Born To Be Wild

Author: admin

  • How Incident Management Exercises Become Reality

    How Incident Management Exercises Become Reality

    Picture this: you’re in a three-hour training and exercise workshop with your colleagues around Crisis Management preparations and best practice. You’ve been learning everything about what your organisation can do now to be best prepared. During the latter half of the workshop, you begin your scenario exercise.

    This exercise involves the whole class where both the CMT and the day-to-day staff go through a makeshift event.

    Your course facilitator briefs everyone on the exercise but reminds them that “if the alarms or your phones do go off, it’s not me, it’s a real event”. Everything in your exercise is managed by the facilitator.

    But then, Karren’s phone starts ringing. She answers and realizes that it’s a situation eerily like that of the exercise. “I’ve got a call here regarding some protesting down in our lobby, is this your people?”

    “No Karren, it’s not”.

    Three minutes later, the CMT has left and the room has become somewhat deserted. A real event has occurred during a session.

    For most organisations, probably yours’s included, this period of the year is always busy, the “crazy season” which runs from October to December. This year our numbers are exceptionally larger than usual.

    70 training and exercise sessions to be exact. However, that’s not the most interesting statistic we would like to share; it’s the number of sessions that have been interrupted due to a real event. Of all those session’s, 10% of them had to be suspended or cancelled due to a real event impacting the organisation.

    That’s too much of a coincidence

    In Australia alone, we’ve had five recorded events occur during our sessions in the past two months. In New Zealand, it happened only a few week ago during our 16 hours of training.

    Thinking that it won’t happen to me or what are the chances implies you’ve not taken the eventuality seriously. It’s not a matter of if but when and it can even happen during the training of it.

    Our exercises are designed to be extremely realistic and life-like. It’s not uncommon for the Team Leader to turn around and ask the trainer, “is this you guys?” This is what we would commonly label a ‘No-duff’ situation. A code word we would use to identify a real event that has occurred outside of exercise conditions.

    We have seen disruptions to a training session with our clients across several different industries:

    • Local Council – Gas leak building evacuation.
    • Logistics – Severe weather event.
    • Education – Gas leak.
    • Local Government – Cyber event & Protests on campus.
    • Cyber-attack that stopped production for a manufacturing company.
    • Suspected MERS outbreak in a University.
    • Social media accusation of abuse against a school during the Royal Commission.

    What can happen?

    These events re-enforce and drive home the importance of building your resilience capabilities. They are not going away while the type and diversity are increasing every year to organisations.

    So, what’s an example of when this occurred? How did we and the organisation react?

    A specific event comes to mind recently where an office block was the potential target for a major protest. The team were aware of this as news had arisen days before on the attempted gathering. There was already buzz in the session.

    Upon arrival, it was clear something was bubbling up and we all noticed a few aggravated persons making an appearance in the lobby.

    A threat was made that they would return with more people, right when our training session was on.

    Facts started to immerge that the specific initiator of this protest was known for building and promoting these protests. They were also known to bring (most likely fake) dynamite. So, as you can imagine, we were on edge a little during the exercise.

    Luckily in this situation, the main initiator did return with no ‘dynamite’ and to the applause of zero followers.

    Another interesting event happened only a few weeks after. The team RiskLogic was training consisted of a very credible amount of crisis management professionals (including emergency procedures, a regional incident management team and a corporate crisis management team).

    The situation that unfolded during our session was another serious one. A mentally unstable person was threatening the location occupied by staff with firearms. The area locked down, police called, and the CMP was put into action.

    The aspect that makes these so valuable for RiskLogic and our clients, is that we can get involved and help them through the process of managing the event, in real time. Not only do we prove our worth during a real event, we’re able to provide some world-class feedback on how we thought they handled it.

    Yes, we’re there to run the training and scenarios, but if a real-life event occurs – you can sure believe we’ll be there helping you get through it too.

    After this case, we were able to debrief the situation which is incredibly valuable for all involved. Our module, only five minutes before, was around whether this organisation knew what worked for them, what doesn’t, what team structures and processes have proved to be effective and what hasn’t. Having a live example was a great opportunity to go through some of these aspects.

    Where does the value come in?

    If you put business continuity professionals into a real-life situation, you can be confident he or she will find the value out of being there during the event.

    You can learn a lot about your organisation when everyone is in action mode…or in some cases panic mode.

    The organisation may be strong in the Emergency Management sector, but during the above event, it was the Incident Management and Crisis Management that really needed to flow (which needed a lot of work).

    RiskLogic is able to put our solutions and technology to the test, like the dashboards CQCommandhave. We create visual boards and have the facts mapped out while it’s happening.

    We were able to identify trigger points and how these can escalate from Emergency Management to Incident and Crisis Management. All of this while the event unfolds.

    Value comes in from learning from the experience and practicing what we’ve taught you. When certain elements haven’t worked, we can apply a post-event analysis on this and get straight into how this can be sorted.

    Embrace an event

    If this happens to you in a training session, you might be lucky and have a Risklogic facilitator on hand to assist and guide you through the real event, just as some of our Senior Managers have been doing lately.

    In most scenarios, your choices are to continue the exercise and monitor or, suspend the exercise and deal with the real event. Regardless, if it does occur you should be using this as a great time to really test the team, understand the holes that need filling in and, most importantly, making sure you congratulate them on the right steps the team would have taken.

    On the plus side, you already have your team assembled and they should be in the right head space.

    Contact Us today to learn more

  • Organisations Under Pressure: Leading in a Crisis

    Organisations Under Pressure: Leading in a Crisis

    Compared to business as usual, a crisis presents a unique and challenging decision-making environment. Whether it’s a natural disaster, hostage scenario, malware attack or other crisis, leaders and team members may be under enormous psychological pressure when managing a major incident. In such extremes, strategic leadership is crucial, particularly as the leader is unlikely to have had direct experience of the crisis beforehand.

    Two different leadership styles

    There are two different leadership styles that may apply when managing a major incident. These being task-orientated and people-centred leadership. Neither one of these leadership styles outweighs the other in importance. Instead, depending on the crisis and incident, the appropriate leadership style will need to be invoked.

