Incidents Move Too Fast for Pen & Paper

Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.

Incidents Move Too Fast for Pen & Paper

Organizations may not be ready for completely autonomous communication processes, but there are places where automating information updates would alleviate pressure.

Organizations steadily deploy automated threat detection and response processes; some even take it a step further with fully artificial intelligence (AI) security operations centers (SOCs). Automation can catch an incident in seconds, yet communication remains mostly manual across an industry that requires more transparency.

The disconnect can strain relationships and trust as customers wait for incident impact and mitigation answers. Hands-on communications also put more pressure on chief information security officers (CISOs), who must relay timely updates to IT personnel and executives as the incident clock winds down.

Incident response (IR) communications are increasingly too much for humans to coordinate without more help. But disclosures contain sensitive information — the status of a company's security posture or how they responded when alerted to an incident — and automation takes away some of the control leadership wants to hold onto in regard to timing and specificities.

From a coordination and information standpoint, automating communications is absolutely important, says Tim Brown, chief strategy officer at Cytactic. That could mean implementing a centralized place to view everyone's status versus relying on meetings to receive updates.

A dedicated crisis communication platform could help, says Brown. A single click of a button could notify everyone, and that includes contingency options if normal communications go down, which is typical following an incident where systems go offline.

Brown is no stranger to hectic IR communication scenarios. While trying to manage the SolarWinds attack fallout, the former CISO got pulled into crisis after crisis. He oversaw 5 different teams, coordinated tasks, scheduled meetings, received updates from everyone, and tried to keep the customers briefed.

As he looks back now, he appreciates how much help everyone around him was. Still, some preparation was missing: More tabletop exercises, meeting the appropriate people beforehand, and technology to ease communications.

Lost in Translation

IR communications are complicated. Organizations may wait to disclose certain information, so they do not tip off attackers. Sometimes victim organizations post customer-only private advisories, but that leaves public awareness and downstream victims vulnerable. And other times, companies simply choose not to disclose or to downplay effects to save face.

The Securities and Exchange Commission and Cybersecurity and Infrastructure Security Agency (CISA) continue to update and adopt new disclosure regulations in light of more disruptive attacks. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, after missing several earlier deadlines, is nearing finalization. Once in effect, the rule would require covered entities to report substantial cyber incidents to CISA within 72 hours of discovery, and critical infrastructure organizations that make ransom payments would need to report within 24 hours.

Even if organizations want to disclose any information in good faith, that poses challenges. A wide net of victims, third parties, and supply chain risks abound. It's increasingly more difficult to even know who is affected these days.

Douglas McKee, director of vulnerability intelligence at Rapid7, ventures to guess that most security leaders would cite communication problems, and they usually exist long before an incident ever happens. For example, security teams tend to talk in terms of common vulnerability exposures (CVEs) and indicators of compromise, while the people making business decisions need to know what any of that actually means.

On a normal day, that gap is annoying, but during an incident, the language barrier gets amplified because everyone needs answers at the same moment, even though the facts change by the hour. And nobody wants to be the person who said the wrong thing publicly, adds McKee.

"Third parties make this even harder," McKee tells Dark Reading. "I've seen plenty of situations where a vendor knows about a problem in their product well before their customers do, but the notification lands in a generic inbox or goes to a contact who left the company two years ago."

Attackers benefit from that confusion, he warns, adding how important it is for defenders to agree internally on what's happening, to be able to relay information to customers confidently.

Choose Your Automation Carefully

Organizations want to be more transparent, but continually struggle with how to personalize communication outreach, explains Brian Killeen, vice president of global identity solutions at TransUnion. Whether in day-to-day fraud communications or during an active incident, the more they can leverage AI, insights, and understanding the better they can adapt, adds Killeen.

Right now, it's easier to automate detection and response because the inputs can be fairly structured, explains McKee; a log entry either matches a rule or it doesn't. IR communication, on the other hand, involves judgement calls with legal and reputational consequences.

"Organizations are understandably nervous about letting a machine decide what goes out the door with their name on it," McKee says. "Let's face it, an analyst can shrug off a false positive in a few minutes, but there's no easy way to un-send an inaccurate breach notice to your customers."

That doesn't mean automating communication is off the table — it just needs to be pointed at the right parts of the problem, he recommends. Organizations can automate pulling together the incident timeline or tracking which stakeholders have been notified and when. McKee also recommends using tools to draft a first version of an update from data the responders already have.

It's all about freeing people up to spend their time on decisions that actually need a human. The way McKee looks at it, "automation should get the draft in front of the right person faster, and that person should still be the one who verifies and hits send."