When I am teaching cyber incident management, I always talk about four areas which need to be addressed when responding to a ransomware incident. They are: communications and regulation management, technical response, statutory and regulatory communication, and then continuity of operations. Continuity of operations is key in that your organization has obligations to its customers and stakeholders and without them being fulfilled, the organization may fail. The recent RUSI report, Ransomware Victim Experience, mentioned that many people found their existing business continuity plans didn’t really help when responding to ransomware attacks. In response, here are ten potential reasons for this.
One: Has your plan been written specifically with a ransomware response in mind? Very few of the business continuity plans that I have seen have any mention of cyber incidents within their scope or as one of the response issues that the plan addresses. Typically, a plan will cover loss of building with the easy strategy of working from home, loss of a supplier, loss of staff, and loss of IT. If cyber is not mentioned, it has probably not been thought about. From the points below, we can see that a cyber attack has many different impacts than the ‘normal’ type of incident that BCPs are written for.
Two: Does your business continuity plan recognise that there may be a different structure for managing a cyber incident and show how it fits within that structure when responding to a cyber incident?
Three: Absolutely central to responding to a ransomware incident is the requirement to be able to operate processes manually and without IT. Very few business continuity plans I have seen have any manual workarounds and if they are included, they are not in sufficient detail to be able to actually carry out the activity. In responding to ransomware attacks, you often have no choice but to revert back to analogue operating regimes from 20 years ago, which very few people within the organization remember. Manual workarounds need to take into account the extra time to conduct them, or the additional people needed to implement them. Now is an opportunity to take the time and note down the manual processes before the skillset is lost. There may be certain processes which you just can’t deliver without IT. If you are an organization like Deliveroo providing fast food through a platform, there are far too many orders to allow for manual processing, so manual workarounds are not always possible.
Four: In many ransomware attacks, the organization’s primary communications methodology, such as Microsoft products, may be unavailable and alternative methods have to be used. I have very rarely seen this mentioned within business continuity plans. If the hackers are still within the system, they may be able to monitor all communication of those responding, making all communications insecure. BCPs should mention alternative communication methods.
Five: In a cyber attack, I suspect that most recovery time objectives (RTOs) will not be met. Most processes are reliant on technology for recovery. In a cyber attack, it is not just as simple as rebooting the IT system and then getting it up and going. Until you guarantee that the attackers are definitely not within the organization’s systems, the organization may not want to have the systems live again or connected to a network. Thus, due to the digital forensics, it might take days longer to recover, long after the activity RTOs are set at.
Six: In many business continuity plans there are RTOs for applications. Often, these are aspirational as they haven’t been actually confirmed with IT. Sometimes this is due to lack of communications, but often IT departments do not know them due to the lack of testing. In a cyber incident, the quicker the recovery, the more likely that the attackers can encrypt the backups as well, so the application RTO will not be met.
Seven: In a similar way, backups may be encrypted if they are not gapped. Recovery point objectives (RPOs) in business impact analyses (BIAs) are often not designated, not agreed with IT, or may not reflect the gapped backups.
Eight: Most business continuity plans anticipate a staged recovery with some applications and activities being up within hours. Cyber incidents like the Scottish Environmental Protection Agency (SEPA), Comhairle Nan Eilean Siar (Western Isles Council), or Hackney Council, have taken months and years to recover, I suspect long after the RTO stated in the BCP.
Nine: A key component of pre-COVID plans was a list of PCs (mainly) or laptops that needed to be recovered at a work area centre. As everyone now works from home, these requirements have been lost from plans. In some cyber attacks, there may be a need for laptops and PCs to be replaced as this might be quicker than reimaging them. If there is not a list of laptops required in a plan, you may want to reconsider putting one in and then discussing with IT where additional laptops might be purchased from, and whose plan this should be in.
Ten: Your suppliers and partners may not behave in the same way as during a ‘normal’ incident. Often, partners and suppliers may cut off API data flows or blacklist your organization’s email addresses. This can make communications difficult and may slow down the recovery. Again, this should be considered and discussed in advance.
In conclusion, business continuity plans can provide a very useful tool in ensuring the continuity of operations after a cyber attack, but I think for BCPs to be effective, they need to be looked at through the lens of a cyber incident and adjusted accordingly.
The author
Charlie Maclean-Bristol is Director of Training, BC Training. Charlie is an industry-renowned consultant and is part of the BCI’s Hall of Fame due to winning multiple awards, including Continuity and Resilience Volunteer 2023. BC Training is an award-winning organization and most recently won the BCI Europe Award for Continuity and Resilience Provider for a Service or Product 2023.
