To the ones who say "we do not know" in the crisis exercise
Quiet work, part 3: twenty minutes into the crisis exercise, the head of the crisis team asks whether the backups are affected. Someone at the table says no, because it has always been that way. And then someone else says: "We do not know." Why that sentence makes the exercise a success and where BSI Standard 200-4 calls for it.
Read more
To the ones who still report the phishing suspicion at 5:55 pm
Quiet work, part 2: Friday, shortly before closing time, a click on a link that feels wrong. Two options: close the laptop and hope, or call and say you may have clicked something. Why the second is often the earliest detection an organisation gets, where IT-Grundschutz requires it, and why it is so rarely thanked.
Read more
To the ones who test the restore
Quiet work, part 1: a backup that reports green every night says nothing about whether anything can be brought back from it. Only someone who tries knows, on a Tuesday afternoon, without cause and without an audience. Why IT-Grundschutz requires exactly that as a basic requirement, and why hardly anyone notices it anyway.
Read more