    The task-orientated leadership style is focused on strong hierarchies and task-orientated behaviour to drive outcomes. This leadership style takes command and control of the situation by determining specific tasks and scope of work for their alternates. She or he determines what, how, where and when the work must be done.

    The people-centred leadership style places greater emphasis on their relationship with their team members, encourages two-way communication and harnesses ideas from the team. Employees often open up to leaders who are human, who have made mistakes and learned from them. ‘When you capture the hearts and minds of people, let them have their say in some of the decisions, they will have greater buy-in and be more willing to strive for excellence,’ says Melbourne RiskLogic Senior Manager, Gary Vogel.

    Choosing the best crisis leadership style for your organisation

    Crises are unpredictable, chaotic and can escalate quickly. Leaders must deal with issues that are difficult to understand and which seriously threaten the viability of the organisation and possibly even the safety and welfare of staff and clients or customers. ‘During a crisis, people are often panicky and in need of assurance that someone strong is in control. Task-orientated leadership using the command and control approach has been used effectively in these situations as it provides strength, helps assure the team, and galvanises their efforts,’ confirms Vogel.

    An inspirational leader is one who quickly, calmly and decisively controls a crisis situation

     

    ‘With great power comes great responsibility, and managers are expected to lead – especially through times of difficulty. A good leader will change their leadership style based on the situation,’ adds RiskLogic’s Brisbane Regional Manager, Simon Petie.

    A people-centric leadership style may well be better placed for the business as usual environment, or when reviewing and learning from the crisis and preparing for the next one. For a people-centered leadership approach to be effective during the crisis, the workforce must be fully aligned in its values, direction and drive for success.

    ‘The maturity of the crisis management team is a critical consideration in terms of how the leader leads during a crisis,’ says RiskLogic’ Melbourne Regional Manager, Cheryl Hambly ‘If the team has extensive experience working together in crisis mode, the leader may be able to take a more supportive rather than directive role. However, in reality, this may be difficult to achieve. In a less mature team, as is often the case, team members will need a higher level of direction to set objectives and respond to the situation,’ adds Hambly.

    In a crisis, there is often simply no time to consult with the team about what to do. If you hesitate as a leader, if you delay a decision in order to form a committee to discuss your options, you may miss the decisive point that will tip the balance between success and failure, or possibly even life and death.

    Becoming a resilient organisation

    To be a resilient organisation, leaders must be able to adapt to and successfully steer the organisation through all kinds of disruptive changes. It’s not enough to simply train your managers to be decisive or to tell your staff the location of emergency exits and assembly points.

    If the command and control leadership approach is counter to your organisation’s typical approach, working through times of stress and challenge may be exceptionally difficult. Leadership in a crisis might not be within the skill-set of your organisation’s senior leaders – a leader who is highly successful in normal business may not be able to lead well in a crisis.

    The only practical way of preparing leaders for a crisis is a rigorous, realistic and regular training program, which allows leaders to examine all the implications of those challenging, yet plausible ‘What if…?’ scenarios. Key employees need to be trained to work within the crisis management plan to help ensure they respond in the most appropriate way. A well-managed communications strategy that ensures accurate and timely communication is also critical to instil calmness, authority and confidence in all those affected by the crisis.

    RiskLogic has spent over a decade piecing together the perfect solutions for organisational leaders to remain in control during a crisis and understand the best leadership style during a crisis, you can read more about this here in our CQ Leadership Package. 

    Contact Us today to learn more

  • Mass Communications and How They Affect Our Visitors

    Mass Communications and How They Affect Our Visitors

    I hope you all had a well-deserved break over the Christmas period. It’s important to switch off and recharge the batteries as they say.

    For Risklogic, the end of 2017 was our busiest on record, so for me and my colleagues across the ditch, it was very important to take some time. However, when you choose resilience, Emergency or Crisis Management for a career, you have always got one eye on what’s going on around the world, not just on the contracts we work on.

    One of the more well-publicised events were the huge wildfires of California. These have no doubt been catching your attention in some form. Whether it be the celebrity retweets, the images of wild animals fleeing down busy high streets, or the images caught by the International Space Station, you can tell it’s a big one.

     

    The stats so far on the fire

    The covered story and event in America is actually three separate fires, Thomas Fire, Rye Fire and Creek Fire.

    Each of these fires cover hundreds of thousands of acres with Thomas Fire being the largest and most reported.

    The Thomas Fire has destroyed at least 1,063 structures while damaging 280 others; becoming the 7th most destructive wildfire in California history.

    During the three major fires, a dozen other fires roared through the state of California stretching the emergency services to their absolute limit. Fire services from around the country were flown in leaving their own state under-resourced during Americas dry months.

    Over 122,000 acres have been burned, much of it the lush, picturesque landscape of the state’s beloved wine country. The area burnt so far in Napa and Sonoma is three times larger than Washington D.C.

    The fires torched 20,000 acres in about 12 hours on the Monday alone. This means the fires advanced at a rate of more than a football field every three seconds.

    The smoke from the fires led to the worst air pollution on record for Northern California. Air quality is considered “very unhealthy” when the index reaches 201. At one point on Tuesday, the air score in parts of Napa hit 486.

    This large fire has ensured the insurance total had risen to $9.4 billion in less than a month.

    Source: edition.cnn.com

    Getting away from it all

    For me, my downtime and re-charge involved a trip back to my favourite township in New Zealand,

    Wanaka. Located in Otago, near the Southern Alps of NZ. This place is the place to be, so much so Shania Twain has a house there and the character Ethan Hunt of Mission Impossible spent his honeymoon there!

    I wasn’t there to buy a house (unfortunately) or try to escape work from the CIA, it was about mounting biking, trail running and kayaking, maybe the odd beer or two as well. However, on the second day during a trip on our kayaks to a small island, my wife and I noticed a couple of helicopters flying overhead.

     

    Not unusual for this part of the world, the difference this time being each one carried monsoon buckets. ‘Probably just a training exercise’ I thought, as I couldn’t see any fires.

