The creation of a cybersecurity incident response plan (CIRP) can be intimidating, particularly for small-to-medium-sized businesses (SMBs) which often do not have as many resources available to them as larger entities. A CIRP is essential for any organization as it serves as a documented guide outlining the procedures that are necessary in order to minimize the impact felt following an incident. Of course in an ideal world, cyber attacks would be avoided altogether; however, cybercriminals heavily target SMBs - 46% of data breaches hit businesses with 1,000 employees or less and in 2021, 82% of ransomware attacks hit companies within this size category as well. By being prepared in the event of an attack, businesses are able to respond effectively and swiftly, getting back to normal operations far quicker than if they did not have a CIRP in place. In order to follow the road map laid out by a cybersecurity incident response plan, we need to identify the key elements that make up this useful guide.
Identification of Essential Data
Determining which data is absolutely necessary for the business to remain operational is one of the first steps to be taken when creating a CIRP. While it would be ideal to include all of the data in this plan, it can be difficult to actively manage and protect all of a company’s information when in an emergency response space; identifying the essential data for a business to stay afloat is key to directing efforts in effective ways.
The Human Element
In the process of identifying the essentials, it is also crucial that the key stakeholders are outlined. Listing these individuals’ roles and responsibilities helps for people to know what action they need to take when the CIRP is necessary. In addition to the responsibilities and actions needed for these people, it is important to keep up-to-date contact information included in the CIRP so that these employees are easily accessible as soon as their assistance is needed. In addition to the internal CIRP team, external contacts should be identified as well such as law enforcement, regulatory bodies, and third-party vendors who might be impacted by your company’s incident. These entities should be notified in the event of an incident.
Incident Classification and Categorization
Defining incident severity levels helps for the CIRP team to know what action needs to be taken. Based on the severity of an attack, the company should adjust their response; a low or medium severity incident is something more easily contained and the team can focus their efforts more easily. A high or critical severity incident will have a larger impact on a company, disrupting operations and requiring more effort and potentially more people to resolve.
Categorizing an incident helps for the CIRP team to know which path needs to be followed in order to respond to an attack. Incident categories might include data breaches, malware infections, ransomware attacks, phishing incidents, DDoS attacks, insider threats, system vulnerabilities, and more. Though certain elements may be consistent across all categories, identifying what attack has occurred helps to refine the response and assists in getting back to regular operations quickly.
Response Procedures
Following classification and categorization of an incident, the specific response procedures for each option need to be created to guide the CIRP team in their duties following the attack. This includes the creation of step-by-step instructions for responding to each incident. Among these steps, strategies for containment and recovery need to be included.
Documentation & Reporting
Among the response procedures is determining the necessary documentation and reporting that needs to take place following an incident. Maintenance of logs and post-incident reports helps for the team to learn from any prior attacks.
Communication Plan
Creating the protocols for notifying those previously identified key members - both internal and external - is key for ensuring response to an incident can begin as soon as possible following an attack.
Training and Testing
The identified (and now, notified) key members also need to be trained in following the step-by-step outline created in the CIRP. An effective way to do so is scheduling regular incident response drills or “stress tests” to put the training into action. This can help the team to identify areas where improvements are needed so that they are properly prepared for a real attack.
Recovery
Arguably the most important step in the process of cybersecurity incident response plan creation is determining how to restore systems to normal operations.
Revisit the CIRP
After responding to an incident and returning to normal operations, it is crucial that the CIRP is revisited and updated with lessons learned in order to apply the knowledge gained from this endeavor to hopefully prevent future attacks.