Focus on the profession: Crisis management consultant, knowing how to deal with the worst – ZDNet

Crisis management consultant, knowing how to deal with the worst

When a cyber crisis hits a company, there is no shame in seeking support. Cyber crisis management consultants such as Anaïs Fauré from Alcyconie are there to help.

In the world of cybersecurity, some jobs require as much human skills as technical skills. This is often the case for positions related to governance issues, but also for roles specialising in crisis management. This disaster scenario, which many organisations fear, is somewhat of a daily occurrence for crisis management consultants.

It remains to be defined. “A cyber crisis is when a security incident exceeds the usual incident handling system put in place by the company. And generally, the impacts go far beyond the technical aspects alone, disrupting the entire operation of the company,” summarises Anaïs Fauré of Alcyconie.

Of course, ransomware attacks come to mind, paralysing the company’s tools and leaving employees in the dark. But certain types of massive data leaks or the compromise of strategic assets can also fall into this category.

A helping hand with organisation

Faced with this type of scenario, companies often need outside help. This means turning to a company that specialises in incident response or digital forensics. But this help also comes from crisis management consultants, such as Anaïs Fauré. “Our job is to support executives in organising themselves in the very specific context of a cyber crisis. We play a bit of a conductor’s role. We advise, coordinate resources and orchestrate the whole process. But we don’t manage things for them. The final decision always rests with the company.”

Consultants are involved in communication and organisational processes, but also in more down-to-earth considerations. “This requires a certain understanding of the business, but also of how to prepare for a crisis. Not to mention providing psychological support to teams. We are there to help them make decisions and understand what is happening,” summarises Anaïs Fauré.

The consultant’s involvement varies depending on the client’s needs. It may involve providing occasional advice to support certain situations. However, external consultants are sometimes directly involved alongside teams and within the crisis unit. To limit risks and avoid placing all the responsibility on the shoulders of a single consultant, Alcyconie teams generally work in pairs or larger groups.

If you want peace, prepare for crisis

But consultants’ daily work does not consist solely of rushing from crisis to crisis to deliver the good word and best practices. The best way to deal with an incident of this type is to anticipate it, and consultants spend a lot of time working with client companies to help them refine their crisis management systems and even test them through exercises.

“The aim is to propose personalised and, above all, realistic scenarios that take into account the specific characteristics and security measures put in place by the company in question. We therefore spend a certain amount of time learning about how the organisation operates in order to gain a better understanding of how information is reported,” explains Anaïs Fauré. Anticipating these scenarios has been the subject of several publications by ANSSI, which has posted a guide online for those who wish to try their hand at it.

In these exercises, crisis management consultants act as facilitators, developing the scenario by ‘playing out’ the reactions of the various departments, as well as those of external parties who interact with the crisis unit. In this field, the added value of a consultant is that they draw on their experience of supporting crises ‘in the heat of the moment’ to propose realistic scenarios based on real situations. The exercises, which are a kind of life-size corporate role-playing game, are then debriefed to identify what is not working and what can be improved, but that’s not all: “It’s also interesting to be able to highlight their strengths, so that people can understand what is working well.”

Different timeframes

This feedback helps to improve processes within companies, a task that also falls within the remit of crisis management consultants. But in this case, the focus is more on the long term: consultants take the time to familiarise themselves with the company’s documentation, but also conduct interviews with the various team members in order to understand the specificities of each one.

And also to take into account each person’s personality: ‘We can use this opportunity to identify certain profiles that are more suited to being integrated into a crisis management system.’ This work can take several months.

The work of a crisis management consultant is divided between these different time frames: on the one hand, long-term work supporting companies that want to anticipate and prepare for crises, and on the other hand, providing immediate support to organisations hit by an incident that disrupts their entire business. On a day-to-day basis, crisis management consultants must therefore demonstrate a certain degree of adaptability and even be prepared to sacrifice some evenings and weekends: “We know full well that attackers don’t wait until Monday or Tuesday to strike. With the Olympic Games approaching, we are preparing for a fairly busy period,’ admits Anaïs Fauré. So is it a stressful job? ‘There is a bit of stress, but it’s mainly a challenge: our clients see us as experts in the field, so we have to be up to the task.”

Article written by Louis Adam for ZDNet.