Welcome to The Senroc Download! The month of October is Cybersecurity Awareness Month. This month we’re bringing you a special series dedicated to the many forms a cyber attack can take, how to detect them, and ways you can practice with your team. The end goal will be the start of your organizations incident response plan!

In late August, Boston Scientific disclosed a cyberattack causing what it described as global disruption with no clear timeline for restoring its systems. A company of that size has a security team, an incident plan, and rehearsed procedures, but it still could not tell customers when things would work again.

The last thing you want when you’re in crisis is to not know what to do and make rash decisions. The question has never been whether you can prevent every incident — nobody can, and the largest organizations demonstrate it regularly. The question is how long you spend in the fog: the stretch where nobody knows what’s happening, who is in charge, or what to tell customers.

For a small business the fog is usually the entire event because they haven’t taken the time to plan. Something looks wrong on a Tuesday morning, three people investigate separately, somebody reboots a server, somebody else emails all staff and starts a panic, and by the time anyone calls for help the useful evidence is gone. Everyone was just trying to help and get the company operational again, but they potentially did more harm than good.

Takeaway: An incident plan for a small business does not need to necessarily be a complex document. It only needs to answer four questions before anybody is under pressure: who decides, who we call, what gets disconnected, and what we tell people. Deciding those in advance is this week’s habit and rehearsing them once is the drill that closes the month.

The habit is to make four decisions in advance and put them on a single page as your start to an incident response plan.

The first is: who is in charge during an incident — one named person, plus a deputy for when they’re away.

The second is: who do you call first - your IT provider’s phone number, your insurer’s claims line and your bank’s fraud line. Put down the real phone numbers. You don’t want to be looking them up during the crisis.

The third is: what gets disconnected and what doesn’t. The reflex is to shut everything down, but pulling a machine off the network is usually the right answer while switching it off can destroy evidence you’ll want later. In most cases, the rule should be to disconnect the affected machine from the network, leave it powered on, don’t go poking around to investigate.

The fourth is: what you tell people; staff, customers, and possibly a regulator. What you say in the first few hours matters more than it seems because silence gets filled with worse guesses than the truth. You don’t need the wording in advance, but you should decide who writes it and who approves it.

Takeaway: Get these items onto a page and make sure it’s available offline in printed format. You don’t want to get caught in a situation where email is unreachable and the document can’t be retrieved. Include any account numbers and support contract references your providers may ask for, so you’re not hunting those down in the thick of it.

Get the relevant people in a room. This should be the person in charge, the deputy and an office manager to name a few. No computers. Read out the scenario: it’s 7:40 AM on a Tuesday morning, the first person into the office finds a message on their screen saying all company files have been encrypted, and nothing is accessible on the company share drive. For the next 20 minutes, work through what you would do out loud if this actually happened.

The questions in sequence: what’s the first thing anybody does; who gets called and on what number; what do we tell the staff arriving in twenty minutes; can we operate at all today and how; when do we tell customers and who writes that. The process is meant to make sure your answers from the habit work, but also to find any gaps.

Takeaway: Take the time to run through the drill and fix any gaps you might have found. The next thing should be to mark it on your calendar. At a minimum, you should be running through a short tabletop annually, but ideally semiannually. Information changes as time passes and you don’t want to get caught with incorrect information when you need it most.