What is an Incident Response?

What is an Incident Response?

After a bank heist, the work begins with specialized teams and plans engaged, allowing for analysis of the event, and from this analysis, the bank can prepare a response to the incident. The incident response may include stricter entry protocols, additional guards inside or around the building, or the installation of metal detectors, ID scanners, and panes of bulletproof glass surrounding the tellers. As a consequence of the heist, those in command of the bank’s security can use the information they learned—from and following the incident—to increase and better protect the organization.

The cybersecurity world also has these events, though typically conducted via external and internal cyber threats rather than walking into a business with a weapon. What happens before, during, and after these security incidents can make or break an organization, especially if the assailants got away with consumer data, potentially ruining the lives of their victims while ruining the reputation of the victimized entity. When properly planned, an “incident response” will help mitigate the damage of these potential cyber attacks—and help experts predict, respond, and defend their organizations.

What are Cyber Incidents, and How Do They Relate to Incident Responses?

A bank heist, like a cyber assault, is considered a security event. It is a premeditated attack by an individual (or a group) on a target institution (or organization). In the case of the heist, this assault could mean physical weapons and exit planning; however, in the case of a cyber incident, an attack can take various forms, including:

• Malware Events: When cybercriminals use an infected link or attachment to gain access to an organization’s network, typically through a virus or Trojan horse.
•  Social Engineering Attacks: When malicious actors abuse emotional and societal obligations to obtain information such as permission access.
• Denial-of-Service Incidents: When assailants flood their targets’ networks, they can cause mass service disruptions. These events usually include the abuse of botnets.
• Insider Threats: When cybercriminals need a way in, insider threats like purchasable employees and compromised accounts are high on an assailant’s list.
• Supply and Vendor Chain Attacks: When a malicious actor discovers a side-door or zero-day vulnerability, a data breach involving data exfiltration is imminent.
• Brute Force Events: When assailants have the resources to launch a disruptive attack, they could face the challenge directly, abusing any vulnerable entryway.
• Advanced, Persistent Threats (APTs): When cybercriminals have time and patience, they might use these resources to obtain off-radar access to the target network.

The vast variety of potential attacks can overwhelm an unprepared organization. However, properly planning for these potential events mitigates and often entirely dissolves these possibilities. In other words, the attack vectors listed above are categories of potential cyber incidents. Further, with a properly made incident response, organizations can mitigate the consequences of these and other cyber assaults while learning about their direct threats, bulking their defenses, and preparing for the future.

How Incident Response Differs from Other Emergency Planning

Incident Response vs Business Continuity & Disaster Recovery

Incident response, business continuity, and disaster recovery work together to protect organizations’ data; without one, the other two could not entirely defend a business’ valuable data, much less protect their clients and reputation.

Where business continuity is concerned, the goal is to ensure critical business functions and operations during a disruption or emergency. Those on this team work to identify a company’s essential aspects and develop continuity strategies. In comparison, disaster recovery plans work to restore internal systems and infrastructure after an event. Data backups, recovery, and IT restoration are the main priorities of these teams; consequently, they oversee regular data backups and testing schedules.

Incident response differs from business continuity and disaster recovery in many ways, although the responsibilities of all three groups have overlaps. Incident response involves identifying threats, containing and dispelling them, and the recovery process. In other words, business continuity cares for the business during an incident, disaster recovery cares for the business after an event, and incident management response is the immediate physical (or technological) response to the situation. Further, incident response includes regular testing and plan alteration, helping organizations build a structured, predictable approach to incidents.

The Specialized Teams that Oversee Incident Response

While some organizations may rely on a single group for their continuity plans, specialized professionals can distinguish between a complete response with damage mitigation and a partial response with significant losses. Incident response teams come in many varieties, each with varied responsibilities unique to their client or organization.

These teams aim to prepare and prevent security incidents. They test, update, and alter their plans following new threats and available tech patches, prepare tabletop exercises, analyze program initiatives, and conduct follow-up evaluations after an event. During an incident, they identify security vulnerabilities, contain and quarantine threats, and use predetermined tools to dispel threats from their environment.

Incident Response Planning and Essential Aspects

Many organizations utilize a predetermined incident response plan template. These plans contain everything an employee or security expert needs to respond to an incident or threat. Additionally, because most response plans have similar structures, organizations can create one even without an expert.

An incident response plan always starts with a plan overview; this section describes the exact scenario in which someone might implement the plan. If the plan is a holistic response to any threat, the document states it within this section. An overview would specify any particulars, such as when the plan would go into action when facing malware, DDoS, brute force, or any other threat. Moreover, while the threats and organizations may differ, the overview is consistent within any complete incident response plan. After the overview, the real fun starts.

Preparation and Prevention Planning

When establishing an incident response policy, there must be enough information for the responding technician to assess strategy, communication, access controls, tools, and documentation to determine the response team members. Moreover, these sections are the most significant portions, as they list who is responsible for what parts of the incident management response.

