Incident Response Management

Craig Fugate's Deadly Seven Sins of Emergency Management Former FEMA Administrator Craig Fugate, drawing from decades of disaster experience, identified critical flaws in how emergency management is often practiced. These "Deadly Seven Sins" serve as warnings against complacency, bureaucracy, and shortsighted planning. 1. We plan for what we are capable of responding to. Instead of preparing for catastrophic events, we often design plans around what systems can currently deliver. This guarantees failure when the event exceeds those limits. 2. We plan for our communities by placing the "too hard to do" in an annex. People with access and functional needs, children, the elderly, and pets are frequently sidelined into planning annexes—rather than being part of core planning. This marginalizes those who are often the most vulnerable. 3. We exercise to success. Too many drills are scripted to "go right." Real preparedness means stress-testing systems, embracing uncertainty, and discovering failure points. 4. We think our emergency response system can scale up from emergency to disaster. Emergency response systems don't automatically scale to meet catastrophic needs. Disasters break the system—they don’t just stress it. 5. We build our emergency management team around government, leaving out volunteer organizations, the private sector, and the public. A government-centric approach ignores the real capabilities of the Whole Community. Effective emergency management integrates all sectors. 6. We treat the public as a liability. Communities are seen as problems to manage, not partners in response. This mindset underestimates the resilience, resourcefulness, and critical role of the public. 7. We price risk too low to change behavior, and as a result, we continue to grow risk. Risk is underestimated in markets, policies, and development decisions. Without true pricing of risk, society continues to build vulnerability into the system. Takeaway: Avoiding these seven sins requires bold thinking, uncomfortable conversations, and a commitment to inclusive, realistic, and scalable preparedness. As Fugate often says: "Hope is not a plan."

39% of UK workers wouldn't report a cyber attack to their cyber security teams. The reason isn't lack of knowledge, (79% can identify attacks). It's psychology. A recent article by Craig Hale (TechRadar) reveals employees stay silent due to: ➡️ Fear of blame (17%) ➡️ Getting into trouble (17%) ➡️ Not wanting to cause a fuss (15%) ➡️ Preferring to "fix it themselves" (11%) IBM data shows this silence costs organisations an average of $2.03 MILLION more per breach. This connects to our earlier research on social engineering psychology. The same vulnerabilities that make us susceptible to attacks also prevent us from seeking help when we need it most. The solution isn't always better technology. It's psychological safety. Organisations with strong incident reporting cultures achieve: ✅ 58% lower breach costs ✅ 61-day faster incident resolution ✅ $1M savings from internal detection ✅ 75% reduction in successful cyber incidents Do your staff feel safe admitting mistakes? Building trust-based security cultures requires: ▶️ Framing incidents as learning opportunities, not failures ▶️ Leaders modelling vulnerability and admitting their own mistakes ▶️ Separating incident response from disciplinary processes ▶️ Celebrating reporters as security champions, not problems The human element shouldn't be seen or treated as your weakest link - it's your strongest defence when properly supported. What psychological barriers have you observed in cyber security incident reporting? Please share your experiences in the comments 👇 Read our full thoughts and analysis: https://lnkd.in/eEUNDjmc #Cybersecurity #PsychologicalSafety #IncidentResponse #Leadership #CyberResilience #SecurityCulture Source: Craig Hale, TechRadar - https://lnkd.in/ekG5xVBm

The future of emergency preparedness is connected, intelligent, and immediate. Technologies like 5G and the Internet of Things (IoT) are not just buzzwords; they are creating a powerful new nervous system for emergency response. In high-stakes situations, reliable communication and real-time data are paramount. 5G provides the ultra-fast, low-latency networks needed to transmit critical information instantaneously, while IoT sensors gather that vital data from the field. This partnership allows for: Real-time Situational Awareness: Sensors monitor everything from air quality in bushfires to floodwater levels, feeding live data to command centers. Enhanced Communication: First responders use 5G for high-definition video feeds and drone operations, ensuring commanders have eyes on the ground. Optimized Logistics: IoT devices track equipment and personnel, ensuring resources are deployed precisely where and when they are needed. This integration is closing crucial gaps. A study by Infosys projects that these technologies can reduce emergency response times by up to 20%, a difference that can save countless lives. From smart city initiatives in Australia leveraging IoT for flood monitoring to enhanced communication in remote areas of Pakistan via new connectivity, these technologies are transforming emergency management from a reactive effort into a proactive, data-driven science. Is your organization ready for the next generation of emergency response? #TechForGood #5G #IoT #EmergencyPreparedness #Gartner

