This is a roundup of the second #CybersecurityAfterHours event on 18th August, 2021. Don't miss the next event! Sign up here to receive an invite.

What is cybersecurity incident response?

The term Incident Response (IR) refers to the protocol designed to be prepared for, detecting, containing, and recovering from a cyberattack or data breach. The document that this protocol is summarized in is referred to as the Incident Response Plan (IRP). It outlines the organization’s predetermined steps, procedures, and responsibilities under its incident response program. Its goal is to efficiently manage data breach incidents and mitigate the damage caused by cyber-attacks.

Why look into incident response planning?

Having such a plan gives you a specific advantage by:

• Providing a clear vision of the assets that need to be protected.
• Giving a roadmap to dealing with specific events effectively and decisively
• Empowering you to address the underlying cause of a breach and
• Blocking any similar incidents in the future.

Businesses of all sizes, in all locations, must have an IRP in place. When planning an incident response, it’s important to design a multi-level approach to network security and identifying valuable assets. Besides, all IRPs must be able to balance security protocols with the operations and productivity of deployed systems.

Having an IRP swing into action as soon as a breach is discovered gives the organization the advantage of speed. They can nip the criminal activity in the bud and cut short the amount of time the cybercriminals spend in their system. This turnaround speed, in turn directly impacts the amount of data that can be salvaged.

No cyberattack incident is an island unto itself: the bigger the breach, the more newsworthy it becomes. The company’s investors, stockholders, clientele, auditors, or even the media or legal teams may all have questions after a data breach comes to light. Having an IRP in place, which is followed to the T, and all records maintained, goes a long way in reassuring everyone that the incident has been handled responsibly and to the best of the company’s ability.

Components of an Incident Response Plan

While designing an incident response plan, it is important to begin with a broad, bird’s eye view of things before getting more granular.

The components of an IRP and the activities therein can be classified into the following four major categories:

1. Preparation:

Recognizing the need for an IRP is the first step, followed by diverting time and resources to come up with a multi-factorial plan. This is preemptive action in case of a cyberattack.

2. Detection and Analysis: ‍

Determining whether an incident actually occurred, what kind of incident occurred, and the extent of the damage.

3. Containment and Eradication:

As the name suggests, limiting or halting the after-effects to prevent them from spreading further and causing more damage. Then dealing with the problem itself.  

4. Post-incident recovery

This stage involves analyzing what occurred and collating the lessons to be learned. This is important to help the IRP, and security standards, evolve. It also helps make the risk assessment process more granular and efficient.

Developing an incident response plan

While developing an incident response plan, these are some of the steps to be followed:

• Conduct a security audit to identify weaknesses
• Specify the primary incident response requirements both regulatory (NIST, PCI DSS, etc.) and business-related (rapid response times plus recovery strategies, etc.).
• Define security incidents and levels of severity clearly
• Designate a primary incident response team and backup teams
• Delineate a chain of communication and command in case of an incident.
• Beyond the incident, it continues to provide support for steps such as essential documentation for audits, or back-end activities in support of legislation, if any.
• Arrange meetings between key analysts to determine how to up-level security and learn from the lessons of an incident.

It is important to remember here that an IRP is not the responsibility of the techies only. The organization’s business goals and priorities must also be factored in. All parties must decide what assets must be protected, what activities should not be impacted, and what the level of acceptable risk ought to be.

Incident Response Plan Templates are a great place to start building your company’s own IRP. Now that you have the general idea of how to build your incident response plan, you can use a suitable, freely available IRP template to plug your details and protocols into. You can simply trim the fat, i.e. remove the parts that are not as relevant to your industry or organization.

But Templates Don’t Cover Everything! They certainly do not cover aspects that are unique to your business. This is where the recommendations of your CISO are extremely important.

The Importance of Automation In Incident Response

Even with the best IRP and templates, if there is a dearth of security/surveillance staff, it can still be an issue. Statistically speaking, identifying and closing a breach takes a long time, over 100 days. It is extremely challenging to sift through every alert. It is nearly impossible to investigate and respond to every incident.

The answer lies in automation, i.e. automated incident response playbooks. Automated security tools work 24/7. Their surveillance is constant. They can pick up on alerts, investigate them, and deploy the solution as per the incident response plan without breaking a sweat. For instance, if the tool detects unauthorized logins or traffic between the network and an unknown IP address, the incident playbook automatically blocks the traffic and raises the firewall. It alerts the personnel to investigate the occurrences, taking contingency measures before raising the alarm.

Thus, automated IR tools help lower the pressure on security teams while dealing with a large number of problems swiftly and efficiently.