With every passing year, cybercrime incidents are increasing across the world. The ever-growing frequency and scale of cyberattacks paint an alarming picture. There are several factors to explain this rising trend, to highlight a few key reasons: Hackers are using increasingly sophisticated tools and techniques, more dangerous cyber threats are emerging every day, and organizations are not implementing adequate cybersecurity measures.

In an age where digital technologies empower modern businesses at every level, enterprise cybersecurity is a critical need. With growing awareness and stringent regulations, organizations across the world are taking several measures to safeguard their data and infrastructure. Yet, no cybersecurity program is entirely invulnerable. That’s why an incident response plan is so crucial and the benefits of an incident response plan need to be explored.

WHAT IS CYBER SECURITY

Computer security, cybersecurity, or information technology security is the protection of computer systems and networks from information disclosure, theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide. 

Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It’s also known as information technology security or electronic information security. The term applies in a variety of contexts, from business to mobile computing, and can be divided into a few common categories.

·         Network security is the practice of securing a computer network from intruders, whether targeted attackers or opportunistic malware.

·         Application security focuses on keeping software and devices free of threats. A compromised application could provide access to the data its designed to protect. Successful security begins in the design stage, well before a program or device is deployed.

·         Information security protects the integrity and privacy of data, both in storage and in transit.

·         Operational security includes the processes and decisions for handling and protecting data assets. The permissions users have when accessing a network and the procedures that determine how and where data may be stored or shared all fall under this umbrella.

·         Disaster recovery and business continuity define how an organization responds to a cyber-security incident or any other event that causes the loss of operations or data. Disaster recovery policies dictate how the organization restores its operations and information to return to the same operating capacity as before the event. Business continuity is the plan the organization falls back on while trying to operate without certain resources.

·         End-user education addresses the most unpredictable cyber-security factor: people. Anyone can accidentally introduce a virus to an otherwise secure system by failing to follow good security practices. Teaching users to delete suspicious email attachments, not plug in unidentified USB drives, and various other important lessons is vital for the security of any organization.

Types of cyber threats

The threats countered by cyber-security are three-fold:

1. Cybercrime includes single actors or groups targeting systems for financial gain or to cause disruption.

2. Cyber-attack often involves politically motivated information gathering.

3. Cyberterrorism is intended to undermine electronic systems to cause panic or fear.

So, how do malicious actors gain control of computer systems? Here are some common methods used to threaten cyber-security:

Malware

Malware means malicious software. One of the most common cyber threats, malware is software that a cybercriminal or hacker has created to disrupt or damage a legitimate user’s computer. Often spread via an unsolicited email attachment or legitimate-looking download, malware may be used by cybercriminals to make money or in politically motivated cyber-attacks.

There are a number of different types of malware, including:

·        Virus: A self-replicating program that attaches itself to clean file and spreads throughout a computer system, infecting files with malicious code.

·        Trojans: A type of malware that is disguised as legitimate software. Cybercriminals trick users into uploading Trojans onto their computer where they cause damage or collect data.

·        Spyware: A program that secretly records what a user does, so that cybercriminals can make use of this information. For example, spyware could capture credit card details.

·        Ransomware: Malware which locks down a user’s files and data, with the threat of erasing it unless a ransom is paid.

·        Adware: Advertising software which can be used to spread malware.

·        Botnets: Networks of malware infected computers which cybercriminals use to perform tasks online without the user’s permission.

SQL injection

An SQL (structured language query) injection is a type of cyber-attack used to take control of and steal data from a database. Cybercriminals exploit vulnerabilities in data-driven applications to insert malicious code into a databased via a malicious SQL statement. This gives them access to the sensitive information contained in the database.

Phishing

Phishing is when cybercriminals target victims with emails that appear to be from a legitimate company asking for sensitive information. Phishing attacks are often used to dupe people into handing over credit card data and other personal information.

Man-in-the-middle attack

A man-in-the-middle attack is a type of cyber threat where a cybercriminal intercepts communication between two individuals in order to steal data. For example, on an unsecure WiFi network, an attacker could intercept data being passed from the victim’s device and the network.

