Role of Incident Response in Cybersecurity

Preparation

The planning that happens before the incident occurs will be the saving grace for when you’re faced with a serious issue. You’ll be able to recover faster and more efficiently when you are prepared.

The preparation phase includes outlining who is in the incident response team (contact info and their role). This phase is also detailing the prevention actions that will be taken place for specific threats. Your company must be doing more than just implementing the cheapest VPN (although that is one helpful security measure).

This part of the plan should detail how sensitive information is managed, stored, and shared. Additionally, risk assessments, software for malware attack prevention, and the like should be detailed here.

Detection & Analysis

When an incident occurs, this is where the detection and analysis phase of your incident response plan is first triggered. You need to determine the origin of the attack, and unfortunately trying to create a plan that encompasses every possible risk and a set procedure for each threat won’t be possible.

Consider the most common cyber attacks for the industry you’re in and the type of company you have, as well as the unique vulnerabilities your company has.

Detecting security incidents can be done by:

• Noticing signs of the incident before it even happens (precursor)
• Noticing the incident occurring during or after the attack (indicators)

For example, noticing failed log-in attempts can be precursor detection for a hacker attempting to get into the system. You might have software in your planning as a preventative method to detect when this occurs.

If an incident is taking place, you will analyze and validate the event (the NIST has more information on how you might do that) to ensure that the response that is triggered is the right one for the event. Your plan would include how to document different types of incidents as well as who to notify (police, customers, recovery teams) and at which phase of the process they would be notified.

Containment, Eradication & Recovery

The most important and actionable part of your plan is this phase, as it includes what you are doing in response to the incident. This would be containing it, eradicating any threats, and recovering from the attack.

The NIST’s criteria that must be considered when creating a containment strategy includes:

• What resources are at risk of damage/theft
• How will evidence be preserved
• Availability of services (networks connection for external parties handling damage control)
• Resources required to handle the containment and recovery (monetary, time, personnel)
• Duration of the strategy being enacted (how long is each phase of the solution? Hours, days, weeks, months)

It is very important to gather all evidence that can be found and have it preserved for eradication and recovery purposes. It might mean that these documents only stay internal, or you give them to any organizations or authorities involved in the incident response.

When it comes to the eradication phase, this will be different depending on the incident type. It’s simple; eliminate whatever will help to stop the attack (this could be disabling breached accounts, closing networks, or deleting malware). Oftentimes, consulting with a specialized data forensics specialist can be helpful in this phase.

In the recovery phase, you’ll go back to the security incident response plan and make any updates needed based on the new information you have after the attack. Recovery can also include training employees on the procedures in the plan to be more equipped to deal with future incidents.

Depending on the severity of the attack, the eradication and recovery phases could be anywhere from a few days, to several months.

Post-Incident Activity

After recovering from the incident, your company should debrief as part of the post-incident activity. Reflecting on what happened can help the team identify similar incidents sooner.

Assess the severity of the damage and whether new tools and security measures should be made. Continue to update the cyber security incident response plan for ultimate effectiveness. This is also where relevant parties need to be notified.

If sensitive data was extracted, copied, viewed, or used, then most state laws require the public to be notified. Affected parties (like customers) would be notified, and oftentimes the media will be involved as they learn of the attack and report it to the general public (if you are a notable company).