Prepare for a cyberattack

The KB is a versatile organization: the national library not only has a huge book repository but also houses an enormous physical collection. Additionally, the KB offers various services, such as Delpher, where over 2 million Dutch newspapers and magazines can be found online. 

Each of these requires its own form of protection, says crisis management advisor Milou Dekker. ‘We must comply with the cybersecurity law, which, for instance, stipulates that clear agreements must be made about who has access to which information. You also need to know who does what when something goes wrong.’ 

How does a cyberattack simulation work? 

You'd rather not dwell on the latter for too long. Yet libraries are occasionally attacked. Think, for example, of the British Library, which was hacked a few years ago, resulting in lost files. ‘We try to protect ourselves against such situations,’ Dekker explains. ‘We do this by training our staff as well as possible. All KB employees receive awareness training, where they learn to recognize phishing emails, for example. Additionally, we have a separate team that knows what to do when a problem arises.’ 

How do you best prepare for such a problem? One way is through a simulation exercise: a kind of role-play where you act out what happens when confronted with a digital threat. ‘Part of the team initiates the problem, for example, by calling the department with an alarming message. Then we observe how the employees respond.’ 

This role-play is carefully thought out in advance, Dekker emphasizes. ‘First and foremost, it must be a realistic scenario: there must be a chance that this problem could occur in real life. Additionally, it should align with what you want to train, such as whether employees escalate the issue properly when the problem becomes evident. Furthermore, it must have a high impact: the problem should have significant consequences. And, of course, the problem shouldn't be too easy to solve.’ 

How do you keep colleagues engaged with cybersecurity? 

Creating such a scenario is often already a very good exercise, Dekker observes. ‘Not everyone deals with all risks every day. By thinking about them, you become aware of what could go wrong.’ 

Employees often find such exercises quite tense, Dekker knows from experience. ‘We try to make it fun, for example, by including jokes in the scenario. Additionally, it's important to create a safe environment: it's okay to make mistakes; that's how you learn.’ 

Her department recently acted out a scenario where someone with malicious intent gained access to the network and important systems. ‘Such a person is often not necessarily looking for information but for money,’ Dekker explains. ‘They often threaten to release valuable data unless you pay a ransom. At that moment, you look for ways to contain the problem. For example, how do we ensure that our customer service remains operational?’ 

Why should cyber training be repeated regularly? 

Unfortunately, this scenario is becoming increasingly common, Dekker observes. ‘All companies need to protect themselves against this. On the other hand, by doing so, we collectively raise the standard: the more resilient we make ourselves, the harder we all have to work to maintain that standard.’ 

Such training should be repeated often: practicing once or twice a year is important to keep the measures fresh in everyone's memory. You determine per team what is important to train, for example, in ICT or marketing and communication. ‘It doesn't have to be complicated,’ Dekker emphasizes. ‘You can, for instance, use the experience of other institutions. Additionally, the government offers various standard exercises. You can also conduct a crisis exercise via the National Cyber Security Center (NCSC) or the English National Cyber Security Centre. Collaboratively creating a scenario can also be incredibly helpful. Consider it a creative exercise – and creativity is often abundant in cultural institutions.’ 

What makes a good scenario? 

Want to create your own scenario? Consider the following criteria. 

Get started with cyber resilience 

• Organize at least one cyber crisis exercise per year.  
• Involve different departments in the exercise.  
• Choose a realistic scenario that fits your organization.  
• Evaluate afterward what went well and what could be improved.  
• Use existing scenarios from organizations like the NCSC. 

Author: Anne Louise van den Dool