Something I have noticed during this spring is that the incidents I work on cost more than they used to. Not only because the attackers ask for more money, although they do, but because everything around the incident has become harder.<\/p>\n
When everyone works from home it takes longer to gather the right people. Laptops are spread out all over the country, so collecting them for investigation or reinstalling them takes weeks instead of days. Communication is harder when the normal channels might be compromised and you can\u00b4t just walk over to someone\u00b4s desk. And external help is harder to get on site, as I wrote earlier this month.<\/p>\n
At the same time the business is more dependent on IT than ever. A day without systems used to mean a day of slower work. Now it can mean a day without any work at all.<\/p>\n
So for management: Revisit your incident response plan with remote work in mind. How do we reach each other if mail and Teams are down? How do we get a new laptop to an employee in two days? Do we have a retainer with an incident response company so we don\u00b4t have to negotiate in the middle of a crisis?<\/p>\n
And look at your cyber insurance. Read what it actually covers.<\/p>\n
The cheapest incident is still the one that never happened.<\/p>\n","protected":false},"excerpt":{"rendered":"
Something I have noticed during this spring is that the incidents I work on cost more than they used to. Not only because the attackers ask for more money, although they do, but because everything around the incident has become harder. When everyone works from home it takes longer to gather the right people. Laptops […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,70,33],"class_list":["post-1214","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-cost","tag-incident-response"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1214"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1214\/revisions"}],"predecessor-version":[{"id":1242,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1214\/revisions\/1242"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}