Plans Don't Survive First Contact - Lessons from the Military on Cyber Incidents

Plans Don't Survive First Contact - Lessons from the Military on Cyber Incidents

Speakers: Craig McEwen, Global CISO, Dechra

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=SM8it2h-bwg

Overview

In the high-stakes world of cybersecurity, the moment a major incident strikes often shatters even the most meticulously crafted plans. Craig McEwen, Global CISO at Dechra and a veteran of the British Army, brought a unique perspective to Black Hat MEA, drawing parallels between military operations and cyber incident response. His talk, "Plans Don't Survive First Contact: What the Military Teaches Us about Cyber Incidents," explored the critical juncture where theoretical preparations clash with the chaotic reality of a live attack.

McEwen highlighted that successful incident response isn't about rigid adherence to a script, but rather about dynamic adaptation, informed decision-making, and empowered teams. He introduced the military's Combat Estimate, also known as the Seven Questions framework, as a powerful, flexible tool to navigate the uncertainty, friction, and incomplete information inherent in cyber incidents. This framework, he argued, provides the necessary guide rails for teams to operate effectively and achieve desired outcomes, even when the situation is rapidly deteriorating.

The core message resonates deeply with cybersecurity professionals: while detailed plans are often rendered obsolete by the fog of war, the process of planning and the mindset of adaptable leadership are what truly ensure survival. By focusing on effects and outcomes over prescriptive tasks, organizations can foster resilient incident response capabilities that empower their teams to adapt faster than the adversary.

Background

▶ Watch: Military lessons: plans fail, incidents disrupt routine. (0:00)

The genesis of this talk lies in a fundamental challenge faced by nearly every organization: preparing for cyber incidents. McEwen, reflecting on his military background, observed striking commonalities between military and cyber operations. Both are characterized by "long periods of boredom" and routine, followed by sudden, disruptive events—a cyber incident or "contact" in military terms. This abrupt shift from routine to crisis often causes immense shock and uncertainty, leading pre-established plans to collapse.

McEwen critiqued several common shortcomings in traditional cyber incident planning. Often, plans are too rigid, failing to account for the fluid and unpredictable nature of real-world attacks. Incidents rarely follow the exact pathway envisioned in a tabletop exercise, rendering inflexible scripts ineffective. Conversely, some plans are too technical (e.g., 200-page ransomware guides) or too vague (one-page documents offering little guidance). A significant issue is the tendency for incident plans to be IT-centric, focusing primarily on restoring IT systems rather than the broader objective of restoring business continuity and preserving critical operations. Furthermore, rehearsals tend to be limited, with few organizations conducting full crisis simulations involving their entire board on a regular basis. Finally, much of the planning is compliance-driven, aimed at "ticking boxes" for auditors rather than preparing for actual, complex scenarios. These deficiencies collectively contribute to a state of unpreparedness, where shock and uncertainty dominate when an incident inevitably occurs.

Key Findings

▶ Watch: Situation analysis: CMDB, critical assets, network understanding. (6:00)

The central discovery and contribution of Craig McEwen's talk is the application of the military's Combat Estimate, or Seven Questions, framework to cyber incident response. This framework offers a flexible, outcome-focused approach designed to provide clarity and guide decision-making during chaotic situations. McEwen emphasized that this is not a rigid process, but rather a set of guide rails that allows for dynamic adaptation under action-centered leadership and mission command. The core idea is to define clear outcomes, granting teams the flexibility and empowerment to determine the best stages and methods to achieve those outcomes.

The benefits of adopting this framework include:

• Flexibility: It's a process, not a rigid script, allowing teams to respond to changing circumstances.
• Clarity: It provides a structured approach, offering guide rails for decision-making amidst uncertainty.
• Outcome-Focus: It prioritizes achieving specific effects that matter to the business, rather than merely completing predefined tasks.
• Empowerment: It fosters a culture of mission command, where leaders define "what" needs to be done, but empower their teams to determine "how."

By shifting the focus from task-oriented compliance to outcome-oriented adaptability, organizations can build more resilient incident response capabilities that genuinely prepare them for the unpredictable nature of cyber warfare.

Technical Deep Dive

▶ Watch: Outcomes vs. tasks: minimum viable company example. (9:00)

The Combat Estimate framework, consisting of Seven Questions, forms the technical and strategic backbone of McEwen's recommended approach to cyber incident response. Each question prompts a critical line of inquiry, guiding security teams through the complexities of an attack.

