How to Create an Effective Cyber Security Incident Response Plan

When your critical data is under attack, you don’t have time to waste. Incident response helps you respond effectively, and understanding the lifecycle is vital to a powerful defense.

Formulating an incident response plan can be the difference between a quick resolution and significant financial consequences for your business in the event of a cyberattack. While you can start with the Cybersecurity and Infrastructure Security Agency (CISA)’s quickstart guide to incident response plans, we’ve created a complete explanation below.

What Is Cyber Security Incident Response?

Incident response (IR) is how an organization responds to cyber attacks and data breaches to minimize system damage and mitigate data theft. Organizations deploy incident response plans to react to IT threats, including server downtime and outages.

Not only does incident response refer to how an organization responds to and neutralizes threats, it considers several other factors, such as:

• Reducing recovery times and expenses
• Controlling damage to a brand’s reputation
• Establishing best practices in the event of another incident

Every organization that handles sensitive information and data should implement a robust incident response plan to mitigate damage.

Learn more about the benefits of our Incident Response Services.

What is an Incident Response Plan?

An incident response plan (IRP) is a written document created by the leadership team that guides your organization’s actions before, during, and after a security incident. It ensures the proper personnel and procedures are in place to conduct an effective, orchestrated response during a cybersecurity incident.

Incident response plans include:

• Strategies to neutralize threats to systems or data
• Actions required for each state of the response
• Communication and delegation of responsibilities organization-wide to accomplish those actions
• Post-event metrics to evaluate response effectiveness and efficiency

An effective cybersecurity incident response plan should detail what needs to be completed and who is responsible for carrying out each action. A good incident response plan even goes beyond the resolution of the incident. Every organization should have a plan that provides employees with steps on what to do after the incident has been resolved internally.

Some important factors to consider after neutralizing a threat are:

• Legal workflows
• Documentation for auditors
• Detailed historical logs in the event of a similar attack
• Updated best practices to help each department respond to future attacks

Why Are Incident Response Plans Important?

Incident response (IR) plans are crucial because they guide an organization to minimize the damage caused by events such as data breaches, system outages, and more.

Incident response plans ensure that organizations can:

• Respond quickly to attacks to minimize losses
• Create new processes to mitigate the risk of future incidents
• Strengthen old processes
• Establish best practices to mitigate future intrusions
• Prevent irreversible damage to brand reputation

Consequences of security incidents also include service disruption, legal and regulatory fees, and data recovery costs. Data breaches and cyber attacks can threaten a brand’s image and customer loyalty if handled improperly. While cyber attacks are always a threat, having an organized incident response plan to counter them can prevent a lot of damage to a brand’s image in the long run.

Considerations When Developing an Incident Response Plan

Factors that should be considered when developing an incident response plan include:

• Defined roles and responsibilities for key stakeholders
• Procedures for initial detection, incident classification, and escalation
• Initial Response Procedures
• A process to facilitate secure internal and external communications
• Post incident activities

Roles and Responsibilities

To ensure an effective response to an incident, it is important that an organization assigns the proper personnel with the appropriate skills to form the Incident Response Team (IRT). The IRT will represent a variety of specialized teams that can respond to critical security incidents from both a technical and strategic perspective. An Incident Response Plan (IRP) should identify members of an IRT and establish how different members of the team report to and interact with each other.

A fully equipped IRT should be comprised of:

• Incident Manager (CISO): provides direction to all members of the IRT, ensures effective management of the incident response process, and facilitates communications to organizational leadership. A virtual CISO (vCISO), can advise a company’s full-time incident manager, create strategies to support incident management, support initiatives, and more.
• Incident Commander: oversees the technical areas of an incident while assigning tasks to the IRT team and directly interfaces with the Incident Manager regarding critical or strategic decisions that need to be made.
• Core Team: convenes during a security incident and throughout the entirety of the IR lifecycle verifies and classifies incidents, gathers evidence, conducts technical analysis, and applies proper mitigation and remediation actions as necessary.
• On-Call SME Support Team: steps in depending on incident severity to help with technical aspects and other functions to help protect business interests.
• External Team: provides third-party support based on specialized knowledge and skills needed to reduce the impact or duration of an incident.

The diagram below illustrates the various organizational and IT teams that make up the IRT core, support, and extended teams.

