Contradiction alert - how can you prepare and predict things you can’t predict? That makes no sense!
Defending against known threats and attacks from cybercriminals is fundamental to all organizations' cybersecurity strategy and defense posture. But even with the best approach and execution in the world, there will still be significant newly discovered threats that appear. The most recent was the zero-day vulnerability in the Log4j framework distributed with many Java-based applications and control systems. What can you do to prepare for unforeseen high-risk vulnerabilities?
While it is true that we couldn't sit down in a room and plan for specifics such as "Let's make a plan in case there is a vulnerability in Log4j in the future," it is possible to use well-known and trusted planning and risk mitigation techniques to plan for unforeseen risks.
Organizations need to do this planning as Log4j was only the latest in a series of high-impact vulnerabilities that have appeared over the last few years. Other examples include Heartbleed in 2014, External Blue (MS17-010) in 2017, and SolarWinds Orion in 2020. If anything, the scale, danger, and impact of these significant and unforeseen vulnerabilities are growing over time.
Every IT admin, cybersecurity professional, and the C-suite leadership team in all organizations should be asking this excellent question. Thankfully, they can take steps to prepare both systems and people for any future high-risk threats that appear.
Here at Critical Insight, we have decades of experience planning for and dealing with cybersecurity attacks at all levels. Our goal is to ensure that you don't need to contact us after an attack has disrupted your organization. To help prevent that, we run regular webinars to pass on our team's experience and knowledge to as broad an audience as possible.
In January 2022, we held a Preparing for the Next Big Global Cyber Event webinar. During the session, Critical Insight's Jeremy Johnson (Director Adversary Replication & Detection) and Mike Simon (Chief Technology Officer) covered what organizations can do to prepare systems and staff for any future high-impact vulnerabilities that appear.
The one-hour session is embedded below and watching it will be time well spent for anyone who has any role in defending against cyberattacks in a technical or managerial position. If you have any questions after watching the video, contact Critical Insight through the form below.