Cyber security is one of the direst threats facing modern businesses today. Global cyber-crime damages were set to exceed six trillion dollars each year by 2021.
An incident response plan gives you the guidance you need to handle a cyber-attack, whether it is malware, ransomware, or a DDoS attack.
Step 1: Take stock of what is at stake
Perform an asset audit and put a quantifiable figure on each.
Step 2: Evaluate your risk potential
Take a hard look at the vulnerabilities your company faces. Phishing, faulty coding, unsecured Wi-Fi, unapproved hardware. The average hacker spends 200 days or more inside systems before being discovered.
Step 3: Build an action plan
Put policies in place. Playbooks should contain seven core steps:
- Prepare
- Detect
- Analyse
- Contain
- Eradicate
- Recover
- Post-Incident Handling
Step 4: Form an incident response team
- Incident Response Manager
- Security Analysts
- Threat Researchers
- IT Director
- Documentation Leader
Step 5: Get your workforce involved
A perfect plan means nothing if employees do not know about it. Dry runs are instrumental.
Originally published 1 December 2017. Migrated to the new IRC site in 2026.