Initial Detection, Classification, and Escalation

Initial discovery of a security event or potential incident will usually originate via security alerts or faults in IT processes that are identified by SOC analysts or IT professionals. Once identified, the potential security incident should go through a formal validation process specified in the IRP before being declared an incident and escalated to the IRT team.

Once the security event has been officially declared an incident, preliminary incident details are gathered and escalated to the IRT team so that a proper severity classification may be given. Determining severity is important to ensure the proper teams and response activities or procedures are prioritized due to the risk imposed to an organization, its data, and computing/network environment.

The IRP may dictate that escalations and the activation of the IRT should only be conducted for incidents with a severity of Critical or High by the Incident Commander. If the security incident has been given Medium or Low rating, the incident may be directed to the SOC, IT Security Team, and/or appropriate department, unless the IRT receives special request by the Incident Manager or Commander.

The following illustration highlights the proper escalation procedures for a typical organization.

Incident severity for a given organization is considered unique and based on an organization’s specific threat landscape and potential impact to the business. An IRP should detail exactly how incident severity should be calculated and how incidents of different severities will be handled. The table below highlights how incident severity may be determined based on two components, “threat type” and “system/information criticality.”

Initial Response Procedures

Once the IRT has been activated, briefed on the incident, and assigned a severity rating, it must assess the circumstances and details surrounding the incident. This includes identifying:

• Which systems or assets are compromised
• Which networks and/or locations are affected
• Which user accounts and network IOC’s are involved
• Potential business impact

Additionally, given the circumstances of a security incident, the IRT’s response strategy must account for technical, business operations, and legal considerations.

A well-thought-out IRP should ensure that any required accesses and resources needed to investigate an incident can be obtained in a timely manner.

The following flowchart provides a high level snapshot of the IRT’s response procedures during an incident and how the various teams within the IRT work cohesively as a unit while responding to an incident from the initial detection through post-incident phases.

In order to better understand the various phases of the incident response lifecycle, please see our Incident Response Process.

Communications

Security incidents are chaotic situations that require constant communications from both internal and external teams to reduce confusion and maximize efficiency. Organizations must have approved and pre-defined methods of communication specified in their IRP to facilitate secure internal coordination.

Internal Communications

Intra-IRT communications should include an IRT contact list complete with phone numbers, email addresses, conference bridge information, and/or OOB secure message applications. Additionally, escalation/notification workflows should be mapped out prior to an incident to appropriately engage proper personnel of the IRT and leadership teams. This list of contact information and workflows should be included as an appendix to an IRP.

Depending on incident severity, it is important to have approved internal notification templates on stand-by in case HR or Communication teams must notify internally affected users and/or senior leadership. An IRP should indicate when each template should be used and who has the authority to send them.

External Communications

In order to adhere to corporate policies, national and local laws, or regulations, organizations may be required to report incident-related information to external organizations. During and following a given incident, the CISO, Incident Commander, and legal counsel must determine whether this is the case. An IRP should address and delegate reporting requirements to a specific role.

Pre-approved templates should also be considered for the following:

• Third party notification
• Customer notification
• Law enforcement interactions
• Media requests
• Data breach notifications

Confer with your legal team to determine if you need to submit a cyber incident report in the event of a breach, and add information accordingly to your incident response plan.

Post-Incident Activities

Once the incident has been completely remediated, the next step is formally concluding the incident and setting the stage to ensure cyber security incidents do not happen again.

Share a detailed final findings report during a lessons learned meeting and discuss what went well during the incident and what needs to be improved. Often, an IRP will dictate that the plan itself be reviewed and refined through a series of lessons learned at meetings at the conclusion of every incident.

You’ll also want to set up a test environment for your incident response plan and complete “table tops” to exercise and practice your IRP. Plan to revisit your documentation once or twice a year in order to review procedures and stay up-to-date. Being proactive is a must when it comes to incident response.

Closing Thoughts

Incident response (IR) plans are imperative for any organization that handles sensitive information and data. An effective incident response plan helps prepare everyone within an organization to swiftly respond to detected threats. IR plans help organizations ward off cyber attacks, prevent downtime, and secure data. Just as important, a solid incident response plan can help build trust among stakeholders and customers.

Cyber security services from [redacted] include incident response and take the guesswork out of effective planning. To learn more about the benefits of partnering with an experienced IR team, schedule a call with us today.