Online threats are increasing in sophistication; therefore, it is imperative for organisations to establish protocols prior to a security breach. Cyber-attacks can affect multiple areas such as data, systems, financial resources and customer perception of the organisation. An existing cyber security incident response plan presents organisations with a method for threat detection, mitigation and resolution.

What Is an Incident Response?

Incident response is the formal controlled process that an organisation follows to identify, analyse, contain and recover from an information security incident. When not defined, time can be lost in attempting to respond to an incident that is unfolding.

The cyber security incident response plan should clearly specify roles, procedures, communication and escalation requirements. This helps the employees and the security professionals to find out what responsibilities they have to undertake once they find something suspicious.

Why Preparation Matters

Cybercrimes may occur via various vectors including phishing e-mails, pilfered login credentials, malware, ransomware, unpatched software and breaches in unauthorised access. Stringent security measures do not be able to address each risk.

It is therefore important that preparedness is part of the overall management of risks. Documented response procedures allow the team to react in a standard way, rather than rushing into decisions.

Detecting and Containing Threats

Time is an important consideration in a cyber event; the length of time an attacker has access to a system has a direct correlation to the amount of damage they could cause.

Response procedures start when the suspicious activity is identified and confirmed to be an actual security incident. Then the security team takes the following containment actions, breaking down affected machines from the network, disabling breached accounts, preventing undesired traffic and much more.

Using a Security Incident Response Playbook

A security incident response playbook provides instructions for responding to specific types of incidents. Rather than having general instructions for responding to any security incident, organisations may choose to deploy playbooks for categories such as ransomware, phishing, data breach, compromised account or malware.

A playbook can be used to specify what we should do, who we should call, and what logs we should maintain. This may enable us to automate the response and remove uncertainty.

Recovery and Learning

The containment of an incident does not mark the end of the response. The organisation should be brought back up safely and the infection checked for.

Post-incident reviews are equally important. They will provide information on what actually happened, whether the controls worked or not, and what improvements are needed. This information can then be added to the future security policy.

Hence, a comprehensive cyber incident response method would consist of planning, detection and analysis, containment, eradication and recovery, and post-incident activity.

Building Stronger Cyber Resilience

Response procedures for security incidents should be periodically reviewed and refined, in order to ensure they are still valid. As new technology, new people, new suppliers, new regulations and new cyber threats arise, the approach to dealing with incidents will evolve.

A well-thought-out response plan cannot promise to prevent all online risks, but it can limit any confusion and allow a business to adapt better. Creating protocols, pre-planning, appointing responsibility, running test simulations and analysing all incidents will all help a business strengthen its online protections and reduce the impact of the risks.