Delta Crisis Management

Everyone at it-sa right now is talking about how to prevent and respond to cyberattacks. But what happens when the attackers get through? That’s when a technical incident becomes an executive crisis. We’re here in Nürnberg to talk about the decisions that follow, and how to prepare for them. Come find us at it-sa – Home of IT Security in - we’re with our great partners G DATA CyberDefense in Hall 7A

POV: You’re the CEO of a company with 40 employees. You arrive at work on a Tuesday morning and nothing works. Company has been hacked. Your employees are calling, customers are waiting for answers, and somebody from IT tells you that the systems have been encrypted. Shortly afterwards, you discover that criminals are demanding money to give you access to your own business again. No crisis management department, no in-house legal team, no communications advisers standing by, and probably nobody in the organisation who has ever experienced anything remotely like this before. But the criminals on the other side? They do this for a living. I was at Danske Bank early this morning for an interview about the impact of ransomware attacks on small and medium-sized businesses, and one of the things I think deserves much more attention is just how unequal these situations can be. Having worked in the field of kidnap, extortion and crisis negotiations for well over 20 years, I’ve seen how even very large organisations struggle when they suddenly find themselves in an extortion situation. They have resources, experienced executives and access to external advisers, yet the first hours can still be extraordinarily difficult. Now imagine facing the same situation with a fraction of those resources. The consequences are not necessarily smaller because the company is smaller. Quite the opposite; a few days without access to critical systems, the loss of a major customer or an unexpected financial demand can threaten the survival of the business itself. We spend a great deal of time talking about how smaller companies can improve their cybersecurity, and rightly so. But we should also be talking about what happens when prevention isn’t enough. Because when a small business is hit by ransomware, the person making the decisions may be facing the most consequential crisis of their professional life. For the CEO, it could mean losing everything they’ve spent years building. For the criminals, it’s just another Tuesday.

I was running a cyber crisis exercise recently when a very experienced IT security professional stopped the discussion and said: “Look, if we find a bloody ransom note, it’s a crisis.” He was right. We don’t need to spend the next two hours investigating whether we have a crisis; if we find a ransom note, we activate the crisis organisation and start managing it as one. If two hours later we discover that the situation is less serious than we thought, we can always stand down again. What worries me is what happens next in many organisations. They don’t have an agenda for the first crisis meeting, so they improvise it; the executive team hasn’t trained together, so what is now a full-fledged crisis with financial, legal, operational and reputational consequences continues to be managed primarily as an IT incident. And, in my experience, the problem is seldom the CIO or the CISO. Having helped organisations through more than 150 incidents, fewer than 2% of the executive teams I have worked with during a ransomware crisis had actually trained for it beforehand. That means the CEO and CFO are often making these decisions for the first time while the company is already under attack; information is incomplete, systems may be unavailable, financial consequences are developing by the hour, lawyers and communications advisers need decisions, and somebody is already asking when the business will be back online. None of this means the organisation has failed at cybersecurity. Quite the opposite; even organisations that take cybersecurity extremely seriously will experience serious incidents. We are too interconnected and too dependent on suppliers, software, cloud services, infrastructure and people to believe that prevention can eliminate the possibility altogether. Cybersecurity and crisis management are two different disciplines. We need to be good at both. Have an agenda for the first crisis meeting; have the right decision-making documents in place; know who is responsible for what; and train the executive team to use them before they are needed. Crisis management is a leadership discipline. Let’s not practise it for the first time when the worst situation hits.

The response to last week’s Handelsblatt interview with Peter Skovbo and me has been incredible. I’m grateful to Handelsblatt's @Christian Wemkhe for highlighting a topic that many leadership teams still underestimate: ransomware is not an IT problem. It is a business crisis. After supporting more than 100 ransomware incidents, a few lessons continue to stand out: 💡 Cyber incidents become leadership challenges within minutes. Operations, legal, communications, customers, suppliers, regulators and reputation are all affected. The CEO and executive team must be involved from the start. 💡 Negotiation is not the same as payment. One of the biggest misconceptions we encounter is that opening a dialogue with attackers means you have decided to pay. In reality, negotiation creates time, reduces pressure, improves decision-making and can support recovery efforts. 💡 Training matters more than most organizations realize. Across the incidents we have managed, very few executive teams had previously completed crisis management training. Those that had were consistently faster, calmer and more effective under pressure. The uncomfortable reality is that for many organizations, a ransomware attack is increasingly a question of when, not if. The difference is often determined long before the incident happens: preparation, leadership alignment and crisis readiness. Thank you to Christian Wermke and the Handelsblatt team for the opportunity, and to Peter for sharing the stage and his insights. #CyberSecurity #Ransomware #CrisisManagement #Leadership #BusinessContinuity #CyberCrisis #DeltaCrisisManagement

During a ransomware attack, speed is not always your friend. And this is where a strategically risk-thinking CFO can become one of the most important people in the room. I have seen executive teams become fixated on one objective: getting out of the crisis as quickly as possible. I think that is both natural and understandable. But ransomware and cyber extortion rarely present you with one problem to solve, instead they open a box of potential risks that need to be seen, understood and for most of them, mitigated. In other words: it’s a complex and evolving situation that develops as the executive team is solving it. And it entails significant Financial, Legal, Operational and Reputational risks: - Systems are down, some (or even worse: all) of the employees are unable to work. - Operations are slowed down or halted. - Customers start asking questions. Oftentimes the kind of questions that their legal counsel sends. - Stolen data appears in the equation, yet we don’t know how much data and what data, at least not yet. But still, authorities and regulators may need to be notified. - The media becomes interested. Employees hear rumours. - Business partners become concerned. The list goes on and on. It can feel like a game of whack-a-mole; solve one problem and another appears. This is why I believe the CFO can become one of the most important people in the room during a ransomware crisis. A strategically minded CFO keeps asking: What’s our financial exposure right now? What are our legal and regulatory risks? What’s the operational cost of another 24, 48 or 72 hours?vWhat could materially damage our reputation? And, crucially: How will the decision we are about to make change those risks? The objective is not simply to move fast. It is to continuously understand the financial, legal, operational and reputational risks, and make deliberate decisions as that picture changes. A CFO who has actually practised this scenario before the crisis is pure gold. And this is also why professional crisis negotiators matter. My job as a crisis negotiator isn’t just to communicate with a threat actor or negotiate a number.It is to help executive management understand the adversary, anticipate what may happen next, and illuminate how developments in the negotiation can change the company’s overall risk picture. In an extortion crisis, you rarely get to eliminate risk. You are constantly choosing which risks you are prepared to carry. That’s why active and rational decisions almost always trump speed. At Delta Crisis, helping executive teams navigate exactly these decisions is what we do. See more at deltacrisis.com

Your CISO cannot solve a ransomware crisis. And frankly, we shouldn’t expect them to. Ransomware may start in IT, but once operations are disrupted, customers are affected, sensitive data may have been stolen and the financial consequences start mounting, we’re dealing with something much bigger. We’re dealing with an executive crisis. I’ve spent more than 20 years working with crisis negotiation, and one of the patterns I keep seeing is organisations expecting their technical teams to manage problems that require executive leadership. Your CISO has an essential role, but somebody needs to bring the bigger picture together. → What are the operational consequences? → What is our legal and financial exposure? → What do we actually know about the threat actor? → Which decisions need to be made now, and which can wait? T hese are questions for the executive crisis management team, supported by experienced advisors. Ransomware is not a crisis of IT. It’s a crisis of everything. And crisis management is a leadership responsibility.