Effective crisis management in the face of a cyberattack remains a complex challenge. One for which organizations are often underprepared for and rarely practice. This presentation explores how one multinational manufacturing company proactively prepared its executive board and crisis management team for a potential cyber crisis. By sharing key insights, lessons learned, and their practical approach, this session will provide you with ideas to strengthen your own organization’s preparedness for a scenario we all hope never becomes a reality.

Most organisations are in the process of preparing for a high-impact incident. Our focus as a security community is now on developing the right processes, having the right tools, and getting everyone involved.

Looking back over seven years of responding to major security incidents, I keep coming back to the same observation: We need to make sure that we keep the human side of incidents in mind. We must ensure that we prepare and act in a way that considers the people involved in responding to an incident, those affected by an incident, and their wider communities. If we don’t, we will miss and fail to address an important impact.

We have become accustomed to the fact that our own infrastructure is under constant attack. That’s why we are constantly working on technical and organisational measures to protect ourselves and be prepared for these threats. But what if it happens to one of our partners, service providers, or suppliers? What do we do when we find out?

In this presentation, you will get a brief insight into two supply chain attacks that put several Swiss companies at risk. The focus will be on the actions taken by these companies and the lessons learned from dealing with this risk to be better prepared next time! As an attendee, you will be able to use these lessons to prepare your own organisation for similar supply chain attacks.

We have grown used to reading about cyberattacks on a daily basis: stolen data sets, encrypted files and backups, business interruptions and payment of ransoms. Companies have been made aware that they must continuously develop their protective measures and nonetheless prepare for the worst-case scenario. Establishing incident response plans and recovery plans and practicing them in tabletop exercises is becoming the norm. Now is exactly the time to engage with the topic of resilience in the context of cyber incidents. Do we really have to switch everything off in an emergency? Doing so will certainly lead to the disruption of all business processes if this is not yet the effect of the attack. Isn’t there a way to think in advance about how (limited) operations can continue despite a compromise to make sure that you don’t have to send all your employees home? This would at least reduce the extent of the damage. In this presentation, I’ll show you what we’ve learned from several cyber incidents we’ve assisted with to help you improve your resilience and preparedness.