On Friday 12 May we saw an unprecedented worldwide attack on IT systems, affecting thousands of organisations in over 74 countries.
In this case the attack was a ransomware by the name of WannaCry and WannaCrypt.
What is ransomware?
There are many types of malware that affect a computer ranging from those that steal your information to those that just delete everything on it.
Ransomware, on the other hand, prevents users from accessing their devices and data, demanding a certain amount is paid in bitcoins to its creator as ransom.
The advice usually given is to disconnect computer from network immediately, try change the date on PC to a date prior to attack (some ransomware have a time code). – If this doesn’t work, completely shut down PC using power button and seek help from a professional cyber defence professional.
Never pay the ransom as this does not guarantee file retrieval and in fact encourages the attackers to persist further.
There are many companies out there who specialise in cyber protection such as ‘Exclusive Networks’ who specialise in one of the leading protection suites ‘Fortinet’.
Aamir Lakhani of Fortinet wrote a very informative blog that cover ransomware prevention in more detail.
So what can internal communicatons do to help?
If you work in a company that has been affected by some sort of ‘cyber crisis’ it may no longer be possible to communicate via the usual online methods, so having, well-established, offline channels is a bonus here.
Channels could include:
- Text to company phones
- Company App
- Telephone calls
- Helpline recorded messages
- Face to face
There are a few simple steps that the internal communicators can take in the event of any crisis.
Step 1 – Gather
If you have been proactive and anticipated this crisis, access your pre-planning crisis process.
Gather your core team (usually consisting of senior figures in PR, Internal Comms, CEO and someone of senior position in the area affected, eg for IT the CTO) the team should collate accurate, clear and concise information about the current ‘crisis’.
This will determine who has, or will be affected, when they will be affected, the impact to business, continuity plans and potentially for how long the crisis is likely to affect the company.
Step 2 – Define
- The core message (Be mindful of legalities, what information is essential to share, or what should be treated as confidential and not shared)
- Who is affected
- The intended audience (often different from those affected)
- What actions are required by the recipient of your comms
- What channels are available and mosr effective
- The spokesperson/signatory
Step 3 – Check
Before sending out any crisis comms it is always wise to frequently check the current status of the ‘crisis’ as this can change minute-by-minute. It is essential for your employees to receive the most up-to-date status.
Step 4 – Two-way
Once sent, be sure the spokesperson is available to respond to any incoming communications, queries or updates and be prepared to respond further to diffucult questions.
Step 5 – Progress
Some of your core crisis team should remain focused on the events at hand. Their role should be to remain up-to-speed with the current status. Your core ‘crisis’ team should be on high alert and available to discuss any further comms required. (This may require a 24hour rota.)
Proactive Crisis Communications
Ideally any organisation such be proactive when approaching crisis comms.
Gather your Core crisis comms team for in-depth brainstorming sessions on all the potential crises that could occur at your organisation. This should be repeated quite frequently and if possible be factored into your routine catch-ups.
This exercise will enable you to realise that some of the potential situations may be preventable by simply modifications to current methods of organisational operation.
You can also begin to identify possible responses, for best-case or worst-case scenarios to each potential situation and who may be affected.
Who would your core crisis comms team be?
Just as all organisation have Fire Marshall who conduct training and drills in order to respond effectively in a real event. So should your organisation have a ‘Core Crisis Team’ the more pre-planning you can do the better you will be at responding in a real event.
Proactive crisis comms planning is much better than trying to plan while under the pressure of an actual crisis.