| | December 202219CIOReviewThose of us who lead cyber security teams dread the day that we pick-up our cell phone at 2 am and see the caller ID says "CyberSOC". You quickly harken back to those days when you were parents getting late night calls from your kids; remember what your mother told you, "Nothing good ever happens after midnight." You take a deep breath, let out a sigh, and take the call, to learn that they have discovered what they think might be a breach. As one of my colleagues likes to say, it makes your "pucker-factor" go up considerably.We all work hard to put incident response (IR) plans in place, run exercises and penetration or red team tests, all to prepare for the day when that call comes. But most of us also secretly hope that our IR plans are like insurance policies, something you have but never want to use for a real situation. While some people thrive for the rush of those moments, like those who work in emergency rooms, most of us would rather practice and never have to play in an incident response game.There are many ways an incident response can be done. You can be fortunate enough to have internal resources to handle it. You can have contracts with companies who provide those critical services. You can have a combination of both. But for smaller companies, these options may prove to be too costly and be out of reach. There are free services offered by DHS-CISA, DOE, and others. But even those are limited and could be difficult to get in the event of a nationwide cyber THE ARMY NATIONAL GUARD ­ AN IR RESOURCE YOU MIGHT NOT KNOW ABOUTBy Timothy S. Pospisil, Director of Corporate Security & Chief Security Officer (CSO), Nebraska Public Power District (NPPD)CXO INSIGHTS
< Page 9 | Page 11 >