When a critical incident strikes and hampers your business operations, it's how you handle what comes next that will make all the difference to the extent of damage and the length of downtime.  Chaos in the aftermath does not need have to be the default.  Your team can stay focused and cool-headed with a solid incident response (IR) plan. 

The Importance of an Incident Response Plan

An IR plan is a structured methodology for handling incidents that have already or are about to impact your organization’s production operations, customer facing applications, IT infrastructure or is cyber related.

 A well-defined IR plan allows IT and security teams to effectively identify incidents, minimize the damage, find the root cause, and fix security holes to prevent future attacks.  Developing an IR strategy is an essential tool to mitigate risk and prepare for a range of incidents.  Yet, most companies do not have a consistent response plan in place.

If your organization doesn’t have an IR plan in place, don’t fret.  A post-incident response checklist is the first step in deploying an IR policy.

Your Incident Response Plan in Action:

Step 1: Prepare

In the event of a data breach, time is of the essence.  Ensure that every member of your team is properly trained and is familiar with all the aspects of their role and responsibilities.  With a clearly defined plan and training, your team can concentrate on working together to resolve the incident, instead of trying to figure out who is responsible for what during a high-pressure event.

Step 2: Identify

When a potential incident is discovered, the team should immediately collect additional evidence, decide on the type and severity of the incident, and document everything they are doing.  Documentation that clearly answers “Who, What, Where, Why, and How” is the only way organizations can learn from incidents in the long-term, and it is also an essential document for prosecution if the attacker is ever brought to justice.  

Step 3: Contain

Prepare both short-term and long-term containment strategies.  Your first priority is to contain the breach so that it doesn’t spread across your network and cause further damage.  If you can, disconnect affected tools and devices from the network.  It is also necessary to have a back-up strategy in place to ensure business continuity.  This way compromised data isn’t lost forever, and you can resume operations quickly.

Step 4: Eradicate

Once you’ve contained the issue, you need to find and eliminate the root cause of the incident so that it cannot repeat itself.  In the case of a cyber-attack, for example, this could mean scanning for and removing all malware and suspicious files, ensuring that patches and updates are implemented, both immediately post-incident and on a regular basis and more. 

Step 5: Recover

Now it is time to restore and return the affected networks and devices back into your business environment.  During this time, it’s important to get your business operations up and running, without the fear of another breach. 

Step 6: Post-mortem

The importance of analyzing and documenting everything about the incident cannot be overestimated.  Maintaining organizational memory about past incidents is a necessary step to prevent the same issues from happening again.  That is where a postmortem analysis comes in. Postmortem analysis is a standardized report that determines “the how, the what, the who, the when, and the why” of the incident for future reference and pattern discovery. 

It is important to document all the details of the incident while they are still fresh in your mind. 

Your Critical Cyber Security Post-Incident Response Checklist:

The checklist below lays out seven questions to ask yourself post-incident that will help you build and strengthen your IR plan and set out the basic steps, policies and procedures for handling future security incidents. 

1. How were the current security measures circumvented?
2. Which specific assets and platforms were targeted? 
3. How did the organization learn that an incident has occurred?
4. When did the incident occur? 
5. What tools did were used to gain access?
6. What kind of data was exposed?
7. What measures have been adopted to thwart future incidents?

Using this checklist will bring your staff together and make the best use of each employee’s unique skills and specialties, enabling you to respond effectively when the next security crisis inevitably occurs.  It is vital that organizations answer these important questions after each incident and iterate the IR plans accordingly.  This is where a dedicated IR platform comes in.

Have you Considered Leveraging Exigence?

Exigence introduces structure, clarity, and speed to critical incident management, providing complete command and control of every incident.  The Exigence platform coordinates all relevant stakeholders and devices in real-time, orchestrating complex workflows from trigger to resolution, simplifying the postmortem, and empowering organizations to learn and optimize their processes. 

Contact us today to schedule a live demo.