How Strong is Your Incident Response Plan?
A Rapid and Robust Incident Response Plan is Vital
A lot of things can go wrong when you respond to a cyber incident, so it is vital that you have a plan of action in order to mitigate and deal with any damage. As Tim Stiller outlines in his online webinar, How Robust (and Rapid) is Your Incident Response Plan (available to view here) incident response can be a challenge, but to be successful teams need to take an organized and coordinated approach with 6 core steps.
The specific elements of an incident response plan will differ depending on the company and the incident, but all plans must be built on the foundation that your response teams can develop the muscle memory to deal with a threat, no matter its size and scope, in an efficient and timely manner, ensuring that dwell time is kept to a minimum and proactiveness is encouraged.
RECOMMENDED: Threat Intel Tools Take Enterprises Away From âReactiveâ Posture
During the investigation response phase, your company doesnât have the time to formulate a plan â your teams should already know who to engage, what technology to use and what steps to take. Without having a playbook or plan in place, your investigation response procedures will fall short and you will miss critical pieces of data that will help you prepare for the next attack.
Here is a rundown of the core pillars of an incident response plan:
The first step is preparation and this stage is centered on people, process and technology â and knowing what you have in place already, including contacts lists for internal and external stakeholders.
You should have a list that accounts for systems, software and processes involved in the following key areas of preparation:
Endpoint â This can include any antivirus or HIPS systems you have in place and generally any software solutions.
Network â Network preparation includes email security and perimeter documentation.
Log management â In addition to log retention, this area also pertains to log review and how this interacts with your alerts platform to enable an investigation.
Policy â The policy area includes data collection and preservation.
The core takeaway from the preparation stage is to document what you have in order to become familiar with your capabilities and the value of each individual component.
Not only is this a core element of incident response, but it will also give youâre the opportunity to improve processes over time if theyâre not working, and it will give you more data adequately map maturity, identify gaps and pain points.
Incident response teams must develop the muscle memory to deal with a threat, no matter its size and scope
In addition, it is imperative to define what the critical business assets are in order to discern a better grasp on the estimated impact of a breach. For example, if you have helpdesk you need to have its uses defined in a holistic document that details the sum of each part of an incident response.
Continue reading:Â https://www.cshub.com/security-strategy/articles/how-strong-is-your-incident-response-plan