    That soon changed on our way back to our campsite, suddenly it became very clear that this was not a training exercise when Mount Roy came into view covered in smoke and flames. The hillside overlooks Wanaka and obviously attracted a lot of attention from the thousands of tourists that descend on this part of the world.

    Temperatures of 32+ degrees and strong winds were not making things easy for the fire crews and pilots who were flying non-stop all day and for the next couple of days to contain the blaze.

    The Wanaka fire was contained in 5 days. No houses or people were lost, which is a tribute to the hard work and dedication of the emergency services. However, one theme is common in the Wanaka and fires of California: how do we communicate with tourist in this situation?

    I was a tourist, so I’m keen to understand! I am of course from NZ, I have been to Wanaka many times and I know the area well. But what about the backpacker from Europe, who has just got off the plane? It could be jetlag, but it could be they just don’t have any situational awareness on their new environment yet?

    I was amazed to overhear a young German lady in the campsite office asking the receptionist; “Can I have some information on the walks near Mt Roy please”. The receptionist replied in shock “um…everything is cancelled at the moment due to the fire”. (The smoke, 200 hundred acres of scorched hillside and constant drone of helicopters visible from the office window she was standing only centimetres from). “Oh really, what fire?” the young girl replied. The receptionist and I looked at each other in disbelief. Utter astonishment to how anyone, even with the lowest form of life experience couldn’t see the hillside that closely resembled that of Mount Doom during that final scene in Lord of the Rings.

    As of October 2017, New Zealand hosted nearly 3 million tourists. In 2018, we are expecting a 9% increase. Who is responsible for keeping them safe do you think?

    It’s fair to say that New Zealand is working on improving its mass communication process, but has anyone thought about our visitors? I’d imagine that it’s on the Governments ‘to-do’ list and I’m sure the emergency services are very aware, however, this young traveller had no idea, how did it miss her?

    I have to say, that having lived in New Zealand for the last 14-years and most of that time in the Canterbury area, like many other Kiwi’s, I have seen my fair share of natural disasters.

    The “she’ll be alright” statement is still alive and kicking even after these events. Cantabrians have become very accustomed to the shaking, (we still don’t like it though), but it’s probably a new experience for our tourists, will they know what to do? Do we know how to contact them?

    If the Wanaka fire had got out of hand and the town had to be evacuated, how would the COMM’s work? I’m not sure to be honest and I was a tourist too! Which is a massive concern.

    Wildfires can get out of hand very quickly. During my time living and working in Western Australia, I was a volunteer for the State Emergency Services (SES). During that time, I did some bushfire training and the one thing that struck me is the speed at which a fire can travel.

    Similar to the fires of Queensland 2010 which travelled at 110kph at one point, the Thomas fire in California spread an acre a second! You can’t outrun that. You can’t even out drive it. Fast and efficient communication is vital and things can and do get out of hand very quickly.

    Don’t just take my word for it

    The official Government Technology Publication (www.govtech.com) wrote a long-form piece on the issue with communication during an event of this scale.

    Found here, they discuss how “when the warnings came, they were not received by many of those in the most peril”.

    “I can use my cellphone to order a pizza and it gets here,” said Rob Lewin, director of the Santa Barbara County Office of Emergency Management. “Why can’t I have that same system to save people’s lives?”

    Fortunately for Rob, you can use technology to achieve such mass-communication and collaboration with tools like Activate and CQCommand. But as a trainer and seller of these innovative bits of software, I still struggle to find people who believe and understand why they need it as much as someone like Rob Lewin does. If the tools exist, what have you got to lose to use it?

    Technology is still being adopted in the Crisis and Emergency Management space. It’s early days for organisations trusting the power and reliability of an app on their phone. However, the alternative right now simply isn’t working. Trying to communicate over radio, Facebook or even a loud siren 20ks away isn’t going to cut it.

    Education

    So, who is responsible for the tourist? The tour companies? The airline? Airport Immigration? The Government, or maybe the tourist? My personal view is it’s all of the above:

    • Tour company: Provide information of the potential hazards in New Zealand. (I know, not great for selling a product, but they will still come, don’t you worry)
    • The Airline: On the final descent would be a perfect time for the aircrew to remind us to sign up for the mass notification system. We all must fill in the arrivals card anyway, make sure there is a section on mass communication.
    • NZ Immigration: Confirm that the mass communication section has been filled in on the arrival card, so we can contact you in an emergency.
    • The Government: Invest in a national mass communication tool to include visitors.
    • The Tourist: Be responsible, sign up for mass communication, listen to locals and stay smart with your actions.

    An example of a tourist doing the complete opposite of this was during the Wanaka Fires where a Frenchman decided to fly his drone above the planes, which then grounded all helicopters. The stupidity of some people astonishes me to this day. 

    I would be interested to hear your thoughts as I know we’ve all done a lot of travel over the years. Was there an event overseas you were a part of? How was it handled? What did you do and was there anything you would recommend?

    Regardless, we’re still deep in the fire season, so stay aware, prepared and be resilient out there!

    Until next time, plan, do, check & act…

    Contact Us today to learn more

  • A.I. Recognising You: A Good or Bad Thing?

    A.I. Recognising You: A Good or Bad Thing?

    We’re all becoming used to our smartphones recognising a face when we take a selfie. Snapchat, for example, can view your face and add effects to it in real time. The new Samsung S8 and iPhone X can both now unlock with a simple scan of the users’ face, as opposed to the previous pin code or fingerprint.

    A year or so ago, Mark Zuckerberg was caught with his MacBook covered in tape to avoid both facial recognition and audio. If the most powerful entrepreneur in the world hides his camera, should we be concerned? The answer is yes, we should be.

    The reason for being aware of this and being concerned circulates around one golden theme: cyberthreat.

    Would-be hackers now have another gateway to your personal details. A good example of how extreme facial recognition has become takes us to the Chinese province of Xinjiang where the township has become a sort of surveillance, Big Brother laboratory.

    The basic premises of this ‘experiment’ is for the government to be alerted when individuals venture 300 metres beyond designated ‘safe areas’. These areas make up routes to workplaces, homes, and shopping facilities. However, an invisible zone has been set focusing its attention on the wandering citizens that live there.

