InfoSec professionals are building systems and adopting tools to help safeguard against ransomware, malware and phishing attacks. Firms are also building an incident response plan that an incident will occur and the plan will guide them out of danger.
Incident response definition
An incident response plan is prepared by an organization on how to responds to a cyber attack or a data breach. It aims to reduce the potential damage of a breach.
Incident response is an approach used in an organization to address and manage a data breach or cyberattacks. It is also called IT incident, computer incident or security incident. It helps in reducing the recovery time and cost by limiting the damage.
How to create an incident response plan
An incident response plan can help you to overcome the damage on time and improves future security efforts. Here is how an incident response plan should be prepared.
Assign clear responsibilities
An incident response plan should be started with assigning roles, assign who will oversee the development of the plan. Gather inputs and assigns roles accordingly. Select who will work in the security incident response team. The team will be responsible for detection, classification, notification, analysis, containment, eradication, documentation, and post-incident activity.
Define your risk tolerance
After assign tasks, you need to define your risk tolerance. Identify your critical data, key functionality the company requires and then prioritize the efforts. Seek the help of the stakeholders during identifying the risks.
Classify events
The third step is incident classification and it is done after defining roles and risks. Develop an incident and classify it so that you better know what action to take. Classified risk helps to prioritize the events. Documented incidents also help during audit and investigation.
Set explicit instructions
After classifying the incidents, you can now divide the role to each person and clarifies their duties. The report should include everything from fixed time scales for an investigation to steps needed for remediating the problems. It will help in avoiding bad decisions.
It should include what actions the SIRT must take when an incident is uncovered. The SIRT will be responsible to investigate and analyze the potential scope. Do not delete any data during the investigation.
Prioritize eradication and recovery
The critical data that enables your business should be fully backed up. For the right eradication and recovery, you need to perform triage. It is vital to learn from an incident and avoid such mistakes in the future.
