An incident response plan is like having an emergency fund ready in case something might happen. The necessity of an incident response plan is unavoidable, and there are many things that need to be focused on when a business owner is making a cybersecurity incident response plan. ACSI presents this article as a guide for all business owners or soon-to-be business owners to make their cybersecurity incident response plan.
A cybersecurity incident response plan is a list of actions that need to be done ASAP, people to contact in order, and all the assets that the company has. The definition may vary for each person or company, but an incident response plan still acts as the action taken after the incident happened.
Without a cybersecurity incident response plan, a company might be in trouble if someone attacked their system. Although the analogy is different from having zero-incident training at all, an incident response plan is still needed to have a guide on what to do during a crisis. It is like having a standard operating procedure for a cybersecurity emergency situation.
Unfortunately, despite the important role of the incident response plan, some companies still have not utilized this tool yet. Quoted from IBM, 77% of correspondence to their survey do not have a cybersecurity incident response plan.
The action is different for each company and may not be the same depending on the causes e.g. ransomware, data leakage, or others, needs to be put from the easiest to hardest. This is to minimalize time-consuming activity and let the preventive action take place sooner.
Therefore, this article will offer you some basic suggestions that should be suitable for just about any sort of company that is developing a cyber incident response strategy.
The plan.
The first suggestion is that each department should at least include one trustworthy individual to deal with the aftermath of the attack. This recommendation is provided considering that a threat to cybersecurity harms the entire firm, not just your computers and IT infrastructure. That person will be responsible to lead the actions needed to fix the problems.
Another suggestion is to make a set of IRP (incident response plan) based on the attack. Is it ransomware? Is it a data breach? Or what? Each set will include all the contact, emails, and number of all employees in that field. The software and hardware that the company or a specific department use will also need to be written down, alongside the solution on what to do to fix them. Is it to shut them down immediately? Or disable a third part antivirus?
After all of that, a detection phase is needed to be done ASAP. Most businesses nowadays utilize more than one security solution to help their IT team monitor and analyze an attack. The examples are:
When it comes to the containment step, there are likely two options. Either contain the attack by disabling the system so the attack would not reach further, or by eliminating the threat while also creating stronger protection so this problem would not occur again shortly. Both options have their ups and downs and can affect the business in either the short term or the long term.
- SIEM (security information and event management). SIEM gathers and correlates security event data from the organization’s network devices (firewalls, antivirus, etc.) SIEM would later provide indicators of real dangers.
- EDR (endpoint detection and response). EDR automatically defends the organization’s end users, endpoint devices, and IT assets of an organization from online attacks that bypass antivirus or firewall.
- SOAR (security orchestration, automation, and response). IT teams can create playbooks with SOAR.
- ASM (attach surface management). ASM is capable of discovering network assets that have never been monitored and can map asset linkages. ASM also continuously monitors vulnerabilities and potential attack vectors across all the company’s assets.
Eradication of the threats will come after the containment step. The last step will be recovering and reviewing. While the objective during recovering step is obvious–which is to recover the company back before the attack took place–reviewing step is crucial so the same attack would not hit the company ever again. It is like an evaluation after an EO conducting an event–an important step to know all the holes in the system that caused the attack, alongside how to seal the holes.
Read our other works:
• Small Business Should Pay More Attention to Cybersecurity
• Domain-domain Baru ZIP Memunculkan Debat di Antara Para Ahli Cybersecurity
• Which One Do You Need, VPN or DNS?
References:
• https://www.sdxcentral.com/articles/news/ibm-77-of-enterprises-dont-have-a-cybersecurity-incident-response-plan/2019/04/
• https://www.cisco.com/c/en/us/products/security/incident-response-plan.html
• https://www.crowdstrike.com/cybersecurity-101/incident-response/
