The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), set to go into effect next year, requires critical infrastructure organizations to report cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA).
The guidelines, as outlined by CISA, were open to public comment over the summer, and the resounding consensus was that many critical infrastructure companies don’t feel prepared to report cyberattacks within the 72-hour required window and ransomware payments within 24 hours.
The hours following a cyberattack are hectic, confusing, and overwhelming, with many often finding that hours can quickly turn into days. If organizations do not have a plan in place before an attack occurs, it’s difficult to coordinate internal efforts to report an attack and identify what needs sharing, all while simultaneously dealing with potential ransom demands, outages in operations, and general chaos.
As companies prepare for CIRCIA there are at least three steps they can take: engage a breach counsel, develop a plan of action should primary infrastructure be taken offline, and strengthen their backup infrastructure. These steps will help to ensure compliance with upcoming regulations while prioritizing business continuity.
Start by identifying a Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RPO measures how often data gets uploaded from the primary network to the backup. The lower the RPO, the more up-to-date the backup, meaning there’s less data lost when it comes time to recover. RTO measures how long it takes to restore systems from the backup. Both objectives determine how much data the company can restore and how fast; crucial information that informs a post-attack strategy. However, it's nearly impossible to maximize resiliency without testing before an attack. While it’s desirable to shorten RPO and RTO, it’s not possible get there without running simulations and recovery tests. Conduct a staged restore or other test run to work out the kinks and optimize RPO and RTO to what works best for the business. Ensuring the content of the backups are protected and consequential, as cybercriminals now target backups to try to leave organizations without any option but to pay the ransom to get their data back. Immutable object storage ensures that data cannot be encrypted or deleted by anyone once it has been written, including employees and threat actors alike.
Having a plan for what immediate actions to take following an attack and how to restore data to bring operations back up and running mitigates the disruption and confusion following an attack. This will make it much easier for companies to report breaches, cyberattacks, and ransom payments to the government, law enforcement, impacted customers, and other stakeholders faster -- and with more information.
Anthony Cusimano, technical director, Object First
