CI : Cyber crises & training

Doctrine, méthode et outillage autour de la gestion de crises d'origine cyber.

Catégorie : Communauté d'intérêt

Description

Today, the dependence of organizations on digital tools means that each of them must equip themselves with crisis management systems adapted to the specificities of cyber attacks, in order to reinforce their robustness (cyber business continuity and recovery plan, systems reconstruction, crisis governance, third-party management, communication, cyber defense and insurance). In particular, organizations must be prepared to maintain degraded operating modes, and be able to prioritize the restoration of critical activities, in a controlled way, within a given timeframe. The growing interdependence of organizations with their partners (third parties, suppliers, insurers, players in the same business sector) makes this work even more complex, requiring players to think in terms of a global approach to cyber risk and crisis management.

The importance of implementing crisis management and business continuity processes is further illustrated by the existence of numerous related standards (ISO 27001, 27031, 22301, and 31000) and the establishment of the European Network and Information System Security Directive (NIS, 2016). The implementation of generic measures, now widely used in the organizations covered by these texts, is no longer sufficient to deal with the intensity, complexity and duration of a cyber crisis. To this end, ANSSI has published a "Crisis" collection of three guides sharing recommendations on the organization of crisis exercises (in collaboration with CCA), crisis communication (in collaboration with CapCom') and cyber crisis management (in collaboration with CDSE). These guides must now be accompanied by more operational elements to help organizations grow in maturity.

To this end, the "Cyber Crisis and Training" Community of Interest (COI) intends to develop three areas of work: doctrine and methods for cyber resilience and crisis management, cyber training, and finally maturity assessment and tooling, the deliverables of which should complement existing initiatives. The kick-off meeting of the community of interest launched by ANSSI in conjunction with the Cyber Campus identified the priority issues to be addressed by the CI for each of these three areas of work, as well as the associated deliverables. The ambition is to create a dynamic aimed at producing doctrines, methods and tools for cyber crisis management, with a view to increasing the cyber resilience of organizations. The work of the IC will thus complement the work carried out by professional associations or institutions, which is why certain subjects will not be addressed by the IC, while others will not be retained for inclusion in the 2022/2023 roadmap, but may be in the longer term. One of the CI's challenges will also be to highlight the complementary nature of the actions carried out by the various professional associations (AMRAE, CCA, CDSE, CESIN, CLUSIF) and the actions carried out by the Cyber Campus WGs.

Logbook of the Cyber Crisis and Training WG

Find below the minutes of the meetings

On July 04, 2023, the WG met in plenary session.

Initial work was presented. A call for new contributors has been issued. Starting in September, it will be possible to join the working group and participate in the production of current and future deliverables. A meeting will be set up shortly to take stock of the work.

To keep abreast of WG news, members are reminded that they can subscribe to the dedicated mailing list (e-mail request: angele@campuscyber.fr).

On 18/04/23, the Crisis Management WG met for its monthly COPIL. It reviewed the progress of work: Proofreading and layout of deliverables:

Several dedicated spaces on Teams have been opened: "Livrables en relecture", "Livrables pour maquettage", "Maquettage réalisée".
A proofreading process will be drawn up.

Publication of deliverables:

Publication of deliverables is planned for this summer.
Ready deliverables will be published individually, and all deliverables will eventually be published together.

It took the following decisions:

Put a "word from the WG" at the top of each deliverable.
Produce a single glossary to which everyone must contribute definitions

ANSSI to propose a common maturity grid to be validated by COPIL members.

Update the general timetable with the launch of the new wave of work at the beginning of September.

Please note that the next COPIL will be held on Tuesday May 16 from 5:30 to 7pm in hybrid format. The plenary session with the community of interest will take place on Tuesday afternoon, July 4.

On 31/01/23, the Crisis Management WG met for its monthly COPIL. It reviewed the progress of work:

Part 1: "Digital resilience concepts and methodology"

Creation of an interview form to standardize the summary of interviews and appointments with the list of interviewees (around thirty).
Launch of action on resilience documentation  Reading sheet being written to standardize analysis and inventory of available documentation.

Part 1: "Reflex cards" (roles in crisis unit, supply chain, cloud)

The first elements of the content of the 3 reflex cards have been drafted.
A v1 of the sheets will be worked on at the/02/15 plenary session + launch of the 3 other sheets

Section 1: "PCA/PRA cyber construction kit".

Structuring of content, drafting in progress.

Section 2: "Methodology for building a training strategy".

Drafting in progress. Development of a maturity grid for exercises.

Part 2: "FM dedicated to the different types of exercises" and "FM dedicated to the main reference scenarios".

With regard to the exercise strategy to be implemented, to be in line with the PACS reference framework.
Adapt scenario to maturity level

 Section 3: "Assessment and digital services

Recensement des différents outils de gestion de crise

Il a pris les décisions de :

Créer une adresse mail générique pour s’adresser à l’ensemble des contributeurs du GT
Programmer un point Campus/ANSSI pour élaborer la stratégie de valorisation des livrables
Programmer une plénière mi mars avec l’ensemble des contributeurs et une autre mi mai avec la communauté d’intérêt pour présenter les livrables en cours.

Il est à noter que le prochain COPIL se tiendra le mercredi 1er mars de 17h30 à 19h en présentiel au Campus Cyber.

Groupes de travail

	Status	Description
Crise cyber et entrainement : doctrine	En cours	Doctrine et méthode de résilience cyber et gestion de crise d’origine cyber.
Crise cyber et entrainement : méthodologie d'entrainement	En cours	Développer une méthodologie d’entrainement générique
Crise cyber et entrainement : outillage	En cours	Développer des outils dédiés à l’évaluation de maturité et à la gestion de crise d’origine cyber.