When it comes to incident response, the question isn’t if your organization will experience a security incident. It’s a question of when. And in the case that a simple event eventually turns into an incident, any security leader might cycle through a plethora of emotions. Panic. Alarm. Dread. And unfortunately, shame.
But why is there such a stigma surrounding cyber incidents? How can we approach these situations more productively? And — most importantly — how can we use our experiences to be better prepared for next time?
The stigma around cyber incidents
The anxiety of reporting a cyber incident could stem from many factors:
- A fear of being perceived as incompetent
- Not wanting to lose customer loyalty and trust
- Fear of reputational damage across the industry
- Worry that reporting the incident will give competitors an advantage
- Avoiding panic from stakeholders
- Difficulty navigating a complex situation and knowing what needs to be communicated
While these fears may be valid, it doesn’t mean that these outcomes will happen or that this is really how the situation will be perceived by outside parties. Security incidents can happen to any organization – no matter how competent, prepared, or vigilant a security leader or their team is.
It’s difficult to accurately measure how many organizations have experienced a security incident. But the 2023 SEC guidelines requiring publicly traded companies to disclose material cybersecurity incidents are addressing this challenge – and experts believe this will have a positive effect.
How we can cultivate a more positive approach
While these new guidelines will help normalize the occurrence of security incidents, it’s up to the cybersecurity community to reduce the stigma around experiencing an incident. Here are some ways we can approach this:
- Act transparently. Being honest about the realities of the situation helps normalize what happened and builds trust with stakeholders, customers, and internal employees.
- Normalize incident response. In today’s digital landscape, responding to incidents is a normal part of risk management. Adopting this attitude sets the stage for your teams.
- Replace blame with reflection. Instead of finding the right party to blame, embrace incident response through a lens of wanting to learn and improve. Reflecting on what happened and learning from it may lead to avoiding future incidents.
- Share lessons learned. By sharing takeaways with the greater cybersecurity community, other leaders can learn from what happened and hopefully avoid the same outcome.
- Create a culture of security. When you emphasize cybersecurity best practices with stakeholders across the organization, you empower others to play an active role in the organization’s proactive cybersecurity strategy.
- Establish accountability. Establishing clear expectations for incident response and determining who is accountable for what parts of the strategy helps ensure future incident response scenarios will flow more smoothly.
- Focus on improvement. Cybersecurity is an ongoing process. By continuing to learn and grow, you and your teams will be that much more prepared next time.
Building cyber resilience so you're more prepared next time
The most important part of removing this stigma around cyber incidents is focusing on how your organization can come back stronger and even more cyber resilient than before.
Of course, experiencing a cyber incident is painful, stressful, and a headache to deal with. But unfortunately, with the current landscape, incidents are also an inevitable part of being a security leader.
If we reframe how we view incidents, we can see them as a valuable learning experience that shows us firsthand how we can improve our security strategy and what current gaps can be closed. And if we approach the situation correctly, hopefully we won’t experience the same scenario again.
We can shift our own narrative by taking a proactive approach to security. By having an incident response plan in place before an incident occurs, you might be able to keep a stressful day from becoming an absolutely horrible day.
To better understand what happened and normalize the occurrence of security incidents, it’s important to understand the lifecycle of an event through its possible evolution to a formal incident, which we defined in this blog with other incident response terminology.
And of course, gaining a comprehensive understanding of everything in your environment through a cyber asset attack surface management product like Axonius is a great move.
In a perfect world, we would be able to completely prevent an incident from happening. But, let’s be real — the industry will never stop evolving, and this likely won’t ever be the case. What we can do is work together to lessen the stigma around experiencing a cyber incident – a situation no one asked to be in the first place.
