In today’s complex landscape of cybercrime, security breaches and data theft, more and more organizations are understanding that planning for potential security incidents has become a crucial element in their business strategy. According to the PwC Global Investor Survey 2018, investors are getting increasingly worried about cyberthreats.
A whopping 41% of all surveyed investors and analysts list cyberthreats as the single biggest threat to businesses, compared to only the fifth place in 2017.
Incident Response Planning (IRP) has proven to be an effective strategy for organizations to:
While organizations are generally familiar with the term in itself, many are at a loss when it comes to building a comprehensive Incident Response Plan for their own operations.
Related articles:
We’ve compiled a 5-part series about Incident Response Planning to help organizations understand what IRP is, what they should consider when implementing IRP, and how they can leverage IRPs to secure themselves against cyberthreats. Part 1 outlines the main benefits of implementing an Incident Response Plan.
When security incidents occur, organizations usually operate on an “all hands on deck” basis. Panic strikes, different teams struggle to evaluate the incident’s impact, and there is typically a lot of confusion in the air.
A clear and thoroughly-outlined Incident Response Plan helps organizations keep their cool in moments of crisis.
The plan needs to be drafted and reviewed by a variety of stakeholders within an organization (the IT team, executive management, the legal team, the communications division) and, most importantly, it needs to be approved prior to a security incident occurring. Chances are, you won’t have the peace of mind and necessary clarity in your line of thought when dealing with a security incident that is happening right this second.
An Incident Response Plan with clear post-incident instructions, assignments of relevant roles and responsibilities as well as guidelines for incident response management will help organizations navigate the stormy waters of today’s cyberthreat landscape.
Security incidents can have disastrous consequences to organizations, ranging from operational downtime to financial losses, reputational damage, and data loss.
Once a security incident has occurred, it is crucial to have the necessary mechanisms in place to mitigate the potential damage and implement corrective actions.
An Incident Response Plan that outlines concrete mitigation and remediation steps can help organizations mitigate the negative impact that a security incident may have on the confidentiality, integrity, and availability of their critical assets.
By having documented steps to be followed through by those responsible for incident response, organizations can avoid oversight and recover more quickly from incidents.
In today’s world of increasingly detrimental cyberthreats, no business is safe. Fortunately for businesses, most of their stakeholders understand that it’s very likely that businesses will experience a security incident at some point, and are no longer surprised when they read the headlines about the latest cybersecurity attacks.
What’s important to keep in mind, however, is that post-incident communications are crucial in maintaining your trust relationship with your important stakeholders, such as customers, partners and investors – especially after a crisis.
According to Deloitte’s 2016 Privacy Index, about a third of customers reportedly gain trust in an organization if they are properly informed about a breach.
More often than not, organizations fail to respond quickly enough or to provide the necessary amount of detail when informing their networks about the security incident.
Therefore, an effective Incident Response Plan should contain a dedicated section about how to communicate successfully after a security incident.
The IRP can include:
Although we wouldn’t want to wish security incidents on any organizations, we have often witnessed that they tend to improve communication between different departments.
In a crisis, employees who usually don’t communicate on a regular basis have no choice but to collaborate and exchange their thoughts on the best possible strategy to survive a security incident. In fact, communication can make or break a company. It helps to resolve problems, reveal opportunities and different opinions that may not have been considered otherwise, unite employees and foster collaboration and employee loyalty.
Whatever your security incident may be, make sure to communicate with your employees in an open and timely manner. Provide information about the nature of the incident, how long it is expected to last, what its immediate and long-term impact is expected to be, and whether specific guidelines are available to address customer queries.
For long-term success, organizations need to encourage maintaining open communications event after a security incident.
“All men make mistakes, but only wise men learn from their mistakes.” – Winston Churchill, former Prime Minister of the United Kingdom
According to the findings in the 2017 SANS Incident Response Survey, “a key part of the IR process is to examine lessons learned from incidents to pinpoint how the team can increase its maturity”.
When breaking down the recommended Incident Response Process into distinct phases, the Lessons Learned phase is often identified as the most critical phase. Unfortunately, this very critical stage of the incident handling process is often skipped due to limited resources or time constraints, yet should not be underestimated.
Organizations are best advised to take the time to sit down and conduct a so-called post-mortem exercise after every security incident.
This may seem like a waste of time at first, but can help sharpen defenses, optimize processes, establish benchmarks, reassign roles and responsibilities and facilitate incident response management activities overall.
There is no doubt that security incidents against organizations are here to stay. And sooner than later, we’ll all need to live up to the fact that careful planning and preparation is one of the best strategies to handle security incidents.
Not only does Incident Response Planning prepare you better to face security incidents with confidence, but it also helps your organization mitigate damage to your operations, strengthen relationships with your stakeholders and shareholders, improve your interdepartmental communications and, eventually, make you stronger to face potential cyberattacks going forward.
Now that we’ve learned about the benefits of Incident Response Planning, how do we actually go about building such a plan for our organization? Read Part 2/5 here.
