Breach Readiness With Technical, Cyber Insurance, and Legal Experts Can Improve the Response to a Cyber Incident

In today's cyber environment, 70% of all organizations are dealing with 100 or more security threats on a daily basis, and 46% of organizations are unable to contain a threat in less than one hour of the initial compromise. Threat actors know that organizations are vulnerable to a cybersecurity breach and are just waiting for the opportunity to capitalize. But the important thing for organizations to understand is how to be ready for a breach when it does happen and why a complete response to a breach involves experts in the technical, cyber insurance, and legal fields.

Abbey Mirelli, Incident Response Manager at Pondurance, Valentino Papas, Cyber Practice Leader at RCM&D, and Megan Farley, Partner at KLA Legal, have substantial experience helping clients respond to breaches. They recently presented information about breach readiness — the ability to detect, respond to, investigate, and recover from a security incident quickly and effectively — and explained how experts in all three fields work collaboratively to respond to a cyber incident.

Technical

From a technical or digital forensics and incident response (DFIR) perspective, readiness means having the necessary people, processes, technology, and actionable evidence in place to make critical decisions under pressure. As any organization that has experienced a cyber breach knows, when a breach is ongoing, the pressure is on. The primary goal of readiness is not to prevent every cyber incident but to ensure that the organization is fully prepared and resilient when an incident does occur. Strong preparation can directly reduce downtime, limit business and financial impacts, and enhance the overall quality of forensic investigations.

Readiness matters for a number of reasons. During a cyber breach, most organizations find that attacks move much faster than anticipated and are quite complex with multiple moving parts. Any delay in escalation, containment, or evidence collection can impact the cost and scope of the incident. Also, reactive actions like wiping systems or deleting accounts can unintentionally destroy forensic evidence. Prepared organizations make faster containment decisions while preserving critical evidence and use cross-team alignment with DFIR, IT, executive, insurance, and legal teams that know their roles before the incident ever occurs.

Organizations need to know the importance of people in the process. The best place for an organization to start with readiness is having a written incident response plan with clearly defined roles and responsibilities for its people. If an organization doesn't have a written plan in place, at a minimum, it's wise to have a high-level outline that includes who to contact and when to contact them. Then, the organization should focus on building out the plan soon after. Ideally, an incident response plan should establish defined escalation paths for the IT, security, leadership, legal, insurance, and DFIR teams. The plan should identify who has the authority to isolate systems, disable accounts, take services offline, and approve recovery actions. The IT team and managed services providers must understand the difference between containment and remediation. 

Tabletop exercises are a great way to test an organization's readiness as it gives organizations the opportunity to put their processes into action and see how prepared they are for an actual event. Organizations should conduct recurring tabletop exercises to account for changes in personnel, vendors, and technology and to keep people up to date and comfortable with decisions that will need to be made during a breach. Tabletop exercises should be conducted at least once a year, but the team recommends doing them quarterly.

An organization should strive to achieve technical readiness by adopting these five core factors:

• Logging. Enable and retain sufficient logging across endpoints, identity systems, email, cloud platforms, firewalls, and critical applications. 

• EDR coverage. Maintain endpoint detection and response (EDR) coverage on critical endpoints and servers.

• Forensic evidence. Ensure that evidence can be collected quickly from endpoints, cloud systems, and email platforms.

• Critical logs. Understand where critical logs are stored, who can access them, and how they can be exported. 

• Backups. Regularly validate that backup and recovery systems can't be accessed by threat actors.

When a breach does happen, organizations need to know the order of actions to take, and these actions should be addressed in the completed incident response plan. The team suggests that organizations should isolate first and remediate second but always inspect for business disruption. That means organizations need to isolate compromised endpoints from the network rather than immediately wiping or reimaging them, track what actions were taken by whom and when during containment, and engage appropriate parties early enough to preserve forensic evidence before any major remediation actions occur. 

Cyber insurance

A cyber breach is never easy, but organizations can take proactive actions to eliminate or reduce some of the issues involved in a breach. Having cyber insurance is a critical action to take — and of course, organizations must secure the policy before the incident happens. Cyber insurance provides more than just reimbursement. Insurance can provide funds for incident response, restoration, business interruption, and liability costs, and it can connect organizations with claims professionals, breach counsel, forensic experts, and notification and communications resources. In addition, it helps leadership understand coverage implications and creates a framework for approvals, documentation, and loss measurement — at a time when decisions must be made quickly and under pressure.

