leland Bettis, VP CyberSponse Inc.
Defence is not enough: plan for the breach
A strong defence is not only important, it is critical. Without a focused defensive posture, including adaptation to emerging threats and preparation to fight the next war, you will be overrun.
But even the best defensive tools and strategies do not make for an inviolable structure. Cities are besieged. Armies have marched over, under and around barriers for centuries. Radar can be eluded. The lever of asymmetric warfare is exploitation of real and virtual weaknesses of even the best-funded and defended adversary. If spies and covert actors are not already in your midst, recruits should be expected.
At some point and at some level, all IT systems will be breached. The question is, what is your plan to mitigate the effect when it happens to you?
- Do you have containment, eradication and recovery plans?
- Have you optimised your response processes with a clearly defined command topology, observable and accountable action steps in a predefined workflow, communication protocols for technical and supporting roles, and the right level of process automation?
A response plan is evidence of preparation. Preparation is more critical to thwarting bad actors quickly in your environment than several rooms full of cyber SMEs with plans stuck in their heads.
As the fog of war descends on a breached environment, a plan for the way forward is pivotal. As Colonel VanDriel put it in Bridging the Planning Gap: Incorporating Cyberspace Into Operational Planning (2015): if a commander ignores planning for cyberspace, not only will that commander have ceded the cyberspace domain to the adversary, the adversary can then proceed to undermine that commander's effectiveness in the other four domains of warfare.
No plan is perfect against every iteration of malevolence that threat actors will dispatch. In responding to a breach, a lot of people need to get a lot of things done, often simultaneously. Spending time and resources during a breach deciding what should be done, and by whom, wastes critical time and leads to unforced errors. The more automated your predefined plan, the more efficient it will be in practice, with an auditable post-incident capture.
Originally published 8 July 2015. Migrated to the new IRC site in 2026.