News and Analysis

The way an organization recovers from a cyber attack can be the difference between minimal disruption and going out of business. But while effective recovery can take time, business leaders are increasingly focusing on speed. Recent data shows CEOs are placing huge demands on security professionals to be able to get back up and running quickly. Two-thirds of CEOs expect to be notified of a cyberattack within half an hour, according to research from Cohesity. While 19% of business leaders think they should be alerted to a breach within five minutes.Around 38% of CEOs expect basic operations to be back up and running within a day, with 14% saying this should happen in just one hour. The UK government’s recent Cyber Security Breaches Survey shows most firms can recover within 24 hours. Is this really possible, and if so, how can firms harden defences so they are able to get back up and running swiftly?Attack timelinesAfter a cyberattack hits, some businesses will descend into chaos. “Systems are down, normal tooling doesn’t work – and you may even be isolated from the internet,” says Ade Clewlow MBE, associate director and senior advisor at NCC Group.Yet amid this complex and high-stakes environment, experts say the first few hours after discovering an incident are critical. “How companies react to a breach in the first few hours matters,” says Dennis Martin, cyber and crisis resilience specialist at Axians UK.He explains how during a live ransomware attack, for example, the call on whether to disconnect the network and shut down systems needs to be made quickly. “In practice, this means teams monitoring the network need clear pre-authorisation to shut it down if they suspect an attack. It also means there should be a plan on how to restore once the system has been taken down, for both false-positive cases and confirmed attacks.”Among the steps required, victims need to rapidly establish what has happened, assess whether the threat actor is still active, and work out which systems are affected. They then need to identify the steps needed to minimize the attack’s impact. “Immediate priorities typically include containing the attack and engaging key stakeholders,” according to Adam Harrison, managing director in the cybersecurity practice at FTI Consulting. Speed is important, but acting on incomplete or inaccurate information “can be just as damaging as acting too slowly”, Harrison warns. He says overreacting to a false positive, disconnecting systems in a manner that makes recovery more difficult, or causing unnecessary business disruption “can serve as a self-inflicted wound”.Understanding the scopeSome steps can be taken straight after an attack, such as the initial containment. While this can often begin within the first hours, understanding the full scope of an incident may “take days or even weeks”, says Harrison.Dan Wood, CISO at Cyberfort concurs. He believes recovering quickly and recovering well are “two very different things”. “Everybody pats you on the back for getting operations restored in 24 hours after a cyber breach, but if you haven’t recovered well, recovering quickly is pointless,” he says.Wood says he’s seen organizations seemingly back up and running within hours, but at a cost. “Then they suffer the same attack days later because compromised backups placed the vulnerability and the attacker’s back door straight back into live operation.”The goal should be to have core services running in a clean environment, and to be able to prove this, Martin advises. “Otherwise, systems may be quickly compromised again, and, if a clean environment can’t be proven, partners won’t allow reactivation of vital interfaces.”Yet at the same time, a slow response can be damaging. The impact of this will depend on the phase of the attack, according to Harrison. In the early stages, any delay gives an attacker more opportunity to achieve their objectives, he says. “They may access more systems, steal additional data, deploy ransomware, or establish persistence that makes later eradication significantly harder.”Sluggish responses also increase business disruption. “Systems that could have been isolated early may instead require complete rebuilding,” says Harrison. “Recovery costs can also escalate and regulatory obligations will become more complex if additional data is compromised.”In the latter stages of an incident, or after the adversary has already performed their ‘actions on objective’, the focus shifts from preventing compromise and limiting further damage to restoring operations safely and understanding the full extent of the impact, according to Harrison. “At that point, delays can prolong downtime and increase recovery costs.”Recovery timelinesThe pressure is on, and the initial response should be rapid. But CEOS must also be realistic about the possibility of recovering too quickly. “The number of variables involved in an attack will always dictate the speed of recovery,” Clewlow says. “For example, the threat from AI is moving at pace, so a successful AI-enabled technical attack has the potential to be more damaging in a shorter time.”However, an organization that experiences minor disruption, such as a website being defaced, can usually recover relatively quickly, says Clewlow. “Although technically a cyber incident, this is at the less severe end of the sliding scale. The larger and more complex the network is, the more severe the incident is likely to be, and the longer it will take to return to business as usual.”Meeting the 24-hour benchmark demands “genuine organizational rigour”, according to Tracey Hannan-Jones, consulting director in information security, UBDS Digital. “This means documented and rehearsed response plans, clearly assigned roles, pre-approved communication templates, and recovery infrastructure that is tested regularly and never assumed to work.”Some of the basics include foundational cyber hygiene and ensuring your network is adequately segmented, according to Clewlow.It’s also key to know what the minimum viable operations are for the business and to understand the assets on the network, says Clewlow. He believes rehearsed response plans are a key factor. “CISOs should work with colleagues to ensure business continuity plans are shared and verified against information security realities, and that priorities for restoring systems and services after an incident are clearly understood,” he said.“Recovery from a cyberattack is a team effort, in which the CISO will play an integral role.”