Dealing with cyber crises requires practice

Legal expert Dr Marco Gercke advises large corporations and governments on cyber crises. He also lectures as an honorary professor at Cologne University in Germany. In his keynote speech at this year's it-sa, he will use a simulation to demonstrate the consequences that decisions can have in a complex cyber crisis and what is required for optimal decision-making. In this interview, he explains the typical problems encountered in such situations.

Index

• Career path
• Recurring problems
• Gaps in strategy
• The simulation at it-sa
• Dos and don'ts
• AI is changing the threat landscape

You advise large corporations and governments and have worked on behalf of various international organisations such as NATO and the UN. How did your career path lead you into this field?

Dr Marco Gercke: I studied law and economics, founded two companies and subsequently completed a PhD on cybercrime. In the late 1990s, this was still a very new field of research, particularly within the legal discipline.

My doctoral thesis was one of the first academic works in Germany to deal extensively with this topic. Whilst working on my postdoc, I received invitations to specialist conferences and events organised by international organisations such as the United Nations. At that time, there were only a relatively small number of experts worldwide who were conducting academic research into cybercrime.

Later, amongst other things, I advised Deutsche Telekom, worked as an expert for the Council of Europe and carried out research projects for the European Commission. A key focus of my work increasingly shifted to the question of how decision-makers – such as board members, managing directors or ministers – can be prepared for cyber crises and make sound decisions under considerable time pressure.

Do you encounter problems with your clients that are similar and keep recurring?

Dr Marco Gercke: Yes. A fundamental problem is that the role of top management in a cyber crisis is often not sufficiently defined. Technical standards and established processes exist for CISOs and IT managers. In many cases, however, there is no comparable framework to guide board members and managing directors.

Added to this is a distinctive feature of cyber crises – decisions often have to be made before the full facts are known. Nevertheless, these decisions can have significant and, in some cases, irreversible consequences.

Shutting down a system, for example, may be sensible, but it can also result in a business-critical process being out of action for days. The same applies to ransom payments: anyone who pays under time pressure and only realises afterwards that the recipient is on a sanctions list may have solved one problem but created an additional legal one.

The challenge therefore lies in making structured decisions even in the face of uncertainty and avoiding irreversible mistakes as far as possible.

Looking at companies' cybersecurity strategies, what is often missing from them, or what would be important?

Dr Marco Gercke: Many companies today have comprehensive cybersecurity strategies. However, the crucial question is whether these actually help those who have to make decisions in an emergency. A crisis manual running to several hundred pages may be technically excellent, yet still be of little help to a board that has to make a critical decision within a matter of minutes.

That is why the perspective of senior management is so important: What decisions might I have to face? What information do I need to make them? Who needs to be involved? What resources are available?

And what fundamental questions can we answer even before a crisis strikes? Not every decision can be anticipated. But decision-making processes can be prepared for. The more of these issues that have been clarified in advance, the greater the scope for action during a crisis.

(Editor's note: The article Preventing and Managing Cyber Disasters shows the strategic gaps companies regularly overlook when dealing with severe security incidents.)

Your keynote speech at it-sa will feature a simulation on incident response and emergency management. What is the aim of this exercise, and what do you hope to convey to the audience?

Dr Marco Gercke: The simulation we're running at it-sa is based on a format we typically use out with board members of large companies or decision-makers in the public sector. The audience won't simply observe a cyberattack; they'll become part of the crisis management process themselves and will have to make decisions.

(Editor's note: The session Ransomware Wargame – Simulation Game to Prepare for an Emergency at it-sa EXPO & Congress recently demonstrated how such a format can work in practice.)

Just as in a real cyber crisis, the situation evolves dynamically. Information comes in gradually; some of it is incomplete or contradictory; and whilst a decision is being made, the situation is already changing again.

Often, there is no obviously correct solution. For example, should an attacked system be shut down? This may prevent further data leakage, but at the same time it could interrupt a business-critical process.

In such simulations, we regularly observe that decisions are initially made quickly and with a high degree of certainty. As the simulation progresses, participants become significantly more cautious. They experience first-hand how difficult leadership becomes when information is lacking, time pressure arises and their own decisions trigger new consequences.

Are there specific 'dos and don'ts' in emergency situations? Or rules of conduct and best practices that one can fall back on?

Dr Marco Gercke: The most important principle is this: the crucial work begins before the crisis strikes. Pilots practise emergency situations and work with checklists because, under stress, there is a risk of overlooking important steps. A similar principle applies to cyber crises.

This includes contingency plans tailored to the organisation, clearly defined responsibilities and prepared decision-making processes. Particularly important fundamental issues should, where possible, be discussed in advance.

At the same time, preparation must not be confused with rigidity: no cyber crisis unfolds exactly according to plan. A contingency plan should therefore not replace critical thinking, but rather provide guidance under time pressure.

Furthermore, the senior management's role does not usually end with the technical containment of the attack. Recovery can take weeks or months. Even during this phase, management must maintain an overview and make the necessary strategic decisions.

(Editor's note: The article Cyber Resilience & Incident Response in Geopolitical Crises shows how companies can remain capable of acting beyond the acute response to an attack.)

What adjustments to the cybersecurity strategy are necessitated by AI? What needs to change in order to be prepared for AI attacks?

Dr Marco Gercke: Artificial intelligence is, first and foremost, changing the capabilities of attackers. Attacks that previously required time, specialised skills or significant resources can increasingly be automated and scaled up. Social engineering attacks, in particular, can be tailored in a far more convincing manner; speech, voice and, increasingly, video communication can be convincingly replicated.

For businesses, this means understanding cybersecurity even more strongly as a continuous process. Prevention remains important. However, as attacks become faster, more scalable and more convincing, the question of how quickly a successful attack can be detected and subsequently managed becomes increasingly important. Detection, incident response and resilience are therefore becoming even more crucial.

At the same time, AI is not just a tool for attackers. It can also be used to detect unusual activity and support security teams. We will therefore increasingly see an environment in which AI plays a key role on both sides.

Want to talk directly to Marco Gercke and other experts in cyber crisis management?

At it-sa EXPO & Congress, you can look forward to live simulations, hands-on use cases and direct exchange with exhibitors on incident response and crisis management. Visit now!

The questions were asked by Uwe Sievers.

Further interesting links:

• AI & Cybersecurity: Harnessing Potential, Managing Risks
• Cybersecurity Under Pressure: Learning to Deal with AI-Based Attacks
• Cyber Security Protects Against Attacks. Cyber Resilience Ensures Survival Afterward.