An incident response plan is a“set of instructions to help IT staff detect, respond to, and recover from network security incidents. These types of plans address issues like cybercrime, data loss, and service outages that threaten daily work.”
Generally, an Incident Response plan is created before any incidents occur. Although, most companies have taken a reactionary approach to Incident Response, looking into making one only after a breach has occurred.
Knowing what to do, how to do it, and where to look, at the onset of a cyberattack can spell the difference between mitigatable losses from business ending incidents. There’s also the thought of reputation loss after an attack, if it’s even made known, and a sense of vulnerability that will be hard to deal with in the long term. However, not all is lost. While not everyone has an incident response plan, any forethought into precautionary and reactionary steps to improve your cyber-posture will mitigate future attacks.
Like a “Hurricane Plan” for us Floridians, an Incident Response Plan can boil down to some essentials and best practices. This may be the case for the onset, I should stress, however, that you should consult a cybersecurity expert about your IRP (Incident Response Plan).
So, what should you include in your IRP? My simple answer is everything, within reason. Your network will never be 100 percent secure, so you should prepare both your cyber infrastructure and your employees for the storm to come. In addition to an incident response plan, you need a thorough disaster recovery plan that can mitigate the damage caused by a disaster. (Though that’s more for on-prem hardware near disaster prone areas, but could also include cyberattack).
What to include in your Incident Response Plan?
Points of failure in your network.
Just as you should always back up your data, you should always have a plan B for every critical aspect of your network. Stuff to include would be including employee role, software, and hardware redundancy. Points of failure, like their name implies, can expose your network when an incident occurs. Address them with redundancies or software failover features. Do the same with your staff. If a designated employee can’t react to an incident, name a second employee who can take over the responsibilities. By having backups and redundancies in place, you can keep incident response and operations in progress while limiting damage and disruption to your business.
Critical components of your network
To protect your business against major damage, you need to replicate and store your data in a remote location, such as a cloud solution. Because business networks can be expansive and complex, you should determine your most crucial systems and prioritize their backup. Keep tabs on their locations and estimated recovery times. These actions will help you recover your network quickly.
A Workforce Continuity Plan:
During an incident (cyberattack or otherwise) some locations or processes may be inaccessible. In either case, the top priority is employee safety. Help ensure their safety and limit business downtime by enabling them to work remotely. Invest in infrastructure that moves your operations to the cloud with technologies such as:
- Endpoint Security Protection
- Identity Access Management
- SD-WAN
- Security Information and Event Management
- Email Security Gateway
The Formal IRP itself:
Draw up a formal incident response plan, and make sure that everyone, at all levels in the company, understands their roles. For most IRPs, assume a total company infrastructure failure. This way, you can prioritize the important stuff. If an incident leaves you with most of your infrastructure up, go down the list and start from there, the steps would have been the same but a formal IRP forces a holistic view.
Typical things to include would be:
- A list of roles and responsibilities for the IR team members and other employees.
- A business continuity plan.
- The devices, tools, technologies, and resources that must be in place and the order of which they should be addressed.
- Critical network and data recovery processes.
- How you’ll communicate when Comm channels might be down.
Check out more Cyber security News and Tips Here