Denial-of-service attack

A denial-of-service attack is where cybercriminals prevent a computer system from fulfilling legitimate requests by overwhelming the networks and servers with traffic. This renders the system unusable, preventing an organization from carrying out vital functions.

What is a Security Incident Response Plan and Why You Need One?

A cybersecurity incident response plan (or IR plan) is a set of instructions designed to help companies prepare for, detect, respond to, and recover from network security incidents. Most IR plans are technology-centric and address issues like malware detection, data theft and service outages. However, any significant cyber attack can affect an organization across functions in multiple ways, so the plan should also encompass areas such as HR, finance, customer service, employee communications, legal, insurance, public relations, regulators, suppliers, partners, local authorities and other outside entities.

There are industry standard incident response frameworks from organizations such as NIST and SANS that provide general guidelines on how to respond to an active incident. Your organization’s IR plan, however, should be much more specific and actionable—detailing who should do what, and when. We’ve put together a checklist to outline the key components of a cyber IR plan to help you build the right type of guide for your own organization.

In either case — whether leveraging an incident response plan template or your own homegrown IR Plan — the goals remain the same: minimize damage, protect your data, and to help your organization recover from the incident as quickly as possible.

How to Get Started: Creating an Incident Response Plan

Any organization with digital assets (computers, servers, cloud workloads, data, etc.) has the potential to experience a cyber attack or data breach. Unfortunately, most organizations don’t realize they’ve experienced a data breach until it’s too late. Creating a cybersecurity incident response plan helps you prepare for the inevitable and equip your IT security team to respond before, during, and after a cyber attack. While this blog post won’t go into the depth and detail you need in a true incident response plan, it will help you understand key factors and considerations at each stage of the incident response process: preparation, detection, response, recovery, and post-incident follow-up.

Ideally, your security incident response plan should be leveraged on an ongoing basis — a living document — driving recurring detection and response activities (threat hunting, cyber incident investigations, incident response, and remediation/recovery). By performing ongoing detection and incident response activities, you can improve IT and security hygiene and better protect your organization from unknown threats, hidden attackers, and potentially prevent a data breach.

For the purpose of this blog, we’ve split the incident response planning process into five phases: Preparation, Detection, Response, Recovery, and Follow up.

Preparation

Preparation is the first phase of incident response planning and arguably the most crucial in protecting your business and digital assets. During the preparation stage you’ll document, outline, and explain your IR team’s roles and responsibilities, including establishing the underlying security policy which will guide the development of your IR plan.

• Determine the exact location, sensitivity and relative value of all information in your organization that needs to be protected.
• Gauge whether you currently have sufficient IT resources to respond to an attack or whether third-party support would be required.
• Gain executive buy-in so the plan has full approval from the top of the organization.
• Assign roles and responsibilities for all relevant stakeholders, including IT, HR, internal communications, customer support, legal, PR and advisors. 
• Establish a chain of command that includes both IT and corporate leaders. Who is the incident commander? Who launches the incident response plan? Who has “stop work” authority, such as the emergency shut down of company websites?
• Map the incident response workflow among different stakeholders. When is HR involved? When is legal involved? When is the media alerted? When are outside authorities involved?
• Gather and update 24/7/365 contact information (email, text, VOIP, etc.) for all incident response team members, their backups, and managers. Establish alternative channels of communication if regular channels are compromised or unavailable.
• Identify cybersecurity regulatory requirements for the organization across all functions and develop guidance on how to interact with law enforcement and other governmental authorities in the event of an incident.
• Develop and maintain a list of preferred technology vendors for forensics, hardware replacement, and related services that might be needed before, during or after an incident.
• Establish procedures for IT teams to receive clear, actionable alerts of all detected malware. Specific explanations can help team members avoid dismissing the alert as a false positive.
• Store privileged credentials, including passwords and SSH keys, in a secure, centralized vault.
• Automatically rotate privileged credentials, isolate privileged account sessions for temporary employees, and regularly scan for orphan accounts of former employees that might still provide unauthorized access.
• Request employees to report suspicious emails and activities that might compromise network security.
• Ensure that you have a clean system ready to restore, perhaps involving a complete reimage of a system or a full restore from a clean backup.
• Establish a comprehensive and integrated communications plan to inform both internal and external audiences on incidents in a rapid, accurate and consistent fashion.

