The Cynet 360 platform is the world’s fastest IR tool and includes automated attack detection and remediationLearn More
Incident response is an organizational process that allows an organization to respond to cyberattacks. The incident response process includes identifying an attack, understanding its severity and prioritizing it, investigating and mitigating the attack, restoring operations, and taking action to ensure it won’t recur.
An incident response plan (IRP) is a set of documented procedures detailing the steps that should be taken in each phase of incident response. It should include guidelines for roles and responsibilities, communication plans, and standardized response protocols.
In this article, you will learn:
A successful incident response plan aims to identify attacks and deal with them as effectively and as early as possible. The objective of an incident response plan is to bring the following to a minimum:
A strong incident response process can dramatically reduce the damage caused to an organization when disaster strikes. An incident response plan helps codify and distribute the incident response plan across the organization.
It’s not just about having a good plan—it’s about all relevant stakeholders knowing and agreeing to the plan, and being ready to coordinate efforts around that plan when an attack occurs. These stakeholders typically include security teams, operations, legal, and executive management, but may include others such as development teams, PR, partners and customers.
Here are the main reasons you must have a strong incident response plan in place:
To execute an incident response plan, you need an incident response team. The following are essential roles within the team—in a large organization the roles may be carried out by full-time employees or entire teams; in smaller organizations, they can be filled by employees with other duties who have a part-time responsibility for incident response.
When creating your incident response plan, it is useful to follow existing incident response frameworks from leading research institutions. There are two commonly used frameworks:
The table below summarizes the incident response steps recommended by each framework.
|SANS Incident Response Steps||NIST Incident Response Steps|
Create a security policy, perform a risk assessment, identify sensitive assets, and build the incident response team.
Compile a list of IT assets, identifying critical assets, set up monitoring, define types of security events, and create incident response steps for each type.
Monitor IT systems, detect anomalies, identify actual security incidents and investigate them to establish type and severity.
|2. Detection and Analysis|
Collect data from IT systems, security tools, and external sources, identify precursors (signs of impending incidents) and indicators (signs of an actual attack), and analyze them to identify incidents.
Perform short-term containment to prevent the threat from spreading, then perform long-term containment, including temporary fixes and rebuilding clean systems.
|3. Containment, Eradication, and Recovery|
The containment strategy depends on the level of damage, the need for continuous access to affected systems, and the time needed to implement a solution.
After the incident is contained, remove all threat elements from the environment, restore systems and recover normal operations, while ensuring the same assets are not attacked again.
Clean malware, identify root cause of the attack, and take action to prevent similar attacks in the future.
Bring production systems back online, taking measures to prevent additional attacks. Test, verify and monitor systems as they recover.
|6. Lessons learned|
No later than two weeks from the end of the incident, perform a retrospective, prepare complete documentation, evaluate containment efforts and see if anything in the process should be improved.
|4. Post-Incident Activity|
Learn from previous incidents to improve the incident response process. Use your findings to adjust incident response policies, plans, and procedures, and feed the preparation stage for future incidents.
Learn more about each incident response framework in our detailed guides:
One more thing that can save you time as you prepare an incident response plan is to use ready-made templates shared by other organizations. You can adapt these templates to your specific needs.
The following templates can help you get a head start on your incident response plan:
(*) Website requires registration
Learn more in our detailed guide to incident response plan templates
When building an incident response plan, it is useful to see examples of real plans created by other organizations which have been fine-tuned over time based on their experience. See the following examples of incident response plans by leading organizations:
|Organization||Example Plan Includes||Link to Example|
|U.S. Department of Homeland Security||Roles and responsibilities, core incident response capabilities, coordinating structures||https://us-cert.cisa.gov/sites/default/files/ncirp/National_Cyber_Incident_Response_Plan.pdf|
|Carnegie Mellon University||Definitions of incidents, roles and responsibilities, incident response phases, insider threat guidelines||https://www.cmu.edu/iso/governance/procedures/docs/incidentresponseplan1.0.pdf|
|University at Buffalo||Incident response contact information, incident classification and impact, reporting and notifications||http://www.buffalo.edu/ubit/policies/guidance-documents/incident-response-plan.html|
|Write State University||Incident response steps, security tools, checklist upon detection of intrusion||https://www.wright.edu/information-technology/policies/incident-response-plan|
|University of Oklahoma Health Sciences Center||PCI DSS incident response plan including roles and responsibilities, incident response phases, detailed workflow diagram||https://it.ouhsc.edu/policies/documents/infosecurity/PCI%20DSS%20Security%20Incident%20Response%20Plan%20Final.pdf|
Create a simple, well-defined process
An incident response plan, even if it is very well thought out, must be simple and crystal clear to be effective. Keep details, procedures and explanations to a minimum, to ensure that staff can very easily follow the plan in the urgency and confusion of a real security incident.
Create a communication strategy
Clarify who needs to be informed of a security breach, which communication channels should be used and what level of detail should be provided. There should be clear guidelines on how to inform operations, senior management, affected parties inside and outside the organization, law enforcement, and the press. This is a commonly overlooked part of the incident response process.
Use an incident response plan template
Don’t reinvent the wheel. Always start your incident response plan from a template created by others in the industry, and adapt it to your specific needs. For example, you can start from this template provided by TechTarget which includes incident scope, planning scenarios, logical sequence of events for incident response, team roles, notification and escalation procedures.
Put your incident response plan to the test
Conduct realistic drills and exercises to see how the incident response plan is carried out in practice, and be ready to adapt the plan according to lessons learned. Test your tools to ensure they are able to detect an attack as early as possible in the kill chain, and ensure the team can identify a threat and contain it before sensitive data leaves your network.
Use a centralized approach
Organizations should not be logging into multiple tools and correlating information between them during the urgency of an attack. Processes and tooling should support a centralized incident response process where an analyst can view all the information about an incident in one place.
Put incident response technology in place
Incident response tools\technology provides you with the means to eradicate discovered malicious presence and activity from your environment as well as optimize response workflows by automating repetitive tasks. They can:
Cynet 360 is an integrated security platform that can provide all of the above across endpoints, files, users and networks. It gives security teams full context about security incidents, helping them understand what is happening and take effective action, without needing to consult multiple tools.
Cynet also helps you take remote manual action to contain security incidents, including stopping malicious processes, deleting files, resetting passwords and restarting affected devices. It can also perform automatic containment actions such as stopping rapid encryption of files or automatically isolating endpoints infected by malware from the network.
Learn more about Cynet 360.
Cynet provides an outsourced incident response team that can provide anyone, from small to medium and large organizations, with professional security staff who can execute a fast, effective incident response process.
Our team can deploy the Cynet security platform in a matter of minutes across hundreds to thousands of endpoints. They can then scan, analyse, identify and remediate threats before damage is done. The Cynet incident response team can help with:
Contact us for immediate help
For emergency assistance from our security experts, call us at US 1-(347)-474-0048, International +44-203-290-9051, or complete the form below.
For emergency assistance from our security experts, call us at US 1-(347)-474-0048, International +44-203-290-9051, or complete the form. We will respond shortly