A Cyber Incident Response Plan is a properly documented and executed plan consisting of six distinct sections.
The plan instructs a cyber incident response team within an organization to recognize and respond to security breaches, data breaches, or attacks with a fortified incident response framework.
To better understand the plan’s model, it’s important to note what a Cyber Incident Response Plan is while understanding the effective cyber incident response steps that meet regulatory standards.
What is a Cyber Incident Response Plan?
A Cyber Incident Response Plan contains six key phases, and each phase should address any suspected data breach.
A Cyber Incident Response Plan includes:
- Preparation – This ensures your employees are properly trained in their incident response roles and responsibilities. It develops incident response drill scenarios and conducts mock data breaches to test the security levels, making sure that all levels of the incident response plan are approved in advance.
- Identification – The organization identifies where security has been breached. Numerous questions should be answered, including when the breach happened, how and by whom was the breach discovered? How has it affected operations? And have any other business areas been affected?
- Containment – When a security breach has been discovered, the person who discovered it might immediately seek to delete all files. However, the person should not discard any vital evidence they may need later on when the breach started, and one should work out how to prevent it from happening again. In this stage, the breach has to be contained and short and long term strategies must be established to ensure breaches don’t happen again.
- Eradicate – Once the issue has been contained and passwords and login information have been changed to make sure a security breach does not happen again, systems should be updated.
- Recovery – This stage ensures that affected systems and devices are restored back to their initial settings. Proper tools are evaluated so that it will not happen again.
- Evaluation – In this final stage, team members come together to discuss everything that went wrong including the response to concerns. The security breach is analyzed and documented. Lessons are learned from both mock tests and real events to further strengthen any possible future attacks.
Cyber Incident Response Team
A successful cyber incident response team is composed of technical or IT professionals, management personnel, legal and communication experts.
The team will have various ownership roles within it, and each person will be assigned a distinct role and responsibilities.
When an organization develops a cyber incident response team, the following needs to be considered:
- Management
- Legal support
- Communications
- Technical lead
- Interface to the security team
- Security officers
The team should be ready at any point to identify or suspect a breach of data security.
The Cyber Incident Response team is responsible for:
- Developing proper and well thought through incident management activities
- Investigating the cause of incidents
- Retaining the necessary resources to perform incident management activities
- Managing digital documents and activities from the security incident
- Recommending counter measures and security controls
The size of the organization will determine whether all business areas in this list need to exist. It is necessary to identify people who are knowledgeable and experienced in these areas, so when an incident does occur, there are no gaps in knowledge.
Overall, the most important process of a Cyber Incident Response Plan is that the team is able to respond to threats with an efficient and effective incident response framework.
Any investigation of a security breach has to be understood through its dimensions, scope, and how it is investigated. Moreover, one must also understand the legal framework of how evidence is collected, copies of evidence and supporting documentation.
In turn, it’s important to always document everything, whether written or recorded. This documentation can be stored in an online system where the whole team can access it, and the process can be implemented in a streamlined fashion.
Outsourcing Cyber Incident Response
Many organizations are not adequately equipped to develop in-depth cyber incident protection. There are companies that specialize in data protection and cyber incident response which organizations can utilize.
Read a case study on how UnitedLex leveraged technology and global teams to protect 13.8 TB from a cyber incident.
UnitedLex is a technology and legal services company committed to delivering full-scale Digital Legal Transformation. They provide cyber incident response services. The world’s most forward-thinking law departments rely on the company’s expertise in more than 25 global jurisdictions. Founded in 2006, the team includes 3,000 legal, engineering, and technology professionals with major operations in 18 countries. For more information, contact us.
