In the immediate wake of a ransomware attack, you can bet that the C-suite is going to panic and demand an immediate fix. Carol Barkes, a conflict resolution consultant, talked about the physiological considerations a CISO should think about when dealing with a panicked C-suite
Carol Barkes is the best-selling author of NeuroMediation. She is also a conflict resolution consultant. At the RSA Conference 2022 in San Francisco, she shared the stage with Edward Vasko, director of the Institute for Pervasive Cybersecurity at Boise State University.
Vasko talked through the various stages of C-suite reaction to a ransomware attack, and Barkes shared tips for CISOs on how to handle each of those stages.
Panic
“When your SOC calls you on a Friday afternoon to alert you of a ransomware attack, soon followed by a call from your executive team, it’s the worst moment of a CISO’s life. It’s that Jaws moment,” mulled Vasko, who called this first stage “panic.”
“The first thing you need to do is consider the level of physiological stress the different members of the executive team are dealing with and understand that our bodies react to stress in different ways. Stress shuts off the thinking part of the brain,” explained Barkes. “It helps to soften your voice, make eye contact and make sure they know ‘I’ve got you, we’ve got this.’”
Overreaction
Overreaction often follows panic, said Vasko. “The C-suite will inevitably overreact, want an instant fix, an immediate call to action, and will often want anyone involved out the door. At this point, the C-suite is at its most stressed, reacting just to react and willing to do anything for a fast fix.”
No tags.