    “‘Papers, please’ was the symbol of living under tyranny in the past. Now, government officials don’t need to ask,” said Jim Harper, executive vice president of the libertarian Competitive Enterprise Institute.

    It seems now that a system of this magnitude is simply an up to date way of controlling people.

    It’s unlikely that demographics in New Zealand and Australia are likely to have such extreme measures put in place, however, it doesn’t mean we’re exempt from the technology itself. Far from it.

    In London City and Westminster, it is reported that no less than three cameras are watching you at any given time. There is simply no alleyway, Tube station, park, or shop without CCTV and thus creating the worlds largest ecosystem of digital eyes. The point here though is not to be worried unless you’re giving someone else a reason to be worried. These amounts of cameras can actually work in your favour during a serious incident. You should also remember that there is a current population of 8.7 million people in London and it’s unlikely you’re important enough to be the focus…sorry.

    Since the attacks in France, Manchester and the Sydney Lindt Café incident, security and police have never been so on edge or operating in such large numbers. Going off the events of the last 24 months, they have a fair reason to be as well. We’re therefore likely to continue to see updates in technology in our own streets. New, extreme and intrusive measures to watch everything that is going on.

    Shopping in Westfield this weekend?

    A perfect case to be ‘followed’ by someone other than the kids is Westfield shopping malls. If you enter a mall and decide to jump on their free WiFi system, you are prompted to accept the T&Cs, like always. You’ll likely hit accept before you even consider reading the 9,000-word document. That document, however, explains the following:

    When you sign up to become a member of the Site, you will provide us with certain personal information. Your personal information may be used for providing you with news, offers and information about the Site, the Scentre Group shopping centres and promotions run by the Scentre Group, as well as for the purposes set out in section 13 of these Terms & Conditions.

    In section 13, it reads:

    …we may transfer your personal information to others in countries outside Australia.
    … Scentre may collect your personal information through your use of the Site or through your contact with Scentre. Any personal data and other information provided by you will be treated by Scentre in accordance with the Online Privacy Policy.

    When entering Westfield shopping centres and car parks, customers’ personal information, car licence plate details and images may be collected by Scentre, and Scentre may also collect customers’ personal information and images from third parties

    To save you time reading another 8,500 words on the Online Privacy T&Cs, we’ve narrowed down what they’re saying here by digging deeper.

    Westfield collects user information on their location in the mall, the shops they enter, time spent within that section, any pages the user open through a browser relevant to that retail outlet and sells this information to both search engines and the outlet itself.

    It’s targeted marketing on steroids.

    If you’ve ever wondered how and why an unbelievably relevant product you’ve just spoken to your partner about appears on your Facebook feed, it’s because of the above reason, and it’s as simple as that. Westfield has been doing it and your device does it as well.

    China is leading by example

    There is a reason Xinjiang has become a testing station for such specific, large-scale surveillance centres around where it lies; the region boarders Pakistan and Afghanistan.

    As reported in Bloomberg Businessweek, “The country is on track to represent 46 percent of the $17.3 billion global video surveillance market by year-end, and three-quarters of all deep learning-enabled servers for analysing the data, according to Jon Cropley, a senior principal analyst at IHS Markit.”

    Similar technology was used during the French attacks of 2015 where gunman and suicide bombers terrified the city. While on lockdown, the authorities used registered images of the offenders (or who they thought to be the offenders) and scanned millions of faces within seconds. The days of watching hours of tape to find a blurry face have long gone and have been replaced by auto-recognition. The exact same technology on the Samsung S8 and the iPhone X.

    Due to continued aggressive attacks in the province, last year, Xinjiang called on law enforcement officials to “actively use modern scientific and technological measures” and “safeguard national security and social stability,” the official People’s Daily newspaper reported.

    Bloomberg reported ‘the alert project links security cameras to a database of people who have attracted the attention of authorities and tracks their movements within a particular area, their contact said. Police can follow up by intercepting individuals or visiting their homes and questioning their friends and families’.

    Despite pushback from America and Europe, China is truly leading the way on mass surveillance with this new technology with their reasons being control of unsecure sections and security.

    Freedom vs Safety

    The ultimate pushback from a community around facial recognition, extreme CCTV adoption and control over movements is universal; I want my freedom.

    So, the question is, do we allow being watched so closely and on a large scale and thus allow opportunities to catch criminals and in extreme cases, terrorists? Or, do we get rid of the technology now and go back to the old days of asking witnesses, looking for a “man in a grey shirt”?

    When you swing it that way, it’s obvious which choice to use – so it’s more the concern around security than around the use of personal information. There are literally hundreds of thousands of ways for someone to find your information. As Westfield points out, they can’t guarantee that security, but you accept the risk by joining.

    Therefore, we need to be aware of it, understand it and learn how this technology can help us. We then need to understand how to remain resilient in our own daily lives. Making sure that you know ways of losing your personal information.

    And if you’ve got a webcam on your laptop, perhaps a bit of tape wouldn’t go amiss?

    Contact Us today to learn more

  • 5 Tips on Responding to a Cyberattack

    5 Tips on Responding to a Cyberattack

    Last week, RiskLogic brought you the news on the GDPR Regulation that will affect any business or persons who hold European data. This new regulation, although positive for its subjects in question, could be a damaging change for businesses who have not implemented effective cybersecurity and data breach procedures.

    It’s being predicted that the EU could collect as much as $6 billion in the first year due to many organisations not taking these changes seriously.

    An Overview of the Regulation

    The regulation will affect anyone holding European data who fails to report a breach within 72 hours, in a detailed report. This may affect:

    • A New Zealand or Australian business with an office in the EU.
    • An ANZ business whose website targets EU customers, for example by enabling them to order goods or services in a European language (other than English) or enabling payment in Euros.
    • An ANZ business whose website mentions customers or users in the EU.
    • An ANZ business that tracks individuals in the EU on the internet and uses data processing techniques to profile individuals in order to analyse and predict personal preferences, behaviours and attitudes (largely used for marketing).

