DDoS Attack and Crisis Management Overreach
A European online retailer experiences a distributed denial-of-service (DDoS) attack that degrades its website response time from 200 ms to 8 seconds for 40 minutes. The attack is volumetric (UDP flood) and is mitigated by the ISP's scrubbing center. No customer data is exposed, and no systems are compromised. The incident manager wants to invoke the full crisis management plan, notify all 2 million customers via email and social media, and inform the national CERT. The technical lead argues that the attack is already contained and the website is recovering. The company's incident policy defines a 'major incident' as one with 'significant business impact or media attention.' The marketing director is worried about brand damage if the story leaks. The CEO is traveling and unreachable for 3 hours.
1. Should the incident manager invoke the full crisis management plan? Apply ISO/IEC 27035 principles of incident assessment, severity, and escalation.
Read the worked answer
No, not automatically. 27035 requires assessment against defined severity criteria before escalation. The attack caused 40 minutes of degraded performance, no data loss, and was mitigated by the ISP. The policy defines a major incident as one with significant business impact or media attention-neither is clearly present. Invoking the full crisis plan and notifying 2 million customers would be disproportionate and could itself create media attention and brand damage. The incident manager should instead: confirm containment, monitor for recurrence, assess business impact (e.g., lost sales, customer complaints), and follow the escalation matrix. Informing the national CERT may be appropriate if required by regulation or if the attack is part of a broader campaign, but it is not automatic for a mitigated DDoS. The principle is proportionality and defined criteria, not instinctive escalation. The marketing director's concern about leaks is secondary; the decision should be based on impact, not fear.
2. Evaluate the proposed customer notification. What communication principles from 27035 apply?
Read the worked answer
The proposed mass notification is inappropriate. 27035 communication principles include timely, accurate, targeted, and consistent messaging, and avoiding unnecessary alarm. Customers do not need to act; no data was exposed. A mass email to 2 million customers for a 40-minute slowdown would confuse and alarm them, and could harm the brand more than the incident itself. A better approach is to update the status page, monitor social media, and prepare a response if inquiries arise. If the outage had affected transactions or exposed data, targeted notification would be required. The incident manager should coordinate with communications and legal, and use approved templates. The principle is to communicate to those who need the information, not to everyone by default.
3. What should be done about the CEO being unreachable, and how does this affect incident management?
Read the worked answer
The incident manager should follow the delegation of authority defined in the incident management plan. If the CEO is unreachable, the plan should specify a deputy (e.g., COO, CISO) who can make decisions. The incident manager should document the attempts to reach the CEO and the decisions made by the delegate. This situation reveals a gap: the plan must include contact lists, alternates, and decision rights for major incidents. 27035 emphasizes roles, responsibilities, and communication. The incident manager should not delay necessary actions, but should also not overstep authority. For this DDoS, no crisis-level decision is needed, so the CEO's absence may not matter. For a real major incident, the lack of a deputy would be a serious vulnerability. After the event, the plan should be updated with tested escalation contacts.