Every organization should have a cybersecurity incident response plan. In the event of an attack, an incident response plan represents the organization’s best chance of securing their systems and recovering from the attack. It provides a concise roadmap for how organizations should respond to attacks, and should be regularly updated in light of the latest threat intelligence.

A cybersecurity incident response plan contains six key phases:

1. Preparation
2. Detection and Analysis
3. Containment
4. Eradication
5. Recovery
6. Follow Up

By following these steps, cybersecurity professionals can effectively diagnose, contain, and respond to attacks, protecting their organization against bad actors. In this article, we’ll discuss the role of a cybersecurity incident response plan, explore the six key phases, and share guidance to help you implement a cybersecurity incident response plan in your own organization. 

What is a Cybersecurity Incident Response Plan and Why Do You Need One?

A cybersecurity incident response plan is a comprehensive written plan that outlines a series of actions that cybersecurity teams should pursue in the event of a security incident. The actions are grouped into six key stages, and cover everything from the steps required to prepare for cyber attacks, to how organizations should review their incident response in the aftermath of an attack. 

The majority of elements of these plans are grounded in software solutions, but it’s also important to include more human elements, like how the organization should communicate with customers and partners following an attack. 

These plans are crucial in providing guidelines for how an organization should act after it has been compromised. Without a plan, any actions will likely be unorganized, uncoordinated, and ineffective. A misguided response could result in lasting damage to the organization, with the possibility of millions of dollars in losses and a huge impact to the organization’s reputation. 

Investing in measures like security awareness training or Microsoft 365 security to prevent as many attacks as possible is important, but despite this, every organization should assume that it’s likely to fall victim to an attack at some point. No matter how sophisticated the security infrastructure, there’s always the chance that attackers will deploy novel attack vectors and gain access to an organization’s internal networks. 

In the event of any breach, an incident response plan ensures that organizations can take a measured, effective approach to resolving the incident. It’s clear that investing in developing and maintaining a cybersecurity incident response plan is crucial. 

With that in mind, let’s explore the six key phases that make up a comprehensive incident response framework. 

1. Preparation

As with many plans, the first step involves preparation. The old adage ‘failure to prepare is preparing to fail’ certainly rings true when it comes to cybersecurity incident response. This phase is arguably the most important phase of any incident response plan, defining the roles and responsibilities of various stakeholders and outlining the security policies that underpin any incident response strategy. It’s also important to ensure that these align with the security technologies the organization uses.

There are various key elements that should be covered during the preparation phase. These include:

• Chain of Command – identify the command structure in the event of a cyber attack. Define how the IT team will interact with organizational leadership, and assign decision-making responsibilities to key individuals. 

• Resource Planning – define the required resources to effectively respond to an attack, and make sure provisions for obtaining these are in place. This may include getting sign off on budget, compiling a list of preferred vendors, and ensuring all the required security technologies are installed. 

• Workflow Mapping – establish the steps that should be taken in the immediate aftermath of an attack being discovered. Identify the individuals that should be alerted, the steps that should be taken immediately, and when and how the organization should engage with external partners.

• Employee Training – mandate that employees undergo regular cybersecurity awareness training. This ensures employees know how to react in the event of an attack. Training can also teach employees how to spot the signs of an attack and escalate this to appropriate individuals. 

• Identify Highly Sensitive Information – it’s likely that your organization has highly privileged information that should be protected at all costs. Make sure that the cybersecurity team is aware of the location and value of this information and can effectively protect it. 

• Vulnerability Analysis – engage with an external vendor to understand any current vulnerabilities within your organization’s IT infrastructure. By performing a vulnerability assessment, you can address these issues before they are exploited by attackers. 

It’s often the case that cybersecurity teams will run mock breaches in order to determine the efficacy of their preparations for an attack. This is a helpful way for organizations to identify gaps in their current approach and make sure that when an attack does occur, they’re as prepared as possible. 

2. Detection and Analysis

In this phase, the onus is on organizations to identify any security breaches as early as possible. Breaches could occur in many different areas, and it’s important that security teams have the ability to monitor, identify, and report on security incidents all across their systems. 

Once an attack has been discovered, organizations should gather as much data and information as possible. Data might include snippets of code, forensic evidence, or other artefacts that are crucial evidence in analyzing the severity and scope of any attack. 

Technology plays a vital role in enabling organizations to effectively diagnose and analyze security incidents. At Tech Heads, we’ve partnered with Arctic Wolf, a leading Security Operations Center, to provide Managed Detection and Response services. 

3. Containment

Once an attack has been discovered and analysed, the next step is to contain the attack before it spreads to other systems. Resist the temptation to delete all signs of an attack – this is important evidence that can be used to understand the cause of the attack and prevent future occurrences. 

Having both short and long-term containment plans is important here. In the immediate aftermath, the best step is often to disconnect the affected systems from the internet while you determine how to eradicate the cause and symptoms of the attack. To ensure business continuity, make sure you have a backup system you can deploy to keep things running smoothly.  

During this phase, it’s also worth strengthening existing security protocols. Update access credentials for key systems, encourage employees to change their passwords, and ensure that recent security updates and patches have been applied.

4. Eradication

After the issue has been diagnosed, it’s time to eradicate all aspects of the attack from your systems. This process usually involves determining the root cause of the attack and eliminating it by improving security controls. Security teams should be as thorough as possible – if any element of malware is left in the system, the effects of the attack could be ongoing. In this instance, the organization could face legal liabilities for failing to completely address the attack. 

Following this, the security team should update affected software, apply any patches, and harden their overall security posture. It’s important to do this quickly to ensure the impact of the breach is limited. 

5. Recovery

When the root cause and all traces of the attack have been eliminated, the next step is to restore all affected systems back to their pre-security incident status. But it’s important to rigorously test all of your systems before pushing them back online. 

Verify that the steps you have taken to eradicate the issue have been successful, testing every system for availability, performance, and security in a controlled, closed environment. Continue to monitor the systems on an ongoing basis, and identify and implement additional security measures that will help prevent a repeat of the breach. 

6. Follow Up

Once the attack has been addressed and all affected systems are back online, it’s critical that the security team takes the time to review the incident together. Compile an incident response report that analyzes the response and identifies opportunities for improvement in the response strategy for future attacks. 

This step is important as it enables the entire security team to learn from the attack, and refine their cybersecurity incident response plan to be more effective in the future. Focus on candidly discussing the response, and identify ways that the organization can better prepare for the next attack. 

Partner with Tech Heads on Your Cybersecurity Incident Response Plan

Responding to a cybersecurity incident can be a stressful time, particularly for under-resourced IT teams at small and medium sized businesses (SMBs). That’s why it’s so important to have a comprehensive plan compiled by experienced cybersecurity professionals. 

Tech Heads has all the skills and experience necessary to help your organization develop a cybersecurity incident response plan. Our ThInc. Patrol^TM, provided in partnership with Arctic Wolf, offers Security Operations Center as a Service – an intelligent, responsive monitoring solution built for SMBs like yours. 

To learn more, schedule a demonstration today.