Quick & Easy Steps to Build an Incident Response Plan

 

 

 

 

 

 

 

 

 

This cybersecurity plan is the guide for how your organization will react in the event of a security breach is used aside from the Business Continuity Plan, this will be used practice over the Security Operations of your business to have the best well-planned approach to prevent any attack or security breach in your systems. An incident response capability is necessary to promptly detect incidents in your systems, minimizing the loss and destruction over systems and networks that were compromised and restoring your IT services.

1. Create an incident response policy & plan.

• Define policies governing by defining the statement of management commitment.
• Purpose and objective of the Policy.
• Roles, Responsibilities, and Levels of Authority.
• Prioritization or severity rates of incidents.
• Performance measures
• Reporting and contact forms.

2. Develop procedures for conducting incident handling and reporting.

• Create an SOP (Standard Operating Procedure) to line-up, straighten, and applied the specific technical processes, techniques, checklists, and forms used by the incident response team.

3. Setting guidelines for communication with outside team members regarding incidents.

There is a line of communication needed to improve the detection and analysis of incidents. These can be Sharing information with the different team in the organization but also Outside parties such as vendor software and hardware, the Internet Service Provider, and contacting law enforcement.

4. Selecting a Team Structure and Staffing Model

These will include the following:

Central Incident Response Team - A single incident response team handles incidents throughout the organization.

Distribute Incident Response Team - The organization has different response teams. Each responsible for a particular logical
or physical segment of the organization.

Coordinating Team - An Incident response team provides advice to the other teams without having authority over those teams such as a department may assist external teams by providing central and distribute information of the incident but not addressed in detail.

5. Establishing relationships and lines of communication between the incident response team and other groups.

Team-to-Team
Technical incident responders in different organizations collaborate with their peers during any phase of the incident handling life cycle.

Team-to-coordinating team
Technical incident responder’s team will report on a different organization that acts as a central point for coordinating incident response and management of incident resolutions to completion

Coordinating team-to-coordinates team
Relationships between multiple coordinated incident responder team exist to share information relating to cross-over incident which may affect multiple communities.

6. Determine what services the incident response team should provide.

Intrusion Detection - Team Responsible for doing continuous monitoring and first-tier to analyze incidents more quickly.

Advisory Distribution - Team that issues advisories within the organization regarding vulnerabilities, threats, and current attacks. Only this group should distribute computer security advisories to avoid duplicated effort and conflicting information.

Education and Awareness - The more users and technical staff know about detecting, reporting, and responding to incidents, the less work the Incident Responder Team will have.

Information Sharing - Team members that participate in information sharing groups that ensures that pertinent information is shared within the enterprise and other organizations such as Talos Intelligence - Cisco Security’s Threat Intelligence organization, etc.

 

Hire IT Security Assitant Services to support your Security Operations and more:

If you liked this post, you will enjoy our newsletter. Receive new articles directly in your inbox.

Subscribe & Comment below this article.