Detection & Analysis

The detection phase of security incident response and IR planning involves monitoring, detecting, alerting, and reporting on security events. This includes identifying known, unknown, and suspect threats—those that appear malicious in nature, but not enough data is available at the time of discovery to make a determination either way.

When a lead, threat, or security incident is detected, your incident response team should immediately (if not automatically with the help of cyber incident response software) collect and document additional info—forensic evidence, artifacts, and code samples—to determine the severity, type, and danger of the incident, and store that data for use in prosecuting the attacker(s) at a later point in time.

• Develop a proactive detection strategy based on tools that can automatically scan your physical and virtual hosts, systems, and servers for any vulnerable applications, identities, or accounts.
• Consider traditional solutions such as Endpoin detection and response Next-gen antivirus (NGAV) software, or User/Entity Behavior Analytics (UEBA/UBA) tools to detect malware.
• Also consider deep analysis and forensics-based capabilities that can assess the health of an endpoint by validating what is running in memory at a given point in time.
• Conduct compromise assessments to verify whether a network has been breached and quickly identify the presence of known or zero day malware and persistent threats active or dormant — that have evaded your existing cybersecurity defenses.

Response

Responding to security incidents can take several forms. Incident response actions may include triaging alerts from your endpoint security tools to determine which threats are real and/or the priority in which to address security incidents. Incident response activities can also include containing and neutralizing the threat(s)—isolating, shutting down, or otherwise “disconnecting” infected systems from your network to prevent the spread of the cyber attack. Additionally, incident response operations include eliminating the threat (malicious files, hidden backdoors, and artifacts) which led to the security incident.

• Immediately contain systems, networks, data stores and devices  to minimize the breadth of the incident and isolate it from causing wide-spread damage.
• Determine if any sensitive data has been stolen or corrupted and, if so, what the potential risk might be to your business.
• Eradicate infected files and, if necessary, replace hardware.
• Keep a comprehensive log of the incident and response, including the time, data, location and extent of damage from the attack. Was it internal, external, a system alert, or one of the methods described previously?  Who discovered it, and how was the incident reported? List all the sources and times that the incident has passed through. At which stage did the security team get involved?
• Preserve all the artifacts and details of the breach for further analysis of origin, impact, and intentions.
• Prepare and release public statements as soon as possible, describe as accurately as possible the nature of the breach, root causes, the extent of the attack, steps toward remediation, and an outline of future updates.
• Update any firewalls and network security to capture evidence that can be used later for forensics.
• Engage the legal team and examine compliance and risks to see if the incident impacts any regulations.
• Contact law enforcement if applicable since the incident may also impact other organizations. Additional intelligence on the incident may help eradicate, identify the scope, or assist with attribution. 

Recovery and Follow-up

Post-incident activities (Recovery and Follow-up actions) include eradication of the security risk, reviewing and reporting on what happened, updating your threat intelligence with new information about what’s good and what’s bad, updating your IR plan with lessons learned from the security incident, and certifying then re-certifying your environment is in fact clear of the threat(s) via a post-incidentcyber security compromise assessment or security and IT risk assessment.

Recovery

• Eradicate the security risk to ensure the attacker cannot regain access. This includes patching systems, closing network access and resetting passwords of compromised accounts.
• During the eradication step, create a root cause identification to help determine the attack path used so that security controls can be improved to prevent similar attacks in the future.
• Perform an enterprise-wide vulnerability analysis to determine whether any other vulnerabilities may exist.
• Restore the systems to pre-incident state. Check for data loss and verify that systems integrity, availability and confidentiality has been regained and that the business is back to normal operations.
• Continue to gather logs, memory dumps, audits, network traffic statistics and disk images. Without proper evidence gathering, digital forensics is limited so a follow-up investigation will not occur. 