    The fine for failure to report on a breach could be up to 2% of the business’ annual revenue, or 10,000,000 Euros (whichever is larger).

    Using our own Cyber Security Incident Management Procedures program, we’ve compiled our top five steps you should be considering by May 2018. When the regulation becomes law, every organisation will have a responsibility to maintain a higher level of resilience. Above all, you will no longer be subject to just reputational, operational, legal or regulatory impacts, but now also financial.

    Tip 1) Acquire a detailed Cyber Security Incident Management Procedure & Plan

    RiskLogic’s detailed program on effective cyberattack recovery spans four key steps: Identify, Contain, Eradicate & Recover.

    This program will enable you to:

    • Provide IT personnel with general and specific procedures for dealing with cyber incidents.
    • Provide an escalation path to Executive Management for major cyber incidents that have potential to cause human, financial, legal, reputational and/or strategic impacts.
    • Provide IT personnel with preparation lists in order to better prepare them for cyber incidents.
    • Provide IT personnel with a process to deal with cyber incidents where a defined process for a specific threat is not included.

    The document provides a protocol for dealing with cyber incidents specific to your organisation. It includes assessment tools, key cyber roles and responsibilities, processes for specific threats, mitigation strategies (in general) and for specific key threat areas.

    With the likelihood of a data breach stronger than ever, it’s useful to reach out to these documents to follow effective processes unique to your people and the structure of your organisation.

    72 hours isn’t a long time to report a large breach to a European Council, it’s worth understanding now if you have the steps in place to do this.

    Tip 2) IT Personnel to have Access to General & Specific Cyber Procedures

    Your most important asset during a breach is your IT Personnel. For them to do their job to the highest and most effective standard after an attack, your procedures should be used to manage the containment eradication of the attack, and to manage the recovery from the attack. Identify and assess the processes in the Incident Management Plan to make this happen.

    Once your plan has been signed off by Senior Executives and your IT team has been trained, they should be able to easily answer:

    • What data was lost or breached and who is the immediate contact to notify?
    • How are they notified of the breach of data?
    • What personal information does the breach involve?
    • What was the cause of the breach?
    • What is the extent of the breach?
    • How can the breach be contained?

    Tip 3) Document Escalation Paths for Major Events

    When an event has progressed from an attempted breach to a serious event, your Senior Executives will need to know the details as they occur. Keeping a procedure in place for this will ensure the correct decisions are made from the information coming in.

    Tip 4) Identify the Risk Classification

    In our programs, we separate risks into five key classifications:

    1. A data breach through unauthorized access to customer or sensitive data (including medical information and member level monetary transactions) that may result in information being stolen or disclosed in an unauthorized manner. This would lead to reputational, legal, regulatory, and financial impacts to the organisation.
    2. A denial-of-service attack or network interruption from an attacker (e.g. Hacktivist) against either you or a third-party provider that may result in reputational, operational, legal or regulatory impacts to the organisation.
    3. Phishing, pharming and drive-by attacks against your employees or third-party providers that may result in financial or reputational impacts to the organisation.
    4. Malware or ransomware from an attacker that may result in significant financial, legal or regulatory impacts for the organisation.
    5. Corruption or conflict of interest within your organisation by employees or a third party may result in unauthorised payments being performed. This may lead to financial, legal, reputational or regulatory impacts to the organisation.

    Once the classification has been determined, it’s time to assess likelihood factors. Your organisation should understand the cause and damage that has occurred. Understand quickly the threat source, motivations and the further capabilities of the hacker.

    Summarising the threat source quickly will then help you implement the correct procedures to deal with it. For example, did it come from:

    • Employees
    • Lone individuals
    • Competitors
    • Third party providers, contractors, or other inside entities
    • Hacktivist
    • Organised crime
    • State/s sponsored activity
    • Employers

    Unauthorised access can occur from poor password security from users, password sharing, or accounts being used inappropriately throughout the organisation.

    One of the top four key risks in the world today is IT Administrator passwords being used/accessed to create havoc. Gaining access to an administrator password is the fastest route for hackers/criminals. This can have devastating effects on the organisation and can lead from a small incident to a snowballing one affecting the whole organisation.

    Tip 5) Know what Your Reporting Channels Are

     

    The internal reporting, communication and structure of your crisis team should be well documented, checked and acted upon during an event. The same should be implemented in your external reporting, especially with the new legislation.

    A good starting point is to understand where New Zealand sits right now with regards to processes for reporting breaches. The Privacy Commissioner has a handful of ways to report breaches, and these can be found here: https://privacy.org.nz/news-and-publications/guidance-resources/privacy-breach-guidelines-2/

    CERT Australia recommends that businesses report Cyber Incidents. This can be done by:

    • Calling the Hotline 1300 172 499 or
    • Emailing info@cert.gov.au
    • Online via the Australian Cybercrime Online Reporting Network (ACORN) https://www.acorn.gov.au/

    Conclusion

    These changes come into effect on May 25th, 2018. This gives organisations only a small timeframe to ensure that their processes are in place. Whether you are directly affected by these changes or not, this is a good excuse to review the processes your IT team has in place.

    To put the seriousness of cyber threats in 2018 into perspective, IBM ran a detailed report on the impacts stating that a minor event can last 19.7 minutes with a financial impact of $53,210 per minute. The chances of these smaller events happening are 69% over 24 months.

    We’ll be reporting on these numbers and findings from IBM and McAfee in next week’s article.

    Contact Us today to learn more

  • Criminal Investigation within The Workplace

    Criminal Investigation within The Workplace

    Criminal Investigations within an organisation tend to be on the far side of the spectrum when it comes to a crisis, but their importance to your resilience planning is equal to anything else you should consider. In New Zealand alone, there have been 267,465 victimisations in 2017.

    Criminal Investigations cover many events such as staff thefts (which can be widespread in retail or warehouse environments), fraud including false accounting or misappropriation, sexual assaults, unauthorised use of IT systems and access to computer systems.

    Knowing when it’s necessary to initiate the steps in investigating a criminal act is important to effectively maintain the correct procedures. This April, RiskLogic has partnered with Veritas Investigators to help bring this delicate subject to the surface while in turn, promoting a more open discussion around it.

