The threat of cyber attacks against businesses in the Middle East is higher than it has ever been. The prevalence of AI, geopolitical conflicts, and the high reliance of most companies on cloud-based tools are all factors that mean that it’s not matter of if a business will be subject to a cyber incident, but when. A well-prepared communications plan will play a pivotal role in helping to manage messaging and other factors during cyber breaches, which can cause significant reputational, business and financial harm.
Some cyber attacks – such as those on widely-used software or service providers – can have widespread impact on company systems, causing downtime and affecting customers. These can be high profile incidents that will have significant implications for the scope and type of communications required to employees, customers, and suppliers. In certain circumstances, regulators and industry bodies will need to be proactively informed. Reactive statements may also be needed in response to media, supply chain or client questions.
Other cyber incidents are more focused, targeting specific businesses or known vulnerabilities using tried and tested techniques such as phishing, impersonating senior personnel, or social engineering.
Prepare before an incident happens
With the inevitable in mind, it’s prudent for communications professionals to be as prepared as possible. Taking several practical actions before, during and after a cyber incident provides a framework for action, clarifies roles, and shortens the timeframe of necessary communications.
A proactive strategy enacted from the start will always be stronger and more effective than reacting in crisis.
Build internal relationships
Cultivating strong internal relationships with the C-suite, business heads, spokespeople, and other stakeholders is a core part of the role of communications practitioners, particularly when working in-house. These relationships will always be crucial, because making communications teams aware of situations early is vital in their ability to form an effective response.
In preparation for cyber incidents the relationships needed, in addition to the normal array of leaders and spokespeople, are very likely to be different. The absolute worst time to find out who’s responsible for cyber security or regulatory reporting of cyber incidents is when one has already happened.
Knowing who the external stakeholders are – such as lawyers, specialist comms teams, ransomware negotiators, cyber insurers – is also important, even if these relationships are generally handled by others.
Employee education via internal communications
One of the biggest security vulnerabilities of any business is its people. Since employees will be targeted frequently via phishing (and other methods of capturing their log-in details), social engineering, help desk imposters, and so on, employee education is one of the most important places to start. An internal communications campaign, developed in conjunction with the CISO or cyber lead in the IT department is vital.
A partnership between communications and cyber security teams can also help to prevent issues, by making sure employees are aware of the risks in clear language, and over the long term.
Effective and ongoing employee communications will facilitate awareness of the broad range of possible issues, and keep them up to date with new tactics, techniques and procedures (TTP). This kind of campaign can illustrate ways in which data and systems can be compromised, and provide guidance on known methods that employees can use to decide if something is genuine or not.
Know internal escalation and external reporting requirements
When a breach happens, fast responses are essential. It’s important to have a thorough understanding of who in the organisation would need to be notified most immediately of incidents, actions being taken and the likely timeline – which could be long. According to US-based Ponemon Institute, the average time it takes to identify and contain a data breach is 280 days after the attacker has gained access.
Different tiers of escalation may be needed, depending on the type and scale of the issue. A senior manager impersonation attempt, where there is a risk of financial impact to the business but no loss of customer data, may be a relatively simple internal communication to employees that explains what happened, the formal process to avoid it in future, how to implement the process effectively, and which reminds them to stay vigilant.
A more critical breach where, for example, customer data is compromised, will require a much broader response with messaging tailored to each area. Internally, this could include customer-facing teams and those with supplier relationships, as well as a broader communication to the entire workforce. This may also require the involvement of legal departments for reporting to regulatory or governmental agencies. High-profile incidents will also need rapid responses for media and other concerned parties, like customers.
A thorough understanding of these factors, which are unique to every organisation, will facilitate timely communications where and when they’re needed.
Build a messaging framework and communications plan
Crisis communications playbooks can form the initial basis of a cyber comms framework, and then be tailored for cyber incident scenarios with agreed escalation notifications, templates, procedures, spokespeople and points of contact.
A process where incident-related messaging templates and communications are developed in collaboration with relevant internal teams, but where delivery is centralised, will help ensure that messaging is clear, informative, consistent and targeted correctly. A defined RACI matrix will ensure clarity around who is empowered to make decisions in the event of a crisis.
The need for rapid deployment of cyber comms strategies is almost inevitable, but it’s also important to understand the overall timeline: how much do you need to explain, to whom, and when? Don’t necessarily communicate too early – it’s better to know the facts.
This must be balanced against the need to avoid, as much as possible, a vacuum in information. Customers, suppliers, colleagues or the media may be asking questions. It’s vital that, very quickly, employees are given clear direction of what information is coming and when, what they can and can’t say, and who will provide them with updates.
The communications function can play an important role by being the central source of informed, accurate, consistent, timely and relevant information. Comms teams will also ensure that communications are understandable, rewriting details where necessary to removing or improve clarity in what can be technical situations.
Consider too how communications will be possible if core mail or collaboration systems are affected. Prior agreement of alternatives, such as WhatsApp, will ensure any internal approvals needed are in place and that the necessary stakeholder numbers have already been compiled.
For any issue that is in the public domain, a top-level messaging framework will help ensure prompt and clear communications that provides the right information at the right time.
By preparing for the eventuality of a cyber crisis early, communications leaders will be better able to manage the aspects of the response that can’t be foreseen. And by ensuring employees are informed and educated on cyber risks – employee communications may even help prevent a crisis from occurring in the first place.
(The author is a Communications Consultant)
