Cyberattacks: Incident Response (IR)

Incident response is an organizational process that enables timely, effective response to cyberattacks. The incident response process includes identifying an attack, understanding its severity and prioritizing it, investigating and mitigating the attack, restoring operations, and taking action to ensure it won’t recur.

It is important for Organisation to develop an Incident Response Plan to effectively managed any attack .

An incident response plan is a documented, written plan with 6 distinct phases that helps IT professionals and staff recognize and deal with a cybersecurity incident like a data breach or cyber attack. Properly creating and managing an incident response plan involves regular updates and training.

Preparation

This phase will be the work horse of your incident response planning, and in the end, the most crucial phase to protect your business

Identification

This is the process where you determine whether you’ve been breached. A breach, or incident, could originate from many different areas.

Key Questions

- How was it discovered?
- When did the event happen?
- Who discovered it?
- Have any other areas been impacted?
- What is the scope of the compromise?
- Does it affect operations?
- Has the source (point of entry) of the event been discovered?

Containment

When a breach is first discovered, your initial instinct may be to securely delete everything so you can just get rid of it. However, that will likely hurt you in the long run since you’ll be destroying valuable evidence that you need to determine where the breach started and devise a plan to prevent it from happening again.

Instead, contain the breach so it doesn’t spread and cause further damage to your business. If you can, disconnect affected devices from the Internet. Have short-term and long-term containment strategies ready. It’s also good to have a redundant system back-up to help restore business operations. That way, any compromised data isn’t lost forever.

Eradication

Once you’ve contained the issue, you need to find and eliminate the root cause of the breach. This means all malware should be securely removed, systems should again be hardened and patched, and updates should be applied.

Whether you do this yourself, or hire a third party to do it, you need to be thorough. If any trace of malware or security issues remain in your systems, you may still be losing valuable data, and your liability could increase.

Questions to address

Have artifacts/malware from the attacker been securely removed?
Has the system be hardened, patched, and updates applied?
Can the system be re-imaged?

Recovery

This is the process of restoring and returning affected systems and devices back into your business environment. During this time, it’s important to get your systems and business operations up and running again without the fear of another breach.

Questions to address

When can systems be returned to production?
Have systems been patched, hardened and tested?
Can the system be restored from a trusted back-up?
How long will the affected systems be monitored and what will you look for when monitoring?
What tools will ensure similar attacks will not reoccur? (File integrity monitoring, intrusion detection/protection, etc)

Lessons Learned

Once the investigation is complete, hold an after-action meeting with all Incident Response Team members and discuss what you’ve learned from the data breach. This is where you will analyze and document everything about the breach. Determine what worked well in your response plan, and where there were some holes. Lessons learned from both mock and real events will help strengthen your systems against the future attacks.

Questions to address

What changes need to be made to the security?
How should employee be trained differently?
What weakness did the breach exploit?
How will you ensure a similar breach doesn’t happen again?

No one wants to go through a data breach, but it’s essential to plan for one. Prepare for it, know what to do when it happens, and learn all that you can afterwards.

Next Steps

Dawgen Global Advisors provide guidance to clients in dealing with Cyber Security issues including Incident Response .

Need help? Dawgen Global Team can help you!

Dawgen Global is an integrated multidisciplinary professional service firm in the Caribbean Region. Dawgen Global offer BIG FIRM Capabilities without a big firm PRICE!

Caribbean Head Office:

Dawgen Tower- 47-49 Trinidad Terrace, Kingston 5 Telephone :18769265210

Global Contact :

Email [email protected]

Website : https://dawgen.global/