1. What is the situation and how does it affect me?

This foundational question emphasizes the critical need for a deep understanding of the organization's environment and the immediate impact of an incident. McEwen recounted an experience at a global telco where the first 24 hours of a hands-on-keyboard attack were spent simply mapping the network to identify impacted endpoints. This delay prevented immediate action and highlighted a critical deficiency. The solution, he stressed, lies in maintaining an accurate and effective Configuration Management Database (CMDB). A robust CMDB provides essential visibility into network assets, their interconnections, and their criticality. He cited the Equifax breach as a stark example, where a single, unmapped server led to massive data loss. Understanding what is critical to the business is equally important; McEwen mentioned the MERS/Maersk incident, where the loss of 45,000 endpoints rendered a single, offline domain controller in Gibraltar the most critical asset for recovery. Knowing your network, your devices, and your business's critical assets before an attack enables rapid, informed decision-making.

2. What have I been told to do and why?

This question focuses on understanding the organization's overarching mandate and the specific role of the cybersecurity function during an incident. It's about defining "what must we protect?" McEwen acknowledged that cyber teams are often under-resourced, making it impossible to fix everything at once. Therefore, identifying the most critical assets and prioritizing their protection and recovery becomes paramount. Revisiting the MEK example, he noted that the focus wasn't on cleaning all 45,000 endpoints but on validating, protecting, and utilizing that single clean domain controller to rebuild the Active Directory. This selective focus on high-priority assets, such as Active Directory or other core infrastructure, ensures that limited resources are directed where they can have the greatest impact, ultimately aligning with the most crucial outcomes for the business.

3. What effects do I need to achieve?

This question transitions from understanding the situation to defining concrete, desired outcomes. McEwen introduced the concept of a Minimum Viable Company (MVC) – the absolute minimum operational state required for a business to survive and continue generating value, even if it's not ideal. He shared an anecdote from a mining company in Botswana where, during a disaster recovery exercise, the team initially assumed Active Directory was the most critical asset. However, they discovered that the clock-in system, essential for miners to record their shifts and ensure payment, was actually the top priority. Without it, workers wouldn't come in, rendering any other IT recovery moot. This illustrates the importance of focusing on business-critical outcomes, not just technical tasks. McEwen further emphasized the distinction between outcomes and tasks with an incident in Botswana involving a sophisticated, low-and-slow attack on a virtual machine. His policy was to snapshot and shut down the VM to preserve evidence. However, the team, not understanding the outcome (forensic investigation to understand the root cause), immediately erased the VM. This action, while seemingly protective, destroyed crucial evidence that could have uncovered the broader attack, demonstrating how a lack of outcome clarity can be detrimental.

4. How do I best achieve these effects?

This question delves into the strategic and tactical approaches to achieve the defined effects, often involving segmentation and microsegmentation. McEwen drew an analogy to the Battle of Thermopylae, where the 300 Spartans used a narrow bottleneck to defend against vastly superior numbers. In cybersecurity, this translates to strategically segmenting networks to restrict attacker movement and allow for surgical containment. By segmenting, organizations can become "clinical" about what's important, enabling them to isolate compromised sections or bring critical network segments back online independently. This approach ensures that limited incident response efforts are focused on the most impactful areas, maximizing efficiency and accelerating recovery. Effective segmentation is a prerequisite for controlled and rapid response.

5. What resources do I need?

Beyond the common plea for "more resources," this question pushes organizations to be explicit and realistic about their requirements. It's about identifying specific needs to give the business a "fighting chance." This includes securing IR retainers with professional incident response firms, ensuring access to internal Subject Matter Experts (SMEs) for critical systems (e.g., domain controllers), and defining the involvement of support functions like legal and corporate communications. McEwen stressed the importance of identifying potential pressure points and understanding where external or internal expertise will be needed, and how these different functions will collaborate. Proactive identification of these resources and establishing engagement protocols are crucial for a coordinated and effective response.

6. When and where do the actions occur?

This question addresses the sequencing and timing of incident response actions. While a high-level sequence typically involves contain, communicate, eradicate, and recover, McEwen highlighted that the exact timing can vary. For highly mature organizations, there might be a strategic decision not to immediately contain, but to allow an attack to play out to understand the adversary's objectives—a tactic that requires significant confidence and a high board risk threshold. Containment itself can be "soft" (restricting network access) or "hard" (e.g., completely eradicating virtual machines, as seen in the Botswana example). Communications are also critical, both internally to teams and externally to stakeholders, especially for publicly traded companies. Defining who communicates (CISO, CIO, CEO, Head of Corporate Comms) and how is a vital, often contentious, pre-incident decision. The emphasis remains on defining these actions as outcomes, giving teams the freedom to adapt the "how."

