Data breaches and cyber attacks have become commonplace in the news. The average cost of a data breach is 3.62 million dollars. 43 percent of all cyber attacks are on small businesses, many of whom go under after a breach.
Organisations of all sizes need an incident management process in place before an event happens. Dealing with each event as it comes leaves you unable to handle a breach before it causes irreparable damage.
Developing a proper plan
Focus on specificity. A general plan with vague classification standards is less useful than granular guidance on what to do for malware, phishing, DDoS, SQL injection. This level of specificity makes it possible to develop individualised playbooks based on the type of threat. Develop playbooks for the most common threats first, then evaluate what is likely to become more prevalent: new mobile efforts, new payment methods, third-party integrations.
Keeping the plan updated
Develop is only the first step. A continuous commitment to test, measure and refine each playbook is what makes it work. A full-scale drill for a single threat may take a day or two. Done regularly, it gives the organisation invaluable knowledge about how to deal with an attack.
Track KPIs: response time, number and types of departments affected, tools used. Keep structural information current: roles, third-party contact lists, DNS information, IP ranges, host names.
The proactive approach
Develop a meticulous plan, test it regularly, update it over time. You will be more prepared to handle any cyber threat quickly, effectively and proactively.
Originally published 22 September 2017. Migrated to the new IRC site in 2026.