Just as they used many ways to initially attack their victims and open a back door, they also used a variety of ways to compromise identity.“It is important to understand this aspect of the attack: Unlike some attacks that take advantage of vulnerabilities in software, this attack was based on finding and stealing the privileges, certificates, tokens or other keys within on-premises networks (which together is referred to as ‘identity’) that would provide access to information in the same way the owner would access it. This approach was made much easier in networks where basic cybersecurity hygiene was not being observed – that is, where the keys to the safe and the car were left out in the open.”4
SolarWinds CEO Sudhakar Ramakrishna: “We believe that the entire software industry should be concerned about the nation state attack as the methodologies and approaches that the threat actor(s) used can be replicated to impact software and hardware products from any company, and these are not SolarWinds-specific vulnerabilities.“To this end, we are sharing our findings with the broader community of vendors, partners, and users so that together, we ensure the safety of our environments.”5
Federal chief information security officer Christopher J. DeRusha: “We are at a crossroads for the nation's cybersecurity. The SolarWinds incident exposed gaps in our cybersecurity capabilities and risk management programs, not just in the federal government, but in some of the most mature and well-resourced companies in the world. This event should serve as both a wakeup call and a galvanizing opportunity for the federal government and industry to come together and tackle these threats with renewed resolve. This collaboration is critical, as private-sector entities have primary responsibility for the defense and security of their networks. The government must communicate threat assessments to inform private-sector security operations and ensure common situational awareness.“This incident comes amid a series of aggressive and high-profile attacks on federal systems, attempted theft of the data used to develop the COVID-19 vaccines, ransomware attacks on U.S. hospitals, and new technology and security challenges that arose with the rapid shift to remote work. These myriad challenges underscore the importance and urgency of modernizing federal IT and strengthening U.S. cybersecurity capabilities.”6
U.S. Senator Ben Sasse (R-Neb.) after a critical U.S. fuel pipeline system was shut down by a cyberattack in early May 2021: “There's obviously much still to learn about how this attack happened, but we can be sure of two things: This is a play that will be run again, and we're not adequately prepared. If Congress is serious about an infrastructure package, at front and center should be the hardening of these critical sectors.”
Australian prime minister Scott Morrison: “Based on advice provided to me by our cyber experts, Australian organizations are currently being targeted by a sophisticated state-based cyber actor.“This activity is targeting Australian organizations across a range of sectors, including all levels of government, industry, political organizations, education, health, central service providers, and operators of other critical infrastructure.”7
A PEEK BEHIND THE CURTAINS, AND THE MAKING OF CYBER MAYDAY AND THE DAY AFTER
So why did we write this book?
First, we are passionate about cybersecurity. We love to share true stories and cybersecurity challenges and solutions in numerous ways, including our books, blogs, magazine articles, social media, global speeches, podcasts, and more.
Second, we believe that our unique backgrounds, experiences, and cultures offer a powerful combination of award-winning cybersecurity leadership experiences, partnerships, and stories. This book is intended for a global audience; in addition to a rich resource of insights brought in from around the world, Dan brings a U.S. perspective, while Shamane lives in Australia and works extensively throughout the Asia-Pacific region.
Third, this is a vital topic for the world at this time. The earlier quotes make that abundantly clear.
Fourth, other materials on this cyber topic tend to cover cyber incident response, cybersecurity emergency planning, cyber exercises, and related people/process/technology materials from one of two approaches. Some take an academic approach and offer checklists and detailed frameworks, such as walking the reader through the implementation of the five-function NIST Cybersecurity Framework: identify, protect, detect, respond, and recover. Other materials offer ad hoc stories and fun facts about statistics and costs associated with data breaches, ransomware, and a long list of other security incidents.
While we reference many of these works at the end of the book and point readers to helpful resources throughout, our goals are to bring cyber incident response and the associated planning, response, and recovery to life with true stories that offer compelling lessons and provide practical, actionable advice from leading global technology and security leaders and business executives who have been through the storm. We want to provide CxOs, directors, managers, technology professionals, and frontline business people with the tools they need to prepare for inevitable security incidents.
Bottom line, we offer powerful stories that motivate, along with cyber plans and free resources with practical steps that can be taken from small businesses to large enterprises in the public and private sectors. The goal: cyber resilience that will prepare your team and get you through most cybersecurity challenges you will likely face.
THE THREE-PART BREAKDOWN
The book is presented in three parts: Part I: A Leader's Guide to Preparing for the Inevitable; Part II: Cyber Mayday: When the Alarm Goes Off; and Part III: The Day After: Recovering from Cyber Emergencies.
Part I presents the gift of a time machine, seeking hindsight from top industry leaders around the globe and things we can do differently before having to go through any cyber emergencies. We cover playbooks from cyber disruption to risk transfer options, and explore the power of “perfect practice.” We also unpack a handbook specifically for leaders at the top, and the keys of proactive leadership.
Part II is when Cyber Mayday hits! We walk through real-life cyber emergency incidents and what actually happens when the alarm goes off. In that split second when the virtual walls are crumbling down, what are the most important steps to take and where to go? Who are the players you should be working with in times of crisis and immense pressure? And, in the midst of your Mayday, what can go right?
The chapters in Part III address critical issues when you finally have some breathing space. This is the opportune time to be intentional and reflect on what went wrong, how to recover, and how to level up in your strategy.
This comprehensive exploration of tales, woes, and lessons of leaders is a gift of hindsight and insights, which will enable and position current and next-generation business leaders with the required foresight to continue leading at the frontline. We hope you gain lots of invaluable takeaways from your time spent with us; enjoy.
NOTES
1 1. President Joe Biden speech,
