We hear about cyber security attacks in the news all the time. We know they exist in our daily lives and some people fear them. How dangerous are they actually?
More than half of organisations lack the capability to gather data from across their own environment or coordinate centralised alerts to the business about suspicious activity. Recent studies show that 45 percent of organisations have no incident response plan in place at all.
When a breach or severe incident occurs, businesses need an IR plan ready. The numbers show that a small portion of organisations have one and a tiny fraction have actually tested it. So how does an organisation test an incident response plan? Treat it like a fire drill.
Immediately after
Speed and precision. Take a look at what you can find about the adversary's behaviours and applicable countermeasures. Acting quickly will limit further damage.
Plan, then act. See what information and files are exfiltrated and search for indicators of compromise across host and network traffic. Plan accordingly and choose wisely.
Isolate unaffected networks and systems. No need to shut off everything, but identify where the adversary is and is not, and contain assets from impacted networks or hosts.
Short term
Record actions. Monitor and track how you defend yourself, what produced positive results, what did not. This is critical for remediation.
Retain an expert. If you do not have the required skills in-house, hire external specialists to augment your response and remediation. Run breach readiness and tabletop exercises with advanced incident response consultants.
Long term
Identify, remediate and assess vulnerabilities. After the immediate threat is neutralised, recovery must begin as part of a well-orchestrated response. The vulnerabilities exploited by the threat actor must be identified and remediated. Update people, processes and technology to avoid repeat occurrences.
Deploy network and endpoint monitoring. Help your team more efficiently detect and investigate current and future threat events. Continuous monitoring and active response across IT and networking environments.
Brief and review the IR plan. Analyse tabletop results using intelligence from past experiences, current events and consultants. Collaborate with information-sharing groups and connect with other businesses that have mature IR teams.
Maintaining visibility and repeatable processes during a major security crisis is crucial to reducing losses. Do not let moments of high stress and careless mistakes destroy your brand.
Originally published 11 April 2017. Migrated to the new IRC site in 2026.