    Veritas Investigations recently undertook an advisory role where a company’s employee had been charged with kidnapping.  The company was initially making blind decisions without realising wider implications of both the police investigation and their responsibilities as an employer.  Veritas Investigations were able to provide advice regarding the police investigation in order to mitigate any adverse media coverage.  In addition, they assisted the company with locating and interpreting data which helped inform them about future hires.

    When an event as serious as this occurs to an organisation, there should be strict predetermined processes set in place to ensure legal and compliant steps are taken. Events that are serious enough to seek external Investigators are ones that require planning and practice prior.

    When reviewing or running your Business Impact Analysis (BIA), there are certain questions to consider:

    • What are the considerations of key factors that will influence major decisions?
    • If a complaint like fraud is made, are you confident that police will investigate in a timely manner? What is your process if not?
    • What may happen between business, client/customer and Key Stakeholder relationships should something occur?

    Often when an internal investigation is initiated, it’s hard to keep it confidential. Employees, third parties and in some cases media, can become aware of the decision to seek police or private investigators. This only brings with it more concerns and reputational risk. Your sensitivity of investigation and potential risks need to be evaluated well before any plans are set into motion. Think; does my organisation hold a level of risk we can not afford to be tampered with internally or within the media?

    Sometimes, however, investigations don’t involve the police. This is usually down to the discretion of the organisation in question, but it can be handled in other ways. For example, a whistleblower alerting a company to thefts committed by a trusted employee who is related to the business owners

    Whether police are involved at an early stage or not, many companies will engage the services of a Private Investigator to oversee and manage the process from the company’s perspective. This is especially effective when the process and contact of your chosen investigators is well documented and aligned to your Business Continuity Plan (BCP).

    More than ever, companies are seeking more continuity in their business plan and looking for more ways to reinstate or retain the confidence of their shareholders, clients, customers, and Key Stakeholders. With the help of contracting reliable and experienced Private Investigators, this can add to your resilience and credibility.

    Contact Us today to learn more

  • Internal Theft: The Price of Money Fraud

    Internal Theft: The Price of Money Fraud

    Resource on this article: http://risklogic.co.nz/auckland-april-10th-2018/

    In the retail sector, many larger suppliers will set aside a huge chunk of revenue for the loss of stock. In some cases, this amount is in its millions per year and covers such events as damage on delivery, acts of god, faulty and theft. It also covers internal theft which has been on the rise over the last ten years in New Zealand and Australia.

    Joanne Harrison, a senior manager of the Ministry of Transport was convicted of stealing $725,000 from her employer in February 2017. This threat, although serious, is seldom seen in organisations Business Continuity Plan.

    In line with our workshop this April, we wanted to give you an example and case study of one of Veritas’ clients which explains the process of identifying and dealing with the findings of the event.

    In this example, we’ll call the business Company B. They are a service provider to the education sector. They’ve operated for 5 years and been on a growth strategy throughout that time. It is a family-owned firm that has expanded from the initial 3 employees to now having 17. During this time delegated authorities have devolved outside of the initial investors to employees.

    In February 2018 the company accountant alerts the Managing Director (MD) that whilst on paper they are making a good gross profit their overall net profit does not match their efforts and bookwork.

    The accountant identifies a number of pro-forma invoices for which payment has been authorised by a senior and trusted employee. It appears that the invoices are for firms that are very similar in name to existing suppliers, however, some of the details including bank accounts do not match.

    A discussion is held between the MD and the accountant on how to proceed on a way forward. As a result, the MD rings a friend who is a senior police officer and discusses this matter. The police officer says that it is unlikely that police could investigate this matter in a timely manner (within 6 months) due to other more serious crimes taking priority.

    The MD is unsure how to undertake enquires and seeks advice from a Private Investigator (PI).

    The PI advises that there are a number of opportunities to investigate the pro-forma invoices which include the following:

    • A forensic search on Company B accounts,
    • background search on the trusted employee,
    • background search on all suspect pro-forma invoices,
    • background search on any companies affiliated with pro-forma invoices,
    • authorised search on bank accounts used and
    • conclusion of enquires including recommendations made by PI.

    In addition, the PI gives advice to the company about future prevention opportunities including background and CV checks on prospective employees and using a risk-based approach to future engagement with firms.

    From a resilience standpoint, systems and measures can be put in place to ensure a coordinated response is planned out by the relevant teams, activated in a timely manner to allow minimal downtown.

    This situation is more popular than you might initially think. Employees who are determined enough to make these criminal decisions are finding other ways to get away with it. We must keep up with the small percentage that may consider it. What would you do right now if:

    • You need advice? Who would you turn to?
    • Who would you notify?
    • What actions would you take initially?
    • What actions would you take strategically to ensure this matter was resolved?
    • What actions would you take strategically to ensure this did not happen again?

    With Veritas Investigations, we’ll explore this in more detail on April the 10that our Internal Investigations workshop. Here, our scenario exercise will be the main feature of this event allowing you to be right in the midst of a crisis.

    Identical to what we offer our clients on a larger scale across New Zealand & Australia, you will be part of a professionally run training session on how to handle these situations, correctly and effectively.

    Contact Us today to learn more

  • What We Can Learn From Y2K

    What We Can Learn From Y2K

    Where were you on the evening of December 31st, 1999?

    I was with my family, in a large, cubicle-soaked office block in the dark, wet corners of Reading, United Kingdom. I was nine-years-old and didn’t question any of it solely for the fact I was contempt with the huge office chair I’d perched myself on, the computer games I could play, and the amount of space available for me to burn all the remaining energy I had for that century.

    My father, however, was locked in the data centre of British Telecom (also known as BT). No windows, empty chairs to his left and right, large square monitors draping the walls and an intimidating phone in the middle of the desk. His orders; wait and see.

    My mother waited near the coffee and wine hoping two things: that the world didn’t end, and that the world didn’t end so we could go skiing with the invoice my father was just about to submit for this once-in-a-lifetime 2-hours piece of work.