𝐀𝐔𝐒𝐓𝐑𝐀𝐋𝐈𝐀𝐍 𝐂𝐘𝐁𝐄𝐑 & 𝐏𝐑𝐈𝐕𝐀𝐂𝐘 𝐋𝐀𝐖 𝐀𝐋𝐄𝐑𝐓: 𝐇𝐚𝐧𝐝 ‘𝐞𝐦 𝐨𝐯𝐞𝐫: 𝐅𝐞𝐝𝐞𝐫𝐚𝐥 𝐂𝐨𝐮𝐫𝐭 𝐤𝐞𝐞𝐩𝐬 𝐭𝐡𝐞 𝐛𝐚𝐫 𝐡𝐢𝐠𝐡 𝐟𝐨𝐫 𝐥𝐞𝐠𝐚𝐥 𝐩𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞 𝐢𝐧 𝐜𝐲𝐛𝐞𝐫 𝐫𝐞𝐩𝐨𝐫𝐭𝐬 The Federal Court has released its full reasons in McClure v Medibank, continuing a tough line on legal professional privilege for cyber incident reports. Medibank joins Optus on the canvas, with privilege rejected for multiple reports created after its 2022 cyberattack. This is now essential reading for every GC, Board and cyber incident responder. WHAT WERE THE REPORTS? The applicants sought access to a suite of cyber reports and communications. Key among them: Three Deloitte reports: 🔹️Post-Incident Review (PIR) 🔹️Root Cause Analysis (RCA) 🔹️CPS 234 compliance report Other communications: 🔺️CrowdStrike investigation reports 🔺️Threat Intelligence digital forensic reports 🔺️Internal and external crisis comms and ransom response materials All were commissioned amidst regulatory scrutiny, public statements, and an anticipated class action. WHAT DID THE COURT FIND? ⭐️The Court found that privilege existed in certain third party comms and the two external cyber reports, but did not apply to the Deloitte reports, despite carefully worded engagement letters and "dominant purpose" claims. ⭐️Why? Because the evidence showed multiple purposes — including operational learnings, regulator engagement (APRA), stakeholder transparency, and reputational management. ⭐️Public statements (e.g. announcing a review “to ensure we learn from this event” and promising to “share key outcomes”) were inconsistent with maintaining confidentiality — raising implied waiver. ⭐️The Court stressed that it is not enough to say a report is for legal advice — the actual facts and conduct matter. WHAT ARE THE KEY TAKEAWAYS? 1️⃣ Multi-purpose = high risk: If reports serve both legal and non-legal purposes, they may fail the dominant purpose test. 2️⃣ Public statements can pierce privilege: Committing to transparency may waive rights you didn’t intend to. 3️⃣ Evidence over labels: It’s not about calling it “privileged” — it’s about proving why it was truly for legal advice. 4️⃣ Strategy matters: Privilege needs to be embedded into the comms, commissioning, and governance of cyber response from day one. An appeal is pending so the privilege wars continue. But so far, plaintiff law firms are undefeated. #CyberLaw #LegalPrivilege #IncidentResponse #DataBreach #Governance #CyberSecurity #FederalCourt #Privacy #InHouseCounsel

After spending the past year leading ransomware incident response, I wanted to share some insights that you should be thinking about in relation to your organization. 1. Leadership clarity is non-negotiable. Multiple executives giving competing directions doesn't just create confusion - it directly impacts your bottom line. Every minute of misaligned leadership translated into increased recovery costs and extended downtime. 2. Trust your IR experts. Yes, you know your environment inside and out. But incident response is their expertise. When you hire specialists, let them specialize. I've seen firsthand how second-guessing IR teams can derail recovery efforts. 3. Master the time paradox. Your success hinges on rapid containment while simultaneously extending threat actor negotiations. If your leadership and IR partnership aren't solid (points 1 & 2), this delicate balance falls apart. 4. Global password resets are deceptively complex. Every human account, service account, API key, and automated process needs rotation. Without robust asset management and IAM programs, this becomes a nightmare. You will discover dependencies that you didn't even know existed. 5. Visibility isn't just nice-to-have - it's survival. Modern security tools that provide comprehensive visibility across your environment aren't a luxury. This week reinforced that every blind spot extends your recovery time exponentially. 6. Data gaps become permanent mysteries. Without proper logging and monitoring, you might never uncover the initial access vector. It's sobering to realize that lack of visibility today means questions that can never be answered tomorrow. 7. Backup investment is incident insurance. Organizations regularly lose millions that could have been prevented with proper backup strategies. If you think good backups are expensive, wait until you see the cost of not having them. 8. Protect your team from burnout. Bring in additional help immediately - don't wait. Your core team needs to be there for the rebuild after the incident, and running them into the ground during response isn't worth it. Spending money on staff augmentation isn't just about handling the immediate crisis - it's about maintaining the institutional knowledge and expertise you'll need for recovery. Remember: the incident ends, but your team's journey continues long after. #Cybersecurity #IncidentResponse #CISO #RansomwareResponse #SecurityLeadership"