Follow-up

• Complete an incident response report and include all areas of the business that were affected by the incident.
• Determine whether management was satisfied with the response and whether the organization needs to invest further in people, training or technology to help improve its security posture.
• Share lessons learned. What went well, what didn’t and how can procedures be improved in the future?
• Review, test and update the cybersecurity incident response plan on a regular basis, perhaps annually if possible.
• Conduct a compromise assessment or other security scans on a regular basis to ensure the health of systems, networks and devices.
• Update incident response plans after a department restructure or other major transition.
• Keep all stakeholders informed about the latest trends and new types of data breaches that are happening. Promote the message that “security is everyone’s job.”

Here are the top 5 benefits of an incident response plan:

Quicker mitigation

According to a report by IBM, the average time to identify and contain a data breach was 280 days.

An incident response plan contains a detailed plan of action on how to handle potential security incidents. For each particular scenario, this includes measures that have to be undertaken by employees, isolating affected areas, recovery systems to be put in place and so forth. These pre-planned steps will help an organization to minimize its response time to a large extent. A delayed response means that the malicious agent within an organization’s networks and systems has a more severe impact. The delayed response enables the agent to gather more sensitive data or infect more systems with malware, etc. If cyberattacks are not quickly and effectively dealt with, their potential – financial, legal and operational impact can worsen manifold.

A quick response time will also minimize operational downtime of the affected area. Be it networks, servers, or applications. Thus, organizations have a better understanding of their overall security.

Organized approach

Security incidents are nearly impossible to predict in advance. Despite being seemingly well-protected, any organization can be caught off-guard by unforeseen incidents. By proactively implementing an incident response plan, you have a clear, methodical plan of action to rely on in critical times.

A cyberattack may catch an organization off-guard but if your team is in a state of panic and ill-prepared to handle it, your organization may not be able to strike back and defend itself. An incident response plan helps mitigate the impact of an attack, remediate vulnerabilities, and secure the overall organization in a coordinated manner.

It also ensures that your organization can utilize manpower, tools and resources to efficiently tackle the issue and minimize its impact on other operations. An incident response plan not only reduces the response time but also the overall cost associated with it.

Strengthens overall security

The goal of an incident response plan is to enable an organization to have better incident response capability. In this due process, current measures, systems, weaknesses, and vulnerabilities are all analyzed. In addition, these factors and their potential impact on various security scenarios are considered. Thus, organizations have a better understanding of their overall security.

An incident response plan also accounts for the need for organizations to patch up exposed vulnerabilities and ensure that similar situations do not arise again. These steps create increased cybersecurity resilience for the organization and protect it from future threats.

Builds trust

Customers, partner companies and other stakeholders certainly prefer that an organization have an effective incident response plan in place. Proactive measures like these showcase that an organization has taken the effort to bolster its incident response capability.

Several of the Fortune 500 firms have been the victims of a cyberattack at one point or another. In such a challenging global cybersecurity landscape, an incident response plan goes a long way in helping instill confidence in an organization’s stakeholders.

Compliance

Sweeping regulations worldwide mean that companies have to undertake several measures to ensure compliance. Critical sectors such as the healthcare and financial industry face an even more stringent set of rules to ensure that sensitive data is well-protected.

General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), and the Healthcare Portability and Accountability Act (HIPAA) are examples of such regulations under which organizations need to have an incident response plan to ensure compliance.

Conclusion

The goal of our cyber incident response plan checklist is to help your IT security team develop an incident response plan that is comprehensive, coordinated, repeatable, and effective.

Please keep in mind that developing a cybersecurity IR plan is never a one-and-done exercise. Unfortunately, without regular incident response training and IR exercises, including live cyber attack scenarios, organizations and their IT security teams may find themselves suddenly outmaneuvered by hackers who pivot in their attack strategies/TTPs and their choice of malware.

What worked in the past might not work tomorrow. The right security incident response plan should be a living document that keeps pace with today’s rapidly evolving threat landscape.

Drop your comment