What are the top 3 trends that will trigger organizations to adopt a critical event management plan in 2023? Gartner reveals all
Over the past year, organizations have been focused on managing the rise of home and hybrid workforces and adapting to the many changes resulting from the global pandemic. We have seen the scale and sophistication of cyberattacks grow through an increase in both nation state attacks and cybercriminals that find vulnerabilities within physically disrupted enterprises.
According to Gartner, the consequences to IT operations or supply chains run high at around $540,000 per hour. That amounts to an average cost of business disruption rising from $3.9 million to $4.2 million last year, proving the need for businesses to have effective defenses, including a tried-and-tested critical event management (CEM) plan, in place.
As we look ahead to 2023, we may be turning a corner on COVID-19, but we have already seen the headwinds of three major disruptions for which businesses need to prepare:
Climate change and extreme weather events
Climate change and extreme weather events – including fires, floods, and hurricanes – pose a raft of potential threats to individual households and communities, through to national security. Time is our worst enemy when a critical event unfolds. Every second counts and a cyberattack is the last thing any organization needs to deal with in a moment of crisis. Yet these occurrences often set the stage for cybercriminals to take advantage of organizations distracted in the face of physical danger and impact.
We have seen a sharp rise in cyberthreats since the onset of COVID-19, with organizations suddenly forced to support remote workforces and digitize parts of their infrastructure at speed. Similarly, when adapting to new or emergency conditions, companies can become vulnerable and exposed to inadequate protections in an expanded and under-secured attack surface. Typically, during major events, malicious actors will target critical infrastructure systems across manufacturing, healthcare, energy services and food supply sectors. Phishing campaigns play on the public’s fear and uncertainty to gain access to private and organizational systems.
Just as the global pandemic provided cybercriminals with prime opportunities to target organizations during a transitional time, natural disasters of the future will provide a platform for hackers to experiment with their latest tools and techniques. Aware of the fear and panic leaders experience during critical events, hackers will aim to take advantage when these teams are most distracted.
It’s just a matter of time before we see a major cyberattack against a state or local government during a natural disaster
It’s just a matter of time before we see a major cyberattack against a state or local government during a natural disaster, when hackers could hinder the efforts of first responders, hospitals, and utilities. As we look ahead, more organizations and local governments should consider rehearsing their responses through routine cyberattack simulation drills. Some states, such as Indiana, have held drills and created a preparedness plan. Houston also simulated a cyberattack during a hurricane following the devastating impact of Hurricane Harvey, a category four storm that caused the worst flooding in that region’s history.
More sophisticated cyberattacks
In 2023, cyberattacks will continue to increase in severity and sophistication, leaving unprotected organizations scrambling to keep staff and resources safe. Cyberattacks can result in devastating consequences for organizations that aren’t protected. We often hear of the financial ramifications of being ill-equipped to prepare for and address cyberattacks. Companies also need to consider the cost and consequences of disruptions to their systems or operations, including loss of productivity, negative impact on morale, displacement or loss of staff, revenue loss, and the increased cost of working.
We’ll see the cybercriminal underground continue to adopt new digital habits and become increasingly successful in targeting organizations’ vulnerabilities. As ransomware attacks become more sophisticated, we are increasingly seeing infiltration of internal communication systems to gain access to corporate data and confidential information.
When Uber suffered a breach, the company was forced to shut down several employee communication and engineering systems after a hacker gained access. What do you do when this happens and as the situation unfolds?
Critically, there needs to be a secure and reliable communications platform available as part of the CEM plan. This includes pre-prepared templates to provide guidance and advisories to employees and other stakeholders, sending regular updates and, after the immediate threat has passed, aligning employees and communicating the impact of the incident – plus learnings and recommendations on how to prevent it from occurring again.
Civil disturbances impact communities and put people at risk
Civil unrest impacts communities and companies and puts public safety at risk. In 2023, global recession, conflict, rising inflation and cost of living, as well as a growing public discontent in several countries, threatens disruption around the world. Protests, demonstrations, and rallies make headlines and take over social media feeds, leading to lots of noise and the potential for chaos and uncertainty.
Communicating with employees and stakeholders around civil disturbances is key in the name of public safety. Companies facing closures because of civil unrest, for instance, need to reach vendors, customers, and staff immediately to keep them physically safe and informed.
There needs to be heightened awareness around the potential for cyberattacks through phishing and social engineering tactics that play on people’s distraction and fear to keep enterprise systems secure as well.
Catching the urgent attention of all staff could be more challenging as many workforces continue to work remotely and organizations hire employees in different regions. Communicating to all using a single method or platform, such as email, is unlikely to reach everyone promptly, particularly if employees are working from home or logged off their work devices. In contrast, informal systems such as WhatsApp may open security vulnerabilities.
Take cybersecurity and critical event management seriously, now
It shouldn’t take another major incident for organizations to take cybersecurity and critical event management seriously. When a crisis hits, it’s critical to have tried and trusted systems and processes that keep everyone safe and enable operations to continue – or resume – with minimal disruption. That involves communicating clear and timely information to a team and the public at large. Consider how your team can be proactive and mitigate damage in both physical and cyber worlds.
Contributed by Ken Murphy, VP and General Manager, AtHoc at BlackBerry
