Business Continuity

What was the outcome?
Akela staff were able to deliver a combination of outcomes to the client, capturing compliance, technical security, and governance improvements.

• Research and development to better detect, deter and respond to emerging cyber security issues: The exercises drove refinement of expectations of the vendors contracted to provide intrusion detection, intrusion hunt and open-source threat research services to the client, in addition to providing technical uplift guidance for advanced forensics. This greatly enhanced the client’s ability to receive and expand on information pertinent to the detection, deterrence, and response aspects of cyber incident response.
• Recommended improvements to fix vulnerabilities in products, infrastructures, and processes: The exercises delivered several reports detailing required uplifts to the technical security, functional practice and strategic engagement practices employed by the client, to maximise operational efficiencies. The reports further provided a redesign of the client’s operational response structure, to correct procedural vulnerabilities regarding flexible scaling of resources, clarification of roles and authorities, and alignment of cross-agency mandates in the event of a cyber crisis.
• Experience with Data Loss Prevention and Data Protection, security incident and emergency response: The exercises drove targeted redesign of cross-vendor and cross-organisational information sharing practices, and data access reporting mechanisms, to enhance the exchange of critical personal and system information in the case of a crisis.
• Provision and monitoring of access to data, IT systems, facilities, and infrastructure: The exercises drove significant redesign of the client’s access and identity management processes and practices, to enhance audit reporting in the event of a data integrity crisis - including reconsideration of vendor access management permissions and practices. Additional guidance was provided regarding the sharing of indicators of compromise between entities.
• Communicate with a wide range of disciplines, both internally and externally: During simulation development and incident debriefing, core personnel engaged with representatives at the junior, middle, and senior management levels within the client and their vendors. Incident debriefing involved engagement across administrative, technical, specialist practitioner and legal domains, to capture insights and lessons pertinent to exercise performance.
• Present findings, insights, and recommendations to justify decisions: The engagement report presented findings in a readily digestible format, detailing observations, key impacts, and recommendations supported by tangible evidence. The report was designed for consumption by a mid-to-senior management audience, without the assumption of technical expertise or security operations experience.
• Establish relationships to support the delivery of services: The engagement practices employed by core personnel ensured timely and open sharing of exercise assumptions, limitations, aspirations, and constraints. Regular briefings, updates and workshops ensured “no surprises” for participants and decision makers; structured design to focus on enterprise – and not individual or vendor – performance, ensured a “no-fault” environment welcomed by participants.
• Work in a multi-disciplinary team in an agile delivery environment: Akela’s core personnel aligned the inputs of administrative/clerical, legal, technical and specialist practitioners to develop a seamless and realistic exercise scenario. Personnel applied an Agile methodology during development, representing change management, cyber security, and business process improvement disciplines.

The Australian Aviation Cyber Council
On behalf of the Australian Aviation Cyber Council (AACC), Akela conducted a cyber desktop crisis management exercise on 6 December 2022. The exercise was part of the aviation sector’s overarching strategy to successfully manage significant cyber security incidents across key aviation services and systems. The exercise was designed to allow the sector to refine the way in which it works collaboratively to solve real world cyber issues impacting national services to the aviation sector.

Scope
The scope of the exercise was a walkthrough tabletop exercise that focussed on assessing the ways of working regarding information sharing, collaboration, risks and impact assessments, and response to executives, media, and Government.

Objectives
Through consultation with AACC members, the exercise was designed to achieve AACC’s strategic objectives by discussing, and to a minor degree stress testing, Sector-wide business processes, response capabilities, leadership, decision making (from junior levels to Senior Executives and Board members) and staff endurance under adverse and highly pressurised conditions.

In line with the AACC’s operational requirements and strategic intent, the objective of the exercise was to:

• Practise the Sector in responding as one to a series of major incidents and discussing their responsibilities within individual organisational, sector, and national-level crisis management processes.
• Enable the aviation sector to explore various response options in line with the exercise scenario.
• Identify potential improvement opportunities to the aviation sector’s cyber security crisis management processes, procedures, plans, and policies from a Sector and National perspective.
• Seek to understand roles, responsibilities, and ways of working for all parties in the management of a Sector and National level critical incident.
• Identify capability gaps (e.g.: leadership, authorities, and other non-technical and technical capabilities and abilities) within the Sector and National level crisis management response framework.
• Conduct the exercise as a round table paper-based desktop exercise.
• Plan and conduct the exercise with the endorsement from the senior cyber management of each participating organisation prior to exercise commencement.
• The severity of the incidents should have a classification of ‘critical’ or above and be based on current real-world scenarios.
• Provide a report outlining the findings of the exercise, with information shared only with participating organisations.

Akela designed the desktop exercise to incorporate different functional areas of crisis management, decision-making, and response processes across various aviation sectors such as Major Airlines, the Australian Cyber Security Centre (ACSC), Australia’s major airports, and AirServices Australia (ASA).

The exercise was designed to incorporate a range of business units across all participating organisations. The business units included: