Hot Topic: Responding to a Crisis

Because information security is an organizational governance responsibility, the CIO must guide other executives and act cross-functionally (Oblinger & Hawkins, 2006). Strategic and contingency plans are important for keeping the IT function operating safely in a way that supports the needs of the organization. However, these activities are not sufficient. According to a far-reaching survey (Verizon, 2011), outsiders are involved in at least 80–90% of security incidents. They use some form of hacking or malware in virtually all data thefts and, in many cases, are not detected for months or years.

How should a CIO react to a possible security incident? A response plan, such as the one referenced in the Significant Incident Coordination and Communication Process web page (U.S. Department of Commerce, 2003), will help guide emergency communications and actions, but not every network anomaly is a significant security breach. The operations staff, and ultimately, the CIO, often makes these decisions with partial or ambiguous information. They must weigh a quick and effective response to an actual incident against the possibility of undermining the credibility of themselves and the organization with unwarranted announcements.

This week, you will investigate the cause(s) of the anomalous behavior that you encountered last week. You will receive operations reports from the IT staff, interpret the data, determine what happened, and decide what actions are required.

Evaluate responses to crises
Construct crisis communications
Design solutions to close system vulnerabilities
Evaluate required compliance activities

——

People have different reactions when faced with a crisis. When the crisis hits an organization, leaders need to ensure that individuals’ actions support one another, or at least are not counterproductive.

In a 400- to 600-word posting, provide an example where you have observed people responding to a crisis within an organization. Explain whether you believe people tend to coordinate overlapping responsibilities, conflict with one another, or act independently. Describe how the attitudes and messages of the leaders influence these responses. Identify other factors that might be important. Justify your response.

Then on a second page reply with the following:

Ask a probing question.
Share an insight from having read your colleague’s posting.
Offer and support an opinion.
Validate an idea with your own experience.
Make a suggestion.
Expand on your colleague’s posting.

SAMPLE SOLUTION

Responding to a Crisis

Provide an example where you have observed people responding to a crisis within an organization. A cybersecurity incident refers to an unexpected or unwanted cybersecurity event or series of events that have a significant probability of compromising the business operations (Tanczer, Brass & Carr, 2018). An example of a cyber-attack that I had firsthand experience with was an attack in my previous workplace that involved stealing important business data and information through an external attack. Analysis of the situation revealed that the attack was a collaboration between the insider threats among the employees and a targeted attacker to steal digital resources and cripple the organization’s operations. Therefore, it was more of cyber terrorism as opposed to a cyber-attack. The attack exploited the poor security system used by the company to steal and encrypt data and use the Distributed…