Achieving Integration

it's in our CNA

Nearly two-thirds of all publicly known ransomware attacks in the U.S. in 2019 targeted state or local governments.

Barracuda, August 2019

"If it were measured as a country, cybercrime would be the third-largest economy after the United states and China."

Cybersecurity Ventures, November 2020

Average ransomware demand in 2020 was $312,493, up from $115,123 in 2019.

2021 Unit 42 Ransomware Threat Report

300.6 million identities were exposed in data breaches in 2020.

Insurance Information Institute

In 2020 there were 791,790 complaints of suspected internet crimes - and increase of over 300,000 from 2019 - with reported losses that exceeded $4.2 billion.

FBI, March 2021

Annual expected cybercrime costs in 2025: $10.5 trillion

Cybersecurity Ventures, November 2020

The Cyber Disruption Team

enables collaboration between...

Hagerty's Cyber Nexus Approach

Pre-Incident:

To effectively prevent, respond to, and recover from cyber disruptions, emergency management, information technology/operational technology (IT/OT), local and state government partners, and private sector partners must collaboratively establish plans for managing complex cyber incidents and test those plans. Ensuring cyber preparedness establishes relationships pre-event and tests viability of planning. Effective planning leads to hardened, more resilient systems, effective alert systems, and a clear chain of command to handle cyber incidents and mitigate cascading impacts.

Develop and Maintain Cyber Incident Response Plans

Hold Quarterly Cyber Disruption Team Meetings

Conduct IT / EM Trainings and Exercises

IT / OT Team
• System monitoring and hardening
• Patch management
• Penetration testing
• Hardware / software maintenance

Emergency Management Team
• Cyber risk management
• Cyber incident/disruption response planning
• Training and exercise

Incident Response:

A coordinated response ensures that all parties are performing their functional missions while minimizing or eliminating unnecessary duplication of efforts. Coordinating response across IT/OT, emergency management, local and state government, and private sector partners ensures that the response is as comprehensive and effective as possible. An effective response can lead to faster threat identification and stronger coordination across agencies and partners, which enables the targeted organization to better safeguard their assets and reputation.

Establish Regular Briefing Schedule Across Disciplines

Communicate and Prioritize Reponse Actions

De-conflict Any Response Issues Across Disciplines

IT / OT Team
• Digital forensics
• Malware analysis and quarantine
• Breach management
• Information technology disaster recovery restoration

Emergency Management Team
• Consequence management (response to physical cascading impacts)
• Operational coordination across relevant disciplines

Post-Incident:

Coordinated recovery actions ensure that the restoration of virtual and physical systems align and that lessons learned from the incident are retained and improved upon. Collaborating on recovery and mitigation activities and managing the long-term impacts of complex cyber incidents supports a community’s ability to recover quickly and increase resilience. Effective post-incident activities enable the targeted organization to restore services faster, complete after-action reporting in a timely manner, and begin mitigation activities to prevent future attacks.

Establish a Regular Meeting Schedule for Virtual and Physical Asset Recovery Coordination

Conduct After-Action ReportingThat Captures Areas for Improvement in Both Virtual and Physical Arenas

Develop a Roadmap for Long-Term Recovery Actions, Including any Mitigation or Grant Management Options

IT / OT Team
• Restoring services (systems, data, connectivity)
• Update controls and processes

Emergency Management Team
• Recovery of physical assets
• After-action reporting

Prepare Your Business

Past Projects

Cybersecurity annex

Hagerty Consulting developed a cybersecurity annex for a state-level emergency management department. This project involved the engagement of a broad group of stakeholders with a role in cybersecurity operations in the state, including stakeholders from state and local governments, regional fusion centers, and the private sector. Hagerty professionals collaborated with subject matter experts who provided in-depth knowledge on cybersecurity, state-level planning, national best practices in cyber response, and fusion center coordination. This planning project contributed to broader emergency preparedness in the state by providing an annex to the state emergency plan that addresses operations related to cyber incidents. This project also contributed to efforts to build capabilities for cyber response and coordination across the state.

Statewide cyber disruption plan

Hagerty Consulting supported a state’s IT department in the development and implementation of a statewide cyber disruption plan. This project involved the engagement of a targeted group of stakeholders with a role in cyber disruption response to inform the development of the plan. Hagerty also developed an implementation strategy to provide recommendations for the implementation, socialization, and maintenance of the cyber disruption plan. The project contributed to broader efforts to increase the state’s cyber response capabilities.

Cyber incident response exercise program

Hagerty Consulting facilitated a series of iterative exercises for a state IT department. Each exercise was designed to test the state's cybersecurity response capabilities and identify areas for improvement to inform the final phase of the project: updating and enhancing the state's cyber disruption plan. Concurrently, Hagerty engaged new stakeholder groups to support the state's long-term goal of socializing cyber incident response protocols with a larger audience. Hagerty updated the state's plan to reflect those findings and provided a separate, long-term improvement plan to ensure the future growth and development of the state's cybersecurity program.