    I regularly think about that evening. As a young child, I had no idea of the extreme concepts being fed through the media all because of the clocks. Nowadays, the idea that computers would simply stop because of time is like me showing a floppy-disk to a 13-year-old; “that’s the save symbol” they said to me. But, curiously to me, my father was part of that, he was the resource to try fix it if the world was going to end. Him and a few hundred other IT pro’s spread across the globe.

    Last week, I sat down with him to ask him about that night.

    “What even is Y2K?”

    “Ironically, I ended up on a desk, running my own business as a consultant and it was a completely different life to what I was used to while in the Army. A culture-shock actually”.

    Although the internet had been around for five years, many people were still not using it. Only larger enterprises were adopting it for internal communications and sharing capabilities. The idea of cyberthreat was unknown at the time.

    “The threats are always changing. The more stuff we introduce to this world, the more threats we introduce. The word Cyber wasn’t even in the dictionary back then, as far as I was aware”, but Y2K was.

    Y2K, also known as the Year 2000 Problem, Y2K problem, the Millennium bug and the Y2K bug, was a class of computer bugs related to the formatting and storage of calendar data for dates beginning in the year 2000. Alien to the world we know now, the issue was not caused by a hacker or cyberattack, but simply an oversight on production of technology.

    “The basic idea on Y2K was that for convenience, most computers only used two numbers for the date. Why use four numbers when you only need two for the date [the last two digits of the year]. Then they realised, what date is the computer going to think it is when we get to 2000?” said James B. Meigs of Popular Mechanics.

    The problem that the majority of computer systems made in the 90’s were unable to adjust to a new millennium, caused major concerns across the globe. What would the effects be? Would planes fall out of the sky? Would digital banking crash?

    “That was my biggest payday ever as a consultant. I had a couple of systems that had been built back in the 80’s, the date format was not capable of switching over to 2000. It was as simple as someone had not projected that possibility. So, when the clock changed over, it went back to zero and everything would simply stop working”. The system clock would either go back in time to 1900, or continue by adding a 1, making it 11999 – which, as you know, isn’t the correct date to add to invoices and receipts.

    “People were saying planes would drop out the sky and all the rest of it, there were huge concerns. So, I had the job at half-passed-eleven, on the 31st of December to sit in the comms room and wait for the clocks to tick over. I basically stared at the screen…and waited to see what happened. It was probably me and few other thousand IT specialists doing the same thing that night, waiting, seeing what would happen, and uh…nothing happened!”

    Fortunately, the unknown turned out to be nothing more than an over-exaggerated possibility of events. Media attention around something alien to our world for the turn of our new millennium. What was definite though, was the concern of our times. Thousands of organisations were only able to employ people to “see what happens”. No plans or steps were put in place for the worst-case scenario. The seriousness of Business Continuity had taken a major U-Turn to organisations around the world.

     Lesson learnt

    “I had two feelings: one I was really, really disappointed because I wanted all the lights to go out at least, but two, also really happy because I’d made a lot of money for not really doing anything”.

    When events like this occur, no matter their credibility or media hype, lessons can always be learnt. We can still go back eighteen years to that night and revisit the revolutionary changes organisation knew they had to make.

    “Future proof is the keyword. Really, people who are technically savvy enough to understand the coding still need to be prepared. That planning & preparation. Looking back, I can’t remember what I was actually going to do if the lights did go out”.

    “It’s really about us accepting that if the lights are going to go out, what are we going to do about it? And that’s what Business Continuity is all about, that’s what we try to preach; yeah, probably nothing will happen now, but if it does – what are we going to do? Having a plan and knowing it, saying this stuff happens and making sure you don’t ignore it means you’ll be ready to deal with it”.

    “At the stroke of midnight of 2000, elevators may stop. Credit cards and ATMs may cease to function. Aeroplanes and trains may come to a halt” Leonard Nimoy dramatically stated during a National Geographic documentary.

    With tensions growing across the United States, people were literally arming themselves for the worst. President Clinton appoints a crisis management expert to prevent a national meltdown.

    John Koskinen, chair to the President’s Council on Y2K ’98 – ’00 said “10% of the population was fairly confident there was going to be an apocalypse. The president called me one night and said ‘here’s an office, an assistant, don’t let the world stop…’”

    Of course, now, those outcomes seem almost comical. How could the change of two digits cause such havoc and devastation? Regardless of the nature of this scenario, there was still a threat to people and organisations, it was just that no one knew exactly what that was.

    “On the night of 21st December 1999, I was pretty much stood there with a fire extinguisher waiting for the fire to start. Beyond putting the fire out, we didn’t really have a plan! No one really knew what would happen, but we didn’t really plan for the worst-case scenario. Remember, always plan for the worst and hope for the best!”

    The lack of action from most organisation caused years of re-planning and rescoping business continuity for many organisations. If this were to happen again, what would we do to ensure we had the most effective processes in place to fix it?

    “The cost to fix the Y2K across the world has been estimated to be around 300 billion [1]. That was the technical aspect of it” says Quora user Shashank Chidambara. “A few known incidents because of the bug affected a hospital in Sheffield, UK [where their] automated mailing system sent wrong medical reports to mothers about the fetus status. Telecommunication companies worldwide had erroneous billing results on Jan 1st”.

    In all, the enormous hype around the event turned out to be nothing more than just that, however, with so many organisations hoping for the best-case scenario, it was a huge risk.

    We can learn from this event from eighteen years ago even today. Don’t allow possibilities to control the situation, be in control and plan a strategy you know will work. At the very least, make sure you’ve got someone like my father on board, sitting in that dark comms room with his family outside, who are waiting to go skiing.

    Contact Us today to learn more

  • What is Business Continuity?

    What is Business Continuity?

    It may seem obvious, but the line between Business Continuity and the definition itself is very blurry.

    The mistake businesses often make is the definition of the name. It’s not about business continuity, it’s about critical business continuity. Continuing the critical part of your business should be the core objective of business continuity (BC). BC implies it’s all of business, which is where the mistake is made. You don’t need to recover the whole business, just the critical parts of your organisation, the process and functions that if not recovered will have the largest impact on your organisation. Whether that be financial, reputational, human, legal or operational.

