The Need for a Proper Incident Response Plan

The current state of technology has brought many positives due to the accessibility and variety of its uses. Along with the positives, though, comes many dangers that if not handled properly can lead to detrimental consequences for individuals and organizations. Cybersecurity incidents can happen to organizations both big and small, and they can then, in turn, also affect others on the individual level. Although it would be great if these incidents never happened, they will, and having a well-designed incident response plan (IRP) in place is vital to managing and mitigating the consequences.

1. Understanding the Importance of an Incident Response Plan

Before laying out the components of an IRP, one must understand what a cybersecurity incident is. A security incident, as defined in the NIST SP 800-82r3, is “an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.” The key components of the definition are foundational to the accomplishment of a proper IRP. Cybersecurity incidents can cause data breaches, financial loss, reputational damage, and legal complications. Having a structured response plan enables an organization to respond quickly, reducing the impact and preventing further damage. Having a robust IRP also demonstrates to insurers that a business takes cybersecurity seriously and has proactive measures in place to detect, respond to, and recover from incidents. This helps to reduce the organization’s risk profile.

2. Establishing an Incident Response Team (IRT)

Having clearly defined roles is essential to implementing and carrying out an IRP. Typical roles included within an IRT are as follows:

• Incident Response Manager: Leads the team, coordinates responses, and makes crucial decisions.
• Security Analysts: Investigates incidents, analyze logs, and identify the root cause.
• IT Staff: Implements technical solutions, such as isolating affected systems or networks.
• Legal and Compliance Officers: Ensures that the organization’s actions comply with legal and regulatory requirements.
• Public Relations/Communications: Manages communication with stakeholders, employees, and the media.
• Human Resources: Addresses incidents involving employees or insider threats.

As much as possible, this team should consist of individuals from different segments within the organization in order to provide a more robust understanding of potential risks and processes.

3. Developing a Detailed Incident Response Process

Once a team is in place, the creation and implementation of the IRP should begin. A typical IRP should contain the following phases:

• Preparation: This phase involves training the IRT, developing response procedures, and establishing communication channels. It is also vital to ensure that all team members know their roles and have access to necessary tools.
• Identification: A key part of identification is the implementation of monitoring systems to detect and identify potential incidents. This involves using tools like intrusion detection systems (IDS), antivirus software, log management, and security information and event management (SIEM) tools.
• Containment: Creating strategies for containing the incident to prevent further damage is essential in responding to an incident. Containment can be short-term or long-term. Within this phase it is vital to evaluate the unique risks associated with the different components of an organization. The strategies of containments used will vary depending on the type of the attack (malware, ransomware, denial of service, etc.) and the magnitude of the attack.
• Eradication: This phase involves identifying and eliminating the root cause of the incident. This may involve removing malware, patching vulnerabilities, or changing compromised passwords. Ensure that the threat is completely eradicated before moving to the next step.
• Recovery: During this step it is key to act methodically and to evaluate the possibilities of the affected parties. The recovery step is in place in order to restore affected systems, data, and operations to their normal state. This includes validating that systems are secure, monitoring for any signs of lingering threats, and conducting tests to ensure everything is functioning correctly.
• Lessons Learned: After all other phases are complete, it is helpful to conduct a post-incident review to analyze what happened, how it was handled, and what improvements can be made. This phase is crucial for continuous improvement and helps prevent similar incidents in the future.

4. Creating Communication Protocols

Effective communication is critical during an incident which drives the need to establish clear communication protocols for internal and external stakeholders. It is important to determine who needs to be informed, how the communication should be handled, and what information should be shared. Along with the internal parties, examples of key external parties that need to be involved are legal advisors, law enforcement, government officials, and third-party vendors.

5. Testing/Maintaining the Incident Response Plan Regularly

An IRP is only effective if it is tested and maintained regularly. Conduct periodic drills, tabletop exercises, and simulations to evaluate a team’s preparedness and identify any gaps in the plan. After each test, conduct a review to identify areas for improvement and make necessary adjustments to the plan. Consistently testing and adjusting the plan is key in adapting to an ever-changing cybersecurity environment. Lastly, maintain an updated version of the plan and ensure that all team members have access to it.

McKonly & Asbury has experience in auditing IRP’s and conducting tabletop exercises. Please contact Elaine Nissley, for more information about McKonly & Asbury’s Internal Audit, readiness, and consulting services.

About the Author