When I was part of the Meta comms team, I was on the taskforce that handled communications during outages such as the one caused by CrowdStrike today (we called them SEVs, short for Site EVents). I personally led the crisis response on two big Meta outages, where multiple apps and services were down for several hours. Here is a summary of the comms playbook I helped build to manage outages. As soon as we became aware of the outage, I reached out to the incident manager oncall. This was usually a senior engineering manager or director in our Production Engineering team but in most companies you'd have a head of SRE or DevOps. Together, we'd figure out the answers to the following questions: 1. Is the outage local, regional or global? 2. When did the outage start and when do we expect to recover? 3. What customers (internal or external) are affected? 4. Is the entire platform down or is it just several features that are affected? 5. Have we had any complaints from major customers? 6. Is the outage the result of a DDoS or cybersecurity incident? 7. Have we lost any customer data? Using the information from the answers above, I drafted a holding statement acknowledging the issue and post it internally and externally. I also started a tracker to monitor press coverage and inquiries from reporters to ensure I could get back to everyone in a timely fashioned and also keep my finger on the pulse of the coverage (volume, sentiment, etc.) Then, as the engineering teams would start investigating and fixing the issue, I checked in with them every hour to get updates. If we had any major updates, I made changes to the holding statement and reshared it with the relevant stakeholders. At Meta, this was my colleagues in the communications team and reporters who were covering the story, but also company-specific stakeholders such as partnerships and marketing, sales, investor relations, legal and policy. That's because in the case of a major outage, public companies might have contractual responsibilities with customers or regulatory obligations to report incidents. We'd repeat the process until the issue was fixed, at which point we issued a final statement reiterating what had happened (configuration changes were the main culprit) and which services were affected. We also apologized for the inconvenience caused and confirmed the issue had been fixed. For outages that lasted for more than four to six hours, we also maintained an open communications channel with the senior leadership of the company to ensure they had visibility of our strategy and execution. Hope this helps other PR teams out there!

When cybersecurity regulations go bad - the 447 page proposed Cyber Incident Reporting regulation is overinflated, wildly expensive ($2.6B), and introduces unnecessary friction to Critical Infrastructure operators for the sake of metrics that might or might-not have some strategic value in the future. Although we can all agree that Critical Infrastructure is a growing target that the government must help protect, we must manage our precious resources carefully. Efficient resource allocation among competing priorities is a crucial part of cybersecurity effectiveness. The proposed reporting requirements are intended to gather metrics so Cybersecurity and Infrastructure Security Agency can provide recommendations over time to help the Critical Infrastructure sectors. But the cost and friction to those businesses is steep, estimated at a whopping $2.6 billion over the next decade, with industry partners picking up $1.4 billion while taxpayers cover the remaining $1.2 billion. I am all for good cybersecurity metrics (in fact a huge fan), as they can give great insights to prioritize and optimize the security posture and investments, but we cannot allow such a pursuit to hobble actual investments into controls or impede crisis response work. Security budgets are not unlimited. For every dollar spent on meeting this requirement for the government to understand who is being attacked, is a dollar not spent on actually protecting and recovering from such events.  #Cybersecurity teams will be told to comply by their executives, but likely not given any additional budget, forcing them to cut other protection projects. The concept of collecting better attack metrics from the Critical Infrastructure (CI) sector is a good idea, but not when the program is designed to cost billions and unnecessarily impact those companies. Especially if the results aren’t that meaningful to protect from future attacks! This program needs to be stripped way down, to the essentials that were legislated under the Cyber Incident Reporting for Critical Infrastructure Act. Many of these sectors already have a myriad of reporting requirements from other oversight bodies! I recommend they make it a unified reporting portal where CI victims will provide only what is required, by whichever regulations apply to them, to streamline the work that companies must currently satisfy (perhaps with a few extra questions for high-level metrics). It should forego the additional detailed data stream requirements, to reduce costs and workload overhead, so Critical Infrastructure organizations can actually focus on recovering from an incident! Metrics are great, but they don’t directly stop attacks. Investments in prevention avoid loss, while investments in rapid detection and effective response, lessen the overall impacts. Spending billions on metrics that may or may not be helpful in the future, is a reckless gamble and a mismanagement of resources. #CriticalInfrastructure