    What the ‘Good Practice Guide’ says:

    A holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.

     

    Step 1: Analyse

    Assessing vulnerabilities and understanding the impacts of a disruption to your organisation.

     

    Stakeholder engagement
    The most important part of this step in your business continuity journey is to ensure that all key stakeholders have buy-in for the process. This means that the implementation of the BC journey for your organisation is backed by the people from the top.

    Policy and Framework
    Intentions and directions of an organisation that sets out the scope and governance of the BC program and reflects the reason why it’s being implemented.

    Business Impact Analysis
    The main technique used for the analysis of an organisations business functions.

    Threat Assessment
    The process of evaluating threats using risk assessment techniques to identify an acceptable concentration of risks and single points of failure.

     

    Step 2: Plan

    “Documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following a disruption.

     

    Crisis Management
    Strategic plans define how strategic issues resulting from a major incident should be addressed and managed by Top Management.

    Recovery Strategies
    Recovery strategies will provide a step-by-step guide for recovering your Critical Business Functions ensuring that functions recover fast to meet the Maximum Allowable Outage (MAO) expectations.

    Business Resumption
    A business resumption strategy contains a series of actions and steps designed to return the affected business to its pre-interruption status and includes restoration or relocation of facilities and resumption of operations to maximum capacity.

    IT Disaster Recovery
    A task orientated document designed to provide the IT disaster recovery team with the tools to identify, assess and respond to companywide incidents affecting IT infrastructure, software or hardware systems.

     

    Step 3: Validate

    Build capability, rehearse and test your program to demonstrate your level of preparedness.

     

    Awareness Training
    It is essential that all individuals undertaking BC related tasks at any level have the appropriate level of competence for the role through:

    • Training
    • Knowledge
    • Experience

    Crisis Leadership Training
    Suitable for senior leadership with overall crisis management responsibilities. Training specifically designed to build awareness, critical skills and crisis leadership capabilities of your team using the latest experiential learning techniques and real-world case studies.

    Component Testing
    A testing regime to provide appropriate coverage of all agreed business continuity recovery activities. This includes defining performance indicators and establishing test scripts to validate the recovery of critical business functions as identified in the Business Impact Analysis.

    Scenario Exercises
    Rehearsing an organisations BC program via realistic, hands-on scenario exercises is critical to:

    1. Build familiarisation with staff roles, responsibilities, processes and available tools
    2. Identify practical program improvements
    3. Provide a high level of stakeholder assurance in an organisations recovery capability

     

    Step 4: Maintain

    Review and rehearse your program to build resilience and ensure continual improvement through:

    • Reviews & updates of your entire program
    • Annual training for your response teams
    • Annual exercising for your response teams and staff

    In summary, Business Continuity needs to be a business as usual activity preparing for extreme events. Your organisation should plan for the worst but hope for the best. But the task doesn’t need to be time or resource heavy.  An effective response is about task orientated activities and the ability to thrive through adversity.

    As with any event, it’s not a matter of if, but when. Understanding the lifecycle of BC, implementing it into your business and building a culture around it will be what ultimately sets you apart from your competitors when a major disruption or event is realised.

     

    If you’d like to know more about how RiskLogic can help implement or review your current BC program at your organisation, contact us today to learn more.

  • Cyber Response Plans

    Cyber Response Plans

    Understanding Cyberattacks

    According to the World Economic Report, the global risk landscape puts extreme weather events as most likely to occur, finally knocking cyber-attacks of the top spot.

    However, you would be forgiven for thinking that cyber is still at the top, it seems to be in the news daily; weather events aren’t common to all countries.

    Cyber is still a new concept to most of professionals and organisations as in general, many haven’t been personally affected. It is likely that you’ve got a connection with someone who has though, and it’s that that seems to capture people’s attention.

    Regardless if it’s in 4th or 10th place on the report, you should never become complacent that it will never happen to you. No matter how great your IT security measures or your IT team are, it all becomes out of date very quickly in this fast-paced world we live in. Humans have been able to create technology that can put up defences against natural harm a million times quicker than natural evolution can provide us.

    The idea of a Cyber-attack is a global phenomenon and younger than most people’s children. There’s always a hacker somewhere in the world looking to be the next great thing, looking to beat your defences. This is what makes them so dangerous to all organisations, including the Defence Forces.

    Cyber hackers are usually part of an anonymous network where users are provided rewards (whether financial or of a title) to hack certain, challenging environments. There is nothing more powerful behind an attack than someone trying to prove a point.

    Resource on this: Cyber: Not just an IT Issue.

    Planning for the unexpected and accepting that it might just happen to you is critical. You must know what your next challenge could be.

     

    A Structured Cyber response

    A cyber attack can cause disruption to business operations just like any other IT related outage. Loss of power, cut fibre, water leak in the room above your data centre (it still happens) the list goes on. The difference with cyber is it all too often becomes public and the impacts to business reputation increase exponentially. This is often outside the responsibility of the IT team and a strategic response is necessary. Your response team needs to act fast through the following 4 phases:

    • Identify: Is this really a hack, or a system or human error?
    • Contain: stop further damage, isolate the threat.
    • Eradicate: Clean up the problem, backup restores.
    • Recovery: get back to business as usual, repair the reputational damage.

    If you haven’t already got one, we would recommend developing a Cyber Security Incident Management Procedure, which should be used by your Cyber Incident Response Team (CIRT) to response to a cyber event. As a minimum we would recommend that your CIRT is made up of the following roles:

    • CIRT Manager
    • IT Security Technical Lead
    • Communications
    • IT Response & Recovery Coordinator (Infrastructure)
    • IT Response & Recovery Coordinator (Applications & Related data)
    • External:
      • Forensic Analyst
      • Forensic Investigator

    A clear escalation policy should be established in your procedure to provide early warning to your Strategic level response to prepare for likely reputational, financial and legal impacts for a severer cyber-attack.

    The evidence is there, organisations must prepare for a cyber attack and accept that it is now  “not just an IT issue.

    Till next time, Plan, Do, Check and Act….

    Contact Us today to learn more