Key Takeaways:
- The cyber threat landscape has changed significantly in the last 12 months
- An incident response tabletop exercise, under privilege, will train your team how to respond
- The exponential increase in cyber litigation makes privilege protection even more important
- Your internal policies and regulators may already mandate incident response plan testing
- Without a trained response team, you face heightened legal risk
Over the past decade, organizations have become more attuned to external cyber risk, adopting information security programs and incident response plans in response. Over the past twelve months, however, the cyber threat landscape has changed significantly, including as a result of geopolitical conflict and other global stress factors. Case in point, the recent attack on Stryker Corporation, a U.S. medical technology company based near Kalamazoo, Michigan. Kalamazoo may seem far from the geopolitical stage, but as the Stryker attack shows, any organization can be a target, as attackers seek to either create chaos to further political ends, or to put a targeted organization off balance, to increase the likelihood of extracting an extortion payment.
According to the dark-website of the Handala hacking group – an alleged pro-Palestinian hacktivist group first observed in December 2023 – the attack was politically motivated, specifically in response to recent U.S. and Israeli strikes against Iran. Importantly, the attack did not appear to follow common hacker TTPs (Tactics, Techniques and Procedures), such as ransomware or Business E-mail Compromise. Rather, the attack seems to have been directed at the “Availability” pillar of the so-called “CIA” triad of cybersecurity: Confidentiality, Integrity, and Availability of systems and data. According to reports, Handala may have been able to access Stryker’s device management system and remotely wipe or otherwise disable Stryker devices, such as company-issued phones.
Most organizations are not prepared for an Availability attack like this. Backups are often imperfect or unreliable and, in any event, take time to restore. And in our world of constant accessibility, losing devices en masse is simply not an eventuality many organizations have planned for.
On the ransomware front, attacker groups have fractured and so-called ransomware-as-a service affiliates have become less predictable, with certain attacker groups now using threats of physical harm or swatting attacks to pressure a victim organization to make payment. These kinds of kinetic threats are well outside of the typical CIA focus of a security team, and can be overlooked in incident response planning.
And on top of this, plaintiffs’ attorneys are bringing class-action suits in response to cyber attacks at a breakneck pace. This arises from two factors, primarily:
- frequent settlements in data breach class actions, leading to more plaintiffs’ firms entering the field, thereby increasing competition; and
- public disclosure and re-disclosure of attacks, even if they did not require data breach reporting under state or federal law.
The first factor, increased competition among plaintiffs’ firms, has led to a race to the courthouse whenever a security incident is reported. The first firm to file a class action can often reap the greatest reward, so the pressure to launch the first action in response to a security incident is real. That implicates the second factor, public disclosure, as plaintiffs’ firms can leap into the class-action fray with incomplete information concerning the incident at hand. This is because of the nature of these public disclosures, which often originate from dark-websites run by the attackers themselves. For example, information about an attack can appear on an attacker’s dark website, which is then picked up by security blogs and other websites in the indexed web and repeated worldwide. This leads to near real-time reporting of these dark-web posts and can lead to a class action suit being filed even before an organization makes its incident public, e.g., through data breach notification letters, where required.
These pressures underscore the importance of the attorney-client privilege in incident response, as plaintiffs’ firms regularly seek to obtain communications of the incident response team, and any reports created in response to the incident, in discovery. Also, a target are any notes, protocols or other reports generated in relation to incident response simulations, so-called table-top exercises, known as “TTXs”. This includes automatic dictation or summaries created via artificial intelligence.
This doesn’t mean an organization should avoid a TTX. To the contrary, many regulatory regimes require them, and your organization’s information security program or incident response plan may already mandate TTX testing on a regular basis. An annual TTX cadence is common in the industry and required under certain regulatory regimes. Many organizations honor this requirement only in the breach, however, or allow their IT teams to run limited exercises focused solely on technical issues, not the kind of systemic, enterprise risks that come from an Availability attack, kinetic ransomware threats, or plaintiffs’ attorneys who race to the courthouse based on hacker posts in the dark web, which may or may not be true.
Conducting an annual, robust TTX through experienced cyber counsel is the best way to address these risks and can function as a kind of mini-cyber risk assessment, identifying risks that the organization should prioritize, given hurdles or impacts identified in the TTX process. An annual TTX, under privilege, also has corollary benefits: strong team building amongst the members of the incident response team; periodic vetting of cyber counsel and external support vendors, such as Digital Forensics and Incident Response (“DFIR”) providers; and a better understanding of how the organization’s cyber insurance policy may, or may not, help in response to an incident.
Further, a TTX will also test an organization’s necessary ability to detect, escalate and respond to an incident in a time-sensitive manner, and doing so helps the response team develop “muscle memory” that, in turn, can increase the efficiency and effectiveness of real-life response efforts. To this end, speed of response is becoming more important by the day as the ever-evolving legal landscape continues to introduce shorter and shorter mandated timeframes. The newest addition into the incident response mix on that front is CISA’s proposed reporting rule that, if rolled out as expected following a recent DHS shutdown-related delay, will impose 24 and 72-hour clocks applying to “covered entities” across sixteen critical infrastructure sectors.
The HSE cyber team has deep experience in running real-world, robust TTX simulations in varied industries, such as retail, higher education, K-12 education, real estate, financial services, critical infrastructure, and others. And as one of five firms awarded a contract by the New York State Office of General Services for cyber legal services to state-contracting entities, including many non-profits in New York, HSE’s Privacy and Data Security team is uniquely situated to bring their real world experience to the incident response planning tables of the public and non-profit sectors.
Please contact a member of HSE’s Privacy and Data Security team if you have any questions.