🚨 Is the UK Cyber Security and Resilience Bill on your radar? 🚨 💡 If you are an organisation already covered by the UK's NIS Regulations, or you are a managed services provider (which it will bring into scope), then it should be. The UK government has just published a policy statement, setting out the measures it intends to include in the Bill. A few key points from my initial reading: 1️⃣ Managed service providers will be subject to the same duties as "relevant digital service providers" (RDSP) under NIS, and the definition of RDSP will be expanded to cover certain SMEs. Expansion to data centres is also being considered, but may be in a separate bill. 2️⃣ The Bill will allow government to create secondary legislation to clarify duties of "operators of essential services" (OES) and RDSP to manage supply chain risks. These will be designed to ensure "appropriate and proportionate measures" are taken, including contractual requirements, security checks or continuity plans. This likely means the Bill itself won't contain mandatory contractual clauses for suppliers, but they are nevertheless coming down the track. 3️⃣ The regulator would be able to individually designate a supplier as a "designated critical supplier" (DCS) in certain circumstances, bringing them directly in scope for core security requirements and incident reporting obligations. This is different to DORA, where organisations have had to determine the criticality of their suppliers. 4️⃣ The Secretary of State is seeking powers to update the regulatory framework without requiring an Act of Parliament. This would allow future expansion to cover new sectors, introduce new requirements, and change regulator responsibilities. The Bill would specifically include the ability for the Secretary of State to make regulations bringing UK NIS into closer alignment with the EU's NIS2 and issue a code of practice. This could mean changes are introduced with less scrutiny and less notice to organisations, due to the lack of parliamentary procedure. 5️⃣ The incident reporting criteria would be expanded, reporting times would decrease (notification within 24hrs followed by an incident report within 72hrs) and some organisations would be required to notify individuals. 6️⃣ The ICO would be given more information on registration, as well as powers to set up new fee regimes and enforce failure to register. Given the ICO's recent record with data protection enforcement, it will be interesting to see how they exercise their proposed powers under the new Bill. 🔗 Link to the policy statement in the comments ⬇️

When wildfires overwhelmed Los Angeles earlier this year, Watch Duty helped keep people safe by providing real-time emergency information. Last month I got to share their story at a conference: architected on Amazon Web Services (AWS), Watch Duty's application scaled to support an additional 1.8 million people in just 48 hours. Here is how it works: Watch Duty combines official data feeds and 24/7 radio monitoring to deliver critical updates about fires, evacuations, and air quality. The app has become a vital tool to firefighters and individuals across 22 US states and counting. John Clarke Mills and team are doing incredible work. You can learn more here: https://lnkd.in/eK886t4g Watch Duty is now working to expand its alert systems to apply to other emergencies, including floods and earthquakes. Dominic Delmolino, Thomas Storck, Veena Chandran, Adrian Bordone, Haley Gottshall, MBA

CRR3 and DORA now speak the same language. Cyber incidents must be part of your loss dataset. Here’s what the new EBA RTS means in practice: 1. Every cyber incident = operational risk. If a cyberattack causes disruption, it must be captured — even if systems recover fast. That includes financial loss, reputational damage, and remediation costs. 2. Two new required flags: ↳ ICT risk — cyber: for attacks, exploits, and data compromise ↳ ICT risk — other than cyber: for internal tech failures or outages 3. DORA only mandates reporting major incidents. But CRR3 requires you to record all ICT incidents internally. Your internal register must go beyond what regulators see. 4. Third-party impact? Dual flag it. If a SaaS vendor goes down and you’re hit, flag it as both ICT risk and third-party risk. 5. Cyber losses now count in capital calculations. The RTS makes it clear: cyber events can affect your annual operational loss figure and your regulatory capital buffer. If you're a fintech CTO and your InfoSec and Risk teams aren't speaking the same language yet, you're likely to fail your next audit. 🙊 Want a quick sanity check on your cyber loss reporting setup? Let’s talk.