Once an organization realizes that there's been a cyber breach, the incident response plan and decision authority must be quickly activated. Next, the organization should promptly notify the the insurer and broker, and it's often part of the policy's required process. 

Cyber insurance can bring all the necessary parties or vendors together for a coordinated, cohesive response. The insured organization owns the business decisions, containment priorities, and continuity. The DFIR team determines the scope, cause, persistence, and recovery requirements. The breach counsel directs legal strategy, attorney-client privilege, and regulatory analysis. The insurance provider and broker coordinate notice, consent, coverage, vendors, and claim economics. 

However, each policy has a unique set of coverages and consent provisions. Some policies require that organizations use only the preapproved vendors on a list without exception, while others allow more flexibility so organizations can work with experts they know and trust. Organizations need to know — way before the time of a breach — whether a vendor is approved and should include the vendors in the incident response plan. Organizations need to evaluate vendors by comparing expertise, geography, sector knowledge, rates, surge capacity, and familiarity with the environment. Also, they should reconcile retainers, service level agreements, billing terms, data handling, and scope of work with coverage requirements. A good practice is for an organization to include the insurance broker, breach counsel, and DFIR team in tabletop exercises to test the notification path of the incident response plan.

The organization also wants to protect the record for the forensic investigation. It needs to preserve evidence, approvals, invoices, timelines, and key decisions. In addition, the organization must track its losses from the start, detailing separate incident costs and quantifying operational and financial impacts, to make a proper claim.

Once an organization has secured a cyber insurance policy, it should be ready to use the policy to its fullest. Organizations need to understand how coverage works, how to report a claim, who the vendors are, who is responsible for tracking costs and invoices, and much more. The insurance broker is there to answer any questions and make sure organizations know what their policies require throughout an incident — before, during, after, and at renewal. 

Legal

From a legal perspective, cyber insurance is generally triggered by an actual or suspected network failure or a cyber incident that has resulted in an actual or reasonably suspected compromise of personally identifiable or otherwise confidential information. A breach can disrupt business, generate enormous costs, and damage an organization's reputation, and cyber insurance can pay for those costs and help the organization recover from the breach.

When a cyber breach is in progress, an attorney, known as a breach coach, may not be the first call an organization thinks to make, but it's an important one. A breach coach performs many roles following a cyberattack including overseeing and directing the investigation, assessing the need for third-party support, ensuring that the investigation is legally protected, providing guidance on meeting legal compliance requirements, and handling all communications. The beauty of working with an attorney is that the investigation is protected by attorney-client privilege. 

When an organization calls the insurance provider's hotline, the call typically is directed to a breach coach who will listen and assess the situation. The breach coach is listening for answers to questions such as: Does the organization need help communicating with employees or clients? Is the website down? Does the general public know the organization is experiencing a breach? What data, if any, did threat actors access? Did this event trigger federal or state compliance laws? Is there a ransom note? The breach coach can quickly bring in a DFIR team for a forensic investigation or take whatever action is needed.

During a forensic investigation, the breach coach will handle communications with clients, vendors, and employees, on an as needed basis, to let them know what's happening. The breach coach can also make an FBI Internet Crime Complaint Center report, providing high-level information about the alleged cybercrime. In addition, in the case of a ransomware event, the breach coach will advise on whether the threat actors are on the sanctioned list, meaning they aren't associated with Iran or other sorts of malicious activity, and can provide advice on negotiation and payment of a ransom. 

If personally identiable information or confidential data was impacted in the breach, the breach coach will also advise on notification letters that must be sent and to whom. Also, if industry-specific state and federal regulatory compliance laws were triggered, the breach coach will send notification letters and possibly need to set up credit monitoring for those impacted victims.

A cyber breach also has the potential for third-party litigation, such as class action lawsuits. Today, even incidents that involve smaller numbers of victims result in class actions, and those suits must be defended regardless of merit. 

In addition, there are numerous other incident response assets available for organizations to use including experts in public relations, bitcoin wallet, international law, forensic accounting, credit reporting, mass publication, and more. Organizations should check with their insurance providers to determine which of these services are covered under their cyber insurance policies.

Conclusion

From the initial call with the insurance provider to the forensic investigation to the final legal action, a breach can be a strain on every aspect of the business. Organizations need to understand breach readiness and be prepared to act when a cyber breach occurs to minimize the damage. For more information about how to be ready for a breach and why a complete response to a breach involves experts in the technical, cyber insurance, and legal fields, watch the webinar.