Imagine an encrypted laptop. A critical business system is unavailable. Customers can't log in. Phones start ringing. Suddenly, the questions aren't only technical. Who's in charge? Who can make the decision to shut something down? Who speaks to customers? And what happens if your usual communication tools aren't available?
As David Newson, Cyber Security Consultant at Intercity, explores in our 'What happens when a breach hits?' session, responding effectively isn't simply about having the right security technology. It's about knowing how your organisation will respond when something goes wrong.
During an incident, the technical investigation is only part of the picture.
You may need to understand which accounts and systems have been compromised, what has happened to your data and what needs to be contained. At the same time, the business could be dealing with unavailable systems, affected customers and suppliers, regulatory responsibilities and people unable to work normally.
That's why one of the most important questions David Newson raises is deceptively simple:
Who's in charge?
Knowing there is a problem and having the authority to act on it are two different things.
Imagine a security analyst identifies suspicious activity and recommends immediately disabling an account. What happens if it's a business-critical service account? Who has the authority to make that call, knowing the disruption it might cause? And who makes the decision if the usual contact isn't available?
Those aren't decisions you want to make for the first time during an incident.
Preparation isn't just about trying to prevent every possible attack. It's about being ready to make difficult decisions if one succeeds.
David Newson highlights several areas businesses can address before that happens.
1AGREE WHO'S RESPONSIBLEDefine who investigates, who manages recovery and who has the authority to make significant business decisions. Clear ownership removes ambiguity when time matters.
2decide what matters mostLeadership needs to understand which services are most important, how long the business can operate without them and what level of exposure or disruption it is prepared to accept.
3make resilience a shared responsibilitySecurity teams cannot make every decision alone. HR, procurement, operations, finance and leadership all influence how effectively the organisation can prepare and respond.
4test the planA plan on paper doesn't prove it will work. David Newson recommends tabletop exercises as one way to test whether responsibilities, contact lists and recovery plans work in practice.
5learn from what happenedRestoring services isn't necessarily the end of an incident. Evidence from the response should inform what changes next, who owns those improvements and how they're validated. Frameworks including ISO 27001 and Cyber Essentials can provide structure for those improvements.
|
There's a natural pressure after an incident to restore normal service and move on. But there's an important distinction between getting back online and becoming better prepared for the next incident.
That requires businesses to look beyond whether systems are working again.
What did the incident reveal about your controls? Did people know who could make key decisions? Were responsibilities clear across the organisation? Have lessons from the incident resulted in tangible change?
David notes, a useful test is to ask:
If the same incident happened again in six months, what evidence would show that you were better prepared this time?
That's what turns incident response into resilience.
At Intercity, we believe cyber resilience is a shared responsibility, not simply a technical one.
That means bringing together technology, monitoring and response with clear leadership, ownership and preparation. The session explores how a Security Operations Centre (SOC), incident response, threat intelligence, established security frameworks and existing Microsoft security investments can contribute to that picture.
Because when a breach hits, the question isn't only whether your security technology detects it.
It's whether your organisation is ready to act.
What happens in those first critical stages of a cyber incident, and how can you prepare before you're facing one for real?
Watch the full session with David Newson to explore the anatomy of a modern cyber incident, the role of Microsoft security technology and the practical steps organisations can take to strengthen their response.