Cyber Crash Investigations: Seizing the Opportunity to Learn from Past Crises

Julia Wighton and David Stocks, incident readiness and response practitioners, use aviation accident investigation as a model for examining past cyber crises. Their goal is to surface root causes and prompt listeners to question how ready their own organizations are in less obvious areas, rather than to offer a full checklist.

The middle of the talk moves through the stages of an incident. Before one, they point to inconsistent multifactor authentication, plaintext credentials in code, overloaded domain admin roles and unclear patching ownership, illustrated by an M365 account that was never challenged because enforcement was missing. During an incident, they flag monitoring blind spots, alert fatigue, unclear escalation with outsourced SOCs and weak data management; a double extortion case grew worse because old customer records and staff personal files sat on a file server. For recovery, they stress containment plans with clear decision owners, business continuity plans that last weeks rather than days, and the ability to restore everything in bulk. A final case showed that a slow decision to disconnect from the internet let an attacker reach more systems and take data.

They close by arguing that expensive tooling matters less than tested processes. Data management and business continuity deserve more attention, and pre-agreed decisions, messaging and joint exercises with executives, technical teams and outside providers can shorten response time.