In the past several months, AI tools that can help hackers penetrate even high-level cybersecurity defenses have become widely available. Faced with this unnerving new reality, organizations need to ensure they are truly capable of running the business without their IT systems for a period of time and recovering under pressure.
Related: Using AI in Your BC Program: Opportunities, Risks, and Oversight
Summary
It was only a short time ago that the biggest concerns about AI from a business continuity perspective were the potential escape of confidential company data and the need to mitigate a growing dependence on AI tools for performing critical business processes.
With the recent reports of rogue AIs breaking into well-protected computing environments, those are beginning to look like the good old days.
At the same time, we’ve begun seeing a proliferation in inexpensive, widely available AI tools that are making it possible for less-skilled attackers to penetrate networks that would previously have been considered highly secure.
And it’s not just happening far away and to strangers, at least as far as MHA is concerned. Organizations we’re familiar with that have always done a great job with IT security—using comprehensive real-time monitoring, long passwords, and two-factor authentication—have experienced AI intrusions.
It’s early days yet in terms of the new world of AI-augmented threats to companies’ computing environments. However, there are some preliminary lessons that can be drawn from our experience so far. The main one has to do with the nature of network security itself.
For a long time now, we’ve known how to keep our computer networks mostly safe. Most successful attacks came as a result of hackers exploiting either outmoded technology or mistakes made by people inside the company.
Not everybody kept their systems and training at the highest level, but we were confident we knew what network security required.
This meant that companies that did keep their technology, processes, and training at a high level could feel somewhat good about the security of their computing environment. They might even have felt justified, based on the low likelihood of their experiencing a serious outage or intrusion, in relaxing a bit around disaster recovery planning and exercises.
Those days are over, at least for the time being.
We’re now seeing organizations that are doing everything right in terms of network security getting hacked, thanks to AI.
It’s very sobering.
And from the BC perspective, it leads to one overriding conclusion. In the new reality, no one can assume their environment is safe, so everyone needs to be good at IT disaster recovery (IT/DR), crisis management (CM), and crisis communications.
This is an ongoing challenge, one whose ramifications we’re still sorting out. But based on our experience so far, we have begun identifying a few key areas organizations should look at as they adapt to the new reality.
It’s not enough to have a disaster recovery plan that says which systems will be restored and in what order. Organizations need to know how they will actually get the business functioning again if one or more critical systems are unavailable for an extended period. That means understanding system dependencies, identifying recovery priorities, establishing workable recovery strategies, and verifying those strategies through exercises that truly validate recovery.
When systems go down, business units should know which critical processes can be performed manually, with spreadsheets, on paper, or through other workarounds—and for how long. Those workarounds need to be realistic enough to use under pressure, not merely items listed in a plan. Remember that customers will not understand the excuse that there are no workarounds for your technology.
A crisis plan that depends on one exceptionally capable person is not a resilient plan. Make sure there are backups for key crisis-management, IT, communications, and decision-making roles, and make sure those backups have actually practiced performing them.
Organizations should become adept at using the APIE incident response framework: Assess the situation, Plan your response, Implement the plan, and Evaluate the results—and repeat as necessary. APIE is widely used by disaster response agencies. It’s a proven process for helping teams identify and take high-value, constructive actions during chaotic situations while keeping stress and emotions to manageable levels.
Organizations often resist live exercises because they are disruptive, uncomfortable, and can expose failures. In the new threat environment, they are more important than ever. Exercises should give people the experience of making decisions with incomplete information, dealing with conflicting advice, communicating under pressure, and working through rapidly changing circumstances. Where practical, require actual phone calls, emails, escalations, and interaction with the people and vendors who would really be involved in an incident.
An organization’s recovery may depend as much on a technology provider as on its own IT department. Find out in advance who will respond during a major incident, how escalation works, who has decision-making authority, and what level of support you can realistically expect. If your provider uses a follow-the-sun support model, understand how that will work when you’re in the middle of a crisis and repeatedly explaining the situation to people in different locations and shifts. Be prepared for the possibility that differences in accents or speech patterns can complicate communication between people from different parts of the world.
In a serious incident, the organization may have to make important decisions before it has a complete picture of what happened or absolute certainty that they know the complete story. Waiting for 100 percent confidence may sound prudent, but the cost of waiting can also be substantial. Organizations should establish in advance what level of uncertainty they are willing to accept and what risks they are willing to take to keep the business moving. Waiting is itself a risk.
Major incidents can quickly produce confusion about who is actually in charge. Senior management may expect systems to be restored quickly without understanding what that requires, while IT may be reluctant to act without clear direction. Establish decision-making authority and escalation paths before an incident occurs, including who has the authority to make a recovery go/no-go decision when the situation is changing rapidly.
Where possible, maintain recent snapshots of important data, contact information, procedures, system information, and other reference material in secure, accessible forms outside the primary environment. Having access to 98 percent of the data you need versus 0 percent can make all the difference when you’re trying to get through an outage.
Your stakeholders will still expect to receive information from you even when you are struggling with a major outage. Or rather: especially then. Employees, customers, partners, regulators, and others need to know what is happening and what they should do. Organizations should have backup communications channels, designated communicators, pre-approved scripts, and a process for providing timely, regular updates when the usual systems aren’t functioning.
Getting your systems back online is not necessarily the end of the incident. Organizations will have to deal with lost revenue, disrupted customers, frustrated employees, missing or corrupted information, regulatory questions, and damaged relationships for weeks or months afterward. Recovery teams should plan into the future to address those consequences and help the organization emerge from the incident in a stronger position.
Our understanding regarding how to deal with AI-facilitated intrusions from a BC perspective is a work in progress. But for organizations that want to make sure their IT recovery capabilities are up to the challenges of the new reality, the practices described above are a good place to start.
The cybersecurity landscape is changing rapidly, and the emergence of widely available, potentially hostile AI tools has invalidated the assumption that strong preventive defenses will keep an attacker out. In the new reality, organizations need to be prepared for the strong possibility that prevention will fail.
Organizations that want to be safe in the new environment must ensure they can functionally recover their IT systems. This requires a new emphasis on practical recovery capabilities, including live exercises that stress-test people as well as plans, understanding how critical IT vendors will respond during a crisis, preparing to make decisions with incomplete information, establishing clear recovery priorities and decision-making authority, and ensuring that critical business functions can continue even when technology is unavailable.
MHA Consulting can help organizations assess their true recovery capabilities, identify weaknesses, and develop and exercise practical strategies for responding when critical technology and business operations are unavailable. If your organization is rethinking its readiness in light of the new AI threat, contact MHA to discuss how we can help.
Because even organizations that have done everything right in terms of network security may still be vulnerable to increasingly capable AI-assisted attacks. Prevention remains essential, but organizations also need to be prepared for the possibility that prevention will fail.
It means more than having a disaster recovery plan. Organizations need practical recovery strategies, a clear understanding of system dependencies and priorities, and realistic ways to keep critical business functions operating when technology is unavailable.
Stress-test them. Exercises should require people to make decisions with incomplete information, communicate under pressure, work with vendors, and handle changing circumstances. Organizations also need backups for critical crisis-management and decision-making roles so that one person’s absence doesn’t become a major vulnerability.
They need to be prepared to make risk-based decisions without having all the answers. Waiting for complete certainty before beginning recovery may sound prudent, but waiting also carries risk. Organizations should establish decision-making authority and acceptable levels of risk before an incident occurs.
They should understand how critical technology vendors will support them, preserve essential information outside their primary systems, maintain backup communications channels, and plan for the business and relationship consequences that may continue long after the technology is restored.