Oracle CEOs: Prioritize Communication in Cybersecurity Incident Planning
Oracle co-CEOs Clay Magouyrk and Mike Sicilia emphasize the importance of comprehensive cybersecurity incident preparation. They suggest moving beyond technical solutions and addressing communication strategies to protect reputation.
Magouyrk and Sicilia advise listing potential cybersecurity incidents and determining communication needs in advance. This includes identifying who needs to know, who might find out, and how to communicate with each group during an incident. They caution against neglecting media and public interest, as seen in recent high-profile incidents involving Medibank, Optus, The Good Guys, Bunnings, and Kmart.
Effective communication during a cybersecurity incident can safeguard a company's reputation long after technical issues are resolved. Oracle's leaders recommend using consistent, factual, and accessible language, avoiding emotive terms and speculation. For data breaches, communication plans should be prepared for customers, suppliers, business partners, and the media.
To ensure communication with key stakeholders is not compromised, maintaining an offsite, 'air gapped' system is crucial, especially when system access is limited. Additionally, expert assistance from a PR team or agency can help mitigate risks and close communication vulnerabilities before an incident occurs.
Magouyrk and Sicilia stress that every business should maintain a risk register, prioritizing high likelihood and high impact risks with mitigation strategies and communication plans. They conclude that businesses must broaden their incident response plans to include robust communication strategies, moving beyond sole focus on technical issues.
