The top lines of the article are:
“This attack was unforeseen, unprecedented but not unimaginable.” In today’s complex risk environment, you may well need to change your risk mind-set. To imagine the unimaginable, you must completely change your view of risk.
“I had a plan until I was punched in the face.” (Mike Tyson) There is no substitute for exercising your risk scenarios. Only through exercising will the team develop the agility to cope with whatever is thrown at them, which is fundamental to success.
“First and foremost are people with all their idiosyncrasies.” People and personalities should be a strength not a weakness. You need different kinds of people in the response team: no-one has all the skills needed to handle a risk event.
“Trust your team – you will all be tested.” You will only get through a crisis if you can trust your team to deliver what is required. This cannot happen instantaneously: real trust must be built up over a long period of time and from responding to real events.
“Escalating late is far worse than timely de-escalation.” To take the pressure off the decision to escalate, and ensure a timely response to events, people need to know they can also de-escalate. But it’s important to get the protocols and permissions for doing so agreed in advance.
“What do we know to be true? How do we know it to be true?” Answering both questions with a good amount of certainty is critical for making appropriate incident response decisions and furthering stakeholder communication.
“Teams and organisations must support one other.” Emotional and personal resilience are important attributes in a response team and this can be greatly assisted by the right support, including proper debriefing and talking about events.
“Going from hype to deployment.” Technology continues to present new challenges as well as benefits. Billions of transactions and millions of pieces of malware will create significant challenges for a CSO. This will demand new skills.
For further reading, please visit our Knowledge Hub.
