Preparing for a Security Incident

Written By: Vance Monical

The worst time to develop an Incident Response Plan for dealing with a security incident is during an actual incident. It’s not a matter of “if” but “when” your organization will be the victim of a cyber-attack. The difference between being prepared and flying by the seat of your pants could spell the difference between a minor inconvenience and being forced to close your doors.

Organizations should develop an Incident Response Plan to ensure it is prepared to handle operational and/or malicious events which may disrupt critical business processes and/or compromise the confidentiality, integrity, or availability of its data. A strong Incident Response Plan will include clearly defined roles and responsibilities, strategies for dealing with different scenarios, and a testing program.

Clearly defining roles and responsibilities starts with establishing a Cyber Incident Response Team. Members of this team should include representation from all key departments of the organization. The team is responsible for the management and logging of remediation and communication activities during an incident. After an incident is over, the team is responsible for performing post-incident reviews and retaining incident documentation.

Strategies for containment, remediation, and recovery should be developed based on a multitude of events and threats specific to your organization and/or industry. The detail of these step-by-step checklists should be proportionate to the severity level of the event in question. Performing regular IT Risk Assessments will assist with the process of identifying threats and potential attack vectors.

Once the plan is established, members of the Cyber Incident Response Team need to be trained and the plan should be tested at least annually. Both objectives can be completed by performing tabletop tests. These simulated security events provide an opportunity to convene the team to clarify roles in addition to discussing actions to be taken based on the nature of different scenarios. Results of tabletop tests should be used to identify and remediate gaps in your Incident Response Plan to enhance your readiness to deal with and recover from an actual event.

Bedel Security assists many of our clients with creating Incident Response Plans and facilitating tabletop tests. Drop us a line at support@bedelsecurity.com to learn more.