7. What control measures should I impose?

The final question focuses on establishing clear decision-making authority during an incident. This is particularly vital in environments with Operational Technology (OT), where shutting down a site or network segment can have significant safety, production, and financial implications. McEwen emphasized the need to clearly define who (e.g., CISO, CEO, specific operational leads) has the authority to make such critical decisions before an incident occurs. Without this clarity, valuable time is wasted in incident response calls debating authority, or worse, no decision is made at all. Other control measures include setting clear containment boundaries, preserving forensic evidence (reinforcing the Botswana VM example), and ensuring teams understand the why behind these actions. Clearly defined authorities build trust within the business, ensuring that critical decisions are made swiftly and accountability is understood.

Demo / Proof of Concept

▶ Watch: Clear decision-making authority for critical incident actions. (17:00)

This talk focuses on a strategic framework and leadership principles rather than a technical demonstration. Craig McEwen did not present a live demo or proof of concept. Instead, he utilized real-world examples from his career, such as the Equifax breach, the MERS/Maersk incident, and specific scenarios from a telco and a mining company, to illustrate the practical application and impact of the Combat Estimate framework.

Defensive Implications

▶ Watch: Final message: planners survive, not rigid plans. (19:00)

The Combat Estimate framework offers profound defensive implications for organizations aiming to bolster their cyber resilience. Defenders should proactively embed these principles into their incident response planning and organizational culture:

1. Know Your Environment: Invest in and maintain an accurate CMDB. Understand your critical assets, their dependencies, and their value to the business. Prioritize protecting what truly matters, not just everything.
2. Define Minimum Viable Company (MVC): Work with business leaders to identify the absolute minimum systems and processes required for core operations during a crisis. This clarity guides recovery priorities and resource allocation.
3. Outcome-Oriented Planning: Shift from rigid, task-based playbooks to outcome-focused guidance. Empower teams by defining what needs to be achieved (e.g., "contain attacker movement," "restore Active Directory") rather than prescribing how.
4. Enhance Segmentation: Implement robust segmentation and microsegmentation across the network. This creates defensive bottlenecks, limits lateral movement, and allows for surgical containment, enabling focused efforts during an attack.
5. Resource Preparedness: Proactively identify and secure necessary resources. This includes establishing IR retainers with external experts, identifying internal SMEs, and defining the roles of legal, corporate communications, and other support functions before an incident.
6. Clear Decision-Making Authority: Establish and communicate clear decision-making authority for critical actions, especially those with significant business impact (e.g., shutting down systems, isolating networks). This prevents paralysis and ensures swift action.
7. Continuous Rehearsal and Training: Regularly conduct realistic incident response exercises and crisis simulations, involving leadership and the board. These rehearsals should focus on practicing adaptability, communication, and decision-making within the Seven Questions framework, not just validating a script.
8. Foster Mission Command: Cultivate a culture of trust and empowerment within security teams. Encourage analysts and responders to make decisions based on defined outcomes, knowing they have leadership support even if mistakes are made, as long as they are not due to negligence.

By adopting these military-inspired principles, organizations can move beyond static, compliance-driven plans to build dynamic, adaptable, and truly resilient incident response capabilities.

Key Takeaways

• Plans vs. Planners: While rigid incident response plans often fail during "first contact," skilled and adaptable planners, guided by frameworks like the Combat Estimate, are crucial for navigating chaotic cyber incidents.
• Outcome Over Task: Focus on defining the desired outcomes (e.g., "restore business continuity," "preserve evidence") rather than prescribing specific, rigid tasks. This empowers teams to adapt to fluid situations.
• Mission Command: Adopt a leadership principle where teams are given clear objectives and outcomes but are empowered to determine the best methods to achieve them. Trust your teams to make decisions.
• Know Your Terrain: A deep understanding of your organization's critical assets, network architecture (via a robust CMDB), and Minimum Viable Company (MVC) is fundamental for effective response.
• Prioritize and Segment: In a resource-constrained environment, identify the most critical assets and leverage segmentation to focus defensive efforts and contain threats efficiently.
• Clear Authority & Resources: Pre-define decision-making authority for critical actions and ensure all necessary internal and external resources (like IR retainers and SMEs) are identified and accessible.

About the Speaker(s)

Craig McEwen serves as the Global CISO for Dechra, an animal pharmaceutical company. Before transitioning into cybersecurity, McEwen had a distinguished career in the British Army, serving in various roles and deployments. His unique background provides him with a distinctive perspective on applying military principles, particularly those related to leadership, planning, and adapting to dynamic, high-pressure situations, to the complexities of cyber incident response. He emphasizes the commonalities between military and cyber operations, advocating for flexible frameworks and empowered teams.