Cyber security incidents can have an impact on all organisations regardless of size. Taking steps to prepare for incidents is so an integral part of good security management.
An incident response plan helps to provide a system within which to respond to a security incident, with defined procedures and roles. What does an incident response plan mean?
An incident response plan is a documentation of response steps a company should follow in case of a security incident. It is frequently used for responding to various types of security incidents like malware phishing denial of service attacks, unauthorised access, data breaches ransomware etc.
It specifies who should respond, what actions should be taken and what procedures should be followed.
Typically a full incident response plan will have several phases. Preparation: policies, response team, communication plan, technical controls. Identification: detection and analysis of anomalies to identify incident occurrence.
Containment- limiting the incident Eradication- removing the cause of the incident e.g. malware, accounts Recovery- restoring and monitoring the affected system Lessons-learned- reviewing the incident, which will allow the business to improve.
Having no well established procedures at the onset of a cybersecurity incident can be potentially complex and time-consuming. An incident response plan offers a starting point detailing the responsibilities and communication procedure to be followed before an incident takes place.
It can aid in standardized decision making process and minimize confusion.
Just as time is important in delivering the plan, regular testing and reviewing of the plan is just as crucial. Company technology, legal issues, organizational structure and cyber-security risks may change over time and keeping your incident response plan up-to-date will ensure it remains relevant and attainable.
An incident response plan is one part of a larger security plan. Proper procedures in planning detection containment, recovery, and analysis will prepare an organization to effectively deal with a security incident.
Formal training, testing, and updates can ensure the response plan remains appropriate to changing security issues.