Incident response plans always include a list of roles and responsibilities for people and teams involved in the procedure; this section can include three or four people or multiple teams, depending on the organization. For example, roles on this list may include:

• Response teams: usually in-house cyber defense professionals and agents
• Executives: most commonly board members, including any CSO/CISO sponsors
• Stakeholders: may consist of other departments like legal or HR representatives
• Communications teams: includes PR representatives for press and Q&A responses
• Third parties: can include partners, vendors, consultants, legal reps, or security

Some incident response plans also include a list of incidents awaiting action. Depending on the organization and its threats, this list may be long. Further, because cyber threats are usually multi-day incidents, some companies may have multiple high-priority events listed in this section. Often, this list includes a type classification of the event, a description of the incident as known, a brief timeline or incident date range, and other essential at-a-glance information.

Lastly, these preliminary sections may include the state of infrastructure and security controls. These network statuses are significant for organizations with broad reach—like multiple branches or satellite offices. Security controls are vital for launching countermeasures for physical, technical, and administrative threats. Where cybersecurity is concerned, these security controls may include data encryption, firewalls, penetration and  intrusion detection systems, and authentication mechanisms.

Detection, Investigation, and Analysis

Following the preliminary sections of the plan, many organizations include a section specifically regarding the monitoring, detecting, evaluating, and triaging of security incidents. The responsibilities of this section are twofold.

On the one hand, the section offers a way for IT staffers to gather data about their systems and allows them to present it in a way that provides information about potentially upcoming incident events.

On the other hand, this section also offers a quick-review path for defense professionals; by having this section, they can efficiently review the facts, determine the possible scope of an attack, and begin mitigation procedures earlier, which reduces costs and damages.

Containment Procedures and Approach to Threat

If an attack happens, this section is vital for the organization to stop the incident management and regain any lost controls or resources; it must be followed during a cyber attack, especially if the victim presumably wants to press charges against the assailants. When enacted, the plan should allow officials to regain control while preventing the destruction of prosecutable evidence—these procedures usually come in two steps, not including restoring any system backups.

The first of these steps is short-term containment, where officials isolate the potential threat by cutting off access gates or temporarily bringing down the entire network. After this phase, a long-term containment begins, where specified access controls apply to unaffected systems. During this time, patches and resources gather, allowing the organization to begin readying additional tools for recovery phases.

Eradication of Incident Response Process and Threat Response

Once the threat is neutralized (short-term containment), eradication and vulnerability identification can start; this incident response process is one of the most detailed sections within an incident response plan. The section may outline removing the threat and restoring impacted systems, often involving “cleaning” the systems.

Depending on the type of attack, the incident response process might mean scrubbing malicious infections away, resetting the passwords of an entire network, or shutting off connections between an operating system and any affiliates, like vendors or clients. This section should also outline any additional actions the organization must take before beginning recovery operations; these actions may include a manual review of data, a scope impact report, and complete records of accessed data.

Recovery of Operations and Mitigation

Incident response plans also typically include recovery and mitigation tactics for employees and teams to follow after an event; this section determines how to restore operations, test those operations for further vulnerabilities, mitigate those possibilities, and utilize specific tools for monitoring and testing system behaviors. These tools commonly include endpoint behaviors and responses, forensic analysis reports, data backups, and vulnerability detectors.

Additionally, some organizations may have a section of their response document dedicated to regulator breach notifications. Many industries must notify regulators, like the state attorney generals, when a significant breach occurs; however, notifications are highly nuanced. Notification may be required based on an impacted consumer’s location (like Maine), or it might come from the geolocation of an organization (like Texas). Other states and organizations may be entirely self-regulated, making this section of an incident response plan necessary to avoid additional monetary and reputation losses.

Post-Incident Review, Lessons Drawn, Follow-Up Tasks

The final sections of an incident plan are directives for the future. A post-incident review, lessons, future tasks, testing schedules, and any ongoing alterations should be available on these pages. Where post-incident reviews and lessons are concerned, a holistic review of the event can help to prepare an organization for similar future attacks; this report can also act as vital training materials for new team members or as benchmarks for other incidents. Additionally, these pages may contain questions about the qualities of future events. These questions may include:

• Budgeting aspects: Would the organization go under if a similar event happened again? Could a specialized team or additional members be hired to defend the organization?
• Expert knowledge: Are the current people overseeing the incident response completing their tasks above expectations? Might someone else do it better?
• Staffing schedules: If a future event happens, would a part-time staff member know what to do? Is it safer to hire full-time members for complete security coverage? Is it necessary for these team members to be on-site, or can they do the work remotely?

These are all subjects that an incident response might include, although organization-specific questions are also necessary. To that end, some incident responses include follow-up tasks and plan testing; these are vital to the document because, without further testing, the knowledge obtained from the incident would go unapplied and, thus, go to waste. Lastly, incident responses usually contain ongoing alterations or amendments to the plan. As a back matter, this section can be long, especially if the overseeing experts keep their systems and documentation up to date.

Incident response plans are essential documents for every organization. They can vary in scope, attention, subject, industry, and responsibility; however, they are a keystone in how organizations respond to the threats they face physically and online. When these plans are customized by experts and implemented with the correct tools, they can mitigate and prevent many system and company threats. Even more importantly, they can help to keep the data of consumers and networks concealed, which promotes and protects the overall health of those companies who use them.