Building an incident response team is something you do before the incident, not during it. Prasanna, Dr. Mike Saylor, and I walk through who needs to be on that team, why each person matters, and how to get them lined up now so nobody’s scrambling when ransomware hits.
We’re back after a few weeks off, and we came back with a topic I care a lot about. When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same treatment. Mike puts it plainly: you don’t want to be recruiting people when the house is on fire.
We cover the core roles. There’s the incident commander, who keeps the business off the backs of the people putting out the fire. There are the subject matter experts on the tech side. And there’s the executive sponsor, who makes the calls you’re not allowed to make. We talk about why legal, compliance, PR, and finance need a seat at the table. We also explain why “there is no evidence customer data was accessed” is a very different sentence from “customer data was not accessed.” (Looking at you, LastPass.)
Then we get into the outside help: your cyber insurance carrier, a third-party incident response firm with a retainer already signed, law enforcement, and your vendors. Mike explains what the FBI will and won’t do for you. He covers why you can’t just pay a ransom to anyone on the OFAC list, and why calling Bob on a Sunday is not a plan.
If your current incident response plan is “we’ll figure it out,” this episode is for you. Listen in, then go write down some names.
Chapters:
00:00 Cold open
01:30 We’re back (and Gemini let me down)
03:27 Why you need a team, not YouTube University
04:29 Know your team before the house is on fire
07:43 Fire crews, training, and the USS Constellation
09:27 Incident response is a business problem
12:02 Core roles: leaders and subject matter experts
14:14 Executive sponsors and who comes back first
16:09 Asset lists, owners, and pre-authorization
17:11 Incident commander vs. incident leads
20:00 Legal, compliance, and attorney-client privilege
22:59 PR and the LastPass problem
24:47 Finance and cyber insurance
27:07 Third-party incident response teams and retainers
32:06 Bringing in law enforcement
33:48 Sanctions, Bitcoin, and paying the ransom
38:05 Vendors who answer the phone on a weekend
39:34 Write it down and name your deputies
40:20 Tabletop exercises
43:06 Wrap-up
