One Sky Solutions
One Sky Case Study
When a cyberattack forces you to rebuild better than before
How a North American manufacturer turns a cyberattack into a business decision: a TI reconstruction designed for its prosperity, which allows it, three years later, to sell one of its business units without a hitch
The morning a reminder call turns into crisis management
In the spring of 2022, we called this manufacturer to set up an integration meeting that kept getting postponed. The contracts were signed, but the work hasn’t started yet. Our contact explained to us that we need to postpone it again: they are experiencing a production stoppage.
Out of curiosity, we ask what this shutdown looks like. The answer comes without him realizing its scope: they seem to be experiencing a cyberattack.
We are closing down knowing exactly what it means: several hundred workers no longer have access to their workstations and operations are completely paralyzed.
The mandate has not yet begun and nothing obliges us to go in there. But we understand exactly the extent of what is happening. With the information we have at this moment, we have no choice but to act. We remind you.
The context
The situation
TI package without worries and signed security program, integration never started.
The problem
A cyberattack hits the entire network: everything freezes, everywhere, at the same time.
Seven decisions made in the crucial early moments
1
Recall without warrant
The integration has not started and nobody is asking us for anything: we are calling back anyway, because a company of this size doesn't go through this alone.
2
Seal before analyzing
We close everything, then we look. The analysis comes after, never before.
3
Bring all the parties together in forty minutes
Executives, lawyer, investigator, insurance office, and our entire team: eighteen people on the same line at 7:40 a.m., because each one conditions the decisions of the others.
4
Same-day deployment across three time zones
About thirty technicians are leaving to relocate the workstations in six facilities.
5
Release the systems in order of production
Not in the logical order of a restoration to service: in the exact order of what the workshop needs to manufacture that week.
6
Identifying strategic clients and building communication with them
Before talking to anyone, it is necessary to know which customers are the most important to the company. We then support the management in establishing a communication strategy with each of them.
7
Establishing a new digital hygiene
Passports, driver’s licenses, and personal documents of employees have been lying dormant in the infrastructure for years. We are removing them and laying the foundation for a new digital hygiene.
ⓘ In 2022, these documents posed a diffuse risk. Under Bill 25, the exposure of personal information of this nature during an incident triggers an obligation to report it to the Commission d’accès à l’information and to the individuals concerned, with fines as a consequence.
Two weeks to build the plan for the next year
For two weeks, meetings and discussions are taking place with management to quickly reach a reconstruction plan for the next year. Each technological choice is based on the business context, not the logical order of a return to service.
Starting from the production notebook
Before choosing what to repair, we ask ourselves a business question: how long can the company sustain itself with what it has already invested? Here, four to six weeks of production. This limit sets the limit: everything that fuels the workshop must be restored before it runs out, the rest can wait.
Replacing rather than repairing, and budgeting
The ERP is not recoverable and each item must be replaced. Rather than continuing with emergency repairs, we are establishing with the management a reconstruction budget of several hundred thousand dollars for the next year: a high-level, costly, but planned decision.
Rebuild differently rather than rebuilding what already exists
We propose to make each business unit autonomous, isolable in a few minutes, rather than restoring the network to its previous state. This is longer and more expensive, and the customer disputes the choice. We maintain it for two reasons: an attack could happen again, and one day a unit will change hands, possibly tomorrow.
Phase 1
Production capacity restored. The four to six weeks of production already underway absorb the shock: no end customer experiences the attack.
Phase 2
Reconstruction has begun to establish new digital hygiene: a new ERP system and new workstations.
Phase 3
Complete segmentation: each business unit is isolated according to the segmented model.
No other cyberincident has occurred since then.
Result: We unplug on the left, we plug in on the right
Production resumes in two weeks and full control returns in three months, without any end customers feeling the impact. But the true result of this reconstruction did not appear until three years later.
The company has the opportunity to sell one of its business units. In such a transaction, the technological verification is often the step that throws the timetable off course: it takes time to untangle the emails, servers, and access points of one unit that are intertwined with the others, and that takes months. Except that each unit had been rebuilt specifically to operate independently.
The transfer therefore required no fuss, no months-long migration, no renegotiation. During the verification call, the buyer’s IT managers delivered their verdict: the cleanest network they had seen, all separated, all documented. They then adopted the model for their subsequent acquisitions.
What SME decision-makers need to remember
signal 1
Your order book is your real reconstruction timeline
Whether you are a manufacturer or a service company, what you have already committed to delivering determines how long you can hold on. This client had four to six weeks of production committed, and it was this cushion, nothing more, that protected their end customers. How many weeks have you got?
signal 2
The continuity plan starts with a business question
Which client is the heaviest? Who is calling him? Who is talking to the employees? It took 12 to 18 hours to answer the first one. In the middle of a crisis, those hours are costly.
signal 3
A segmented architecture is not an expense, it is a balance sheet asset
It protects you from an attack, and it protects you on the day you sell, buy, demerge, or finance. A disentangleable IP can be negotiated. A tangled IP gets discounted.
⚠ Rebuilding in emergency mode always costs more than rebuilding in planned mode, and decisions are made with a shrinking order book.
✕ A buyer who doesn't understand your infrastructure doesn't ask you for explanations: they subtract the amount of doubt from the selling price.
Evaluate your posture before a buyer does it for you
Our worry-free IT package and security program cover prevention, continuous monitoring, and incident response. This case demonstrates something else: how your IT is architected determines what your business is worth on the day of a transaction.
Segmentation and isolation
Each business unit operates on its own and cuts itself off from the rest within a few minutes.
Continuity tested, not theoretical
Disaster recovery plan, restorable backups, and simulation exercises.
Documentation ready for due diligence
What a buyer, insurer, or client will ask to see.
Ready to take action?
An initial, non-binding audit, to find out what a buyer would see in your infrastructure tomorrow morning.