Preparedness for cyber security incidents - of all kinds - is formulaic. Unfortunately, many organizations don't follow these five principles, or don't take them seriously enough.

1. Connect | Protect | Optimize
The 5 Ps of Preparedness
Why Hope is NOT a Strategy
Rafal Los – VP, Chief Security Strategist

2. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
./whoami
Just in case you don’t know me

3. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
strategist, advisor
strategy executive
~25 years in ”the business”
writer
VP, Chief Security Strategist –
Lightstream Managed Services
professional translator
Founder
Down the Security Rabbithole Podcast
father of twins

4. Hope is not a strategy
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Wishing for the best, probably won’t work.

5. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
incidents are inevitable

6. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“cost of doing business”

7. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
panic and chaos is avoidable
Complexity Averted.
Possibilities Realized.
© 2019 Lightstream
Communications. All rights reserved.

8. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
how much impact
is self-inflicted?
Complexity Averted.
Possibilities Realized.
© 2019 Lightstream
Communications. All rights reserved.

10. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“If you fail to prepare…”

13. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
preparation has a formula

14. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
5 core components

15. Program
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Comprehensive, aligned approach

16. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
cannot over-state importance

17. manifestation of strategy

18. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
strategy à program

19. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
define a structured approach

20. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
budget

21. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
staff
Complexity Averted.
Possibilities Realized.
© 2019 Lightstream
Communications. All rights reserved.

22. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
resources

24. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
tip: align to a framework

25. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
I suggest NIST CSF

26. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
identify protect detect respond recover

28. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
response is a capability

29. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
align resources

30. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
internal resources

31. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
+ external support

32. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
+ law enforcement

33. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
+ legal, insurance, PR, etc

34. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
must work together

36. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
within your means

37. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
know your constraints

38. Policy
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Declaration of your operating principles

39. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
explicit declaration of
rules

40. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what you must do

41. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what you can do

42. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what you can not do

43. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
definition of duties

44. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
explicit obligations

45. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
regulatory and legal

47. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
concise, unambiguous

48. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
will be scrutinized
tested
questioned

49. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
will you pay a ransom?

50. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
will you remediate, or
replace?

51. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
who has authority?

52. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
who has accountability?

53. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
when do you report?

55. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
policy is a legal framework

56. Plan
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Simple, understandable instructions

57. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
the value of a plan,
is in the ability to execute

58. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
plans are tricky

59. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
easy to overbuild

60. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
easy to over-complicate

61. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
do not make a ‘book’

62. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
nobody will read it

64. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
nobody reads the
extinguisher manual in a
fire

65. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
make it simple

67. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
make it concise

68. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
make it comprehensive

69. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
make it flexible

70. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
make it accessible

71. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
how to screw it up –

73. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“200 pages, in a binder”

74. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“online, on the network”

75. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“last reviewed 3 years ago”

76. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“specific people, not roles”

78. People
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Someone must hold the door

79. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
it’s easy to forget ”people”

81. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
2:00am, Tuesday:
ransomware has encrypted all
workstations…

84. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
this is a delicate situation

85. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
first call?

86. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
call tree?

87. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
incident response,
legal,
leadership,
board,
press?

88. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
who can make decisions?

89. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
can you contain/mitigate?

90. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
people <> communicate

91. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
maintain confidentiality

92. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
communicate effectively

94. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
name vs. role

95. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what if they’re on vacation?

96. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: chain of command

97. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: [approved] IR vendors

99. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: outside counsel

100. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: insurance

101. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: 3rd parties

102. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
what about: your employees

104. Practice
Complexity Averted. Possibilities Realized. © 2019 Lightstream Communications. All rights reserved.
Practice makes better than a mess

105. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
repeat after me: practice

107. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
things likely won’t go to plan

108. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
“works on paper”

109. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
real-life may be different

111. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
plan A … F

112. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
things WILL go wrong

114. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
learn from F1 teams

115. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
practice, for real-life

116. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
practice, in real-life

118. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
practice non-ideal
situations

120. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
did you learn anything new?

122. Complexity Averted. Possibilities Realized. © 2022 Lightstream Communications. All rights reserved.
Thank you!
• Where to find me
- Twitter
• @Wh1t3Rabbit and @DtSR_Podcast
- Down the Security Rabbithole Podcast
• iTunes, RSS (https://ftwr.libsyn.com), and almost literally anywhere else
- Lightstream – Consulting, Professional & Managed Services
• www.Lightstream.tech
- LinkedIn:
• https://www.linkedin.com/in/rmlos/
• https://www.linkedin.com/company/down-the-security-rabbithole-podcast

123. Complexity Averted.
Possibilities Realized.
www.lightstream.tech