Understand Your Assets. Improve Incident Response.

FREQUENTLY ASKED QUESTIONS

What is Incident Response?

Incident response refers to the process by which an organization addresses or manages a cyber attack or data breach on their IT assets. This includes minimizing the effect of the attack and remediating the cause to reduce the risk of a future attack.

What are the three key elements of Incident Response?

The three key elements of incident response are:

1. Team. Ensuring you have the right team in place to address the incident. This team should include stakeholders from IT, Legal, Human Resources, Corporate Communications, Risk Management, Executive, and third-party security forensic experts.
2. Plan. Having a comprehensive incident response plan in place. The plan should outline how to prepare the team to handle an incident, how to detect and evaluate an incident once it has occurred, how to contain the damage, how to determine the impact and risks, how to find and remediate the root cause, how to resolve the incident, and how to prevent future incidents.
3. Tools. Having the right tools in place to minimize incidents that could cause damage to an organization and their customers.

What is an Incident Response Plan?

A cybersecurity incident response plan is a predetermined team, process, and workflow for how a company will respond to a cyber attack.

In the field of cybersecurity, data breaches are considered inevitable. It’s not a matter of if, but when. When a data breach happens, it’s important to have a plan in place for how to deal with it — both from a technological perspective and from a customer relations and public relations point of view. The plan for such an event is known as an incident response plan, and it’s an important part of every cybersecurity model.

Why should organizations have an Incident Response Plan?

Some compliance frameworks, like the NIST framework, require an incident response plan. Further, some regulators, such as GDPR, have data breach reporting requirements, which an incident response plan is intended to expedite and support.

Incident response plans offer organizations the following benefits:

• Preparation for the future
• Timeliness of responses, and workflows for prioritization
• Streamlines communication across impacted personnel
• Exposes potential gaps in security
• Ensures that critical information is documented and shared across teams, and that lessons learned continue to adapt the plan over time

Additionally, the documentation and reporting following an incident can be important for legal and compliance needs.

What are the key components of an Incident Response Plan?

The first consideration in building an incident response plan is the people who are going to be responsible for following and implementing it. An incident response team might include incident managers, security analysts, threat researchers, as well as stakeholders in senior management, HR, PR, and senior security staff. Third parties, such as legal teams or law enforcement agencies may also be included. 

Once the team is established, a series of workflows, processes, and playbooks should be created to help the team triage and prioritize potential breaches. The plan should document clearly what to do and who to contact. This preparation phase should also include scenarios and exercises for a variety of different kinds of cyber attacks.

When a data breach occurs, having a comprehensive IT asset inventory for cybersecurity is critical to ensure that all at-risk devices, programs, and teams are isolated and contained quickly and efficiently. This helps the team investigate other possible areas where the compromise may have occurred, and increases the rate at which employees are able to get back to work. 

After the threat has been eliminated and patch management is in place, recovering normal services and communicating within the company — and with customers — is critical. 

The last step of a solid incident response plan is to review what happened, identify ways to prevent it from happening again, and to adapt the plan given new information. A mature incident response plan includes automated vulnerability scanning and proactive threat hunting.