Creating a Cyber Incident Response Plan

It is not a question of whether a cybersecurity incident response plan is necessary, but rather when it will be necessary to have a plan in place to address a cybersecurity incident. Without a well-defined plan to respond to cyber threats such as phishing, ransomware, and DDOS attacks, organizations of all sizes and types may abruptly face disruptions in their operations and be unsure of how to initiate the recovery process.

What Is a Cyber Incident Response Plan?

Cyber Incident Response Plan Definition

A plan for responding to cybersecurity incidents outlines the sequential actions that an organization will undertake in the event of such incidents. A well-functioning incident response plan provides comprehensive information on how to identify and categorize cybersecurity incidents. This plan should encompass clear guidelines and procedures, including the factors used to assess the seriousness and consequences of the incident, as well as the resources allocated for response measures.

Cyber Incident Response Plan Purpose

A well-structured plan for incident response in IT aims to quickly identify, contain, and mitigate the impact of a cyberattack, enabling the organization to restore normal operations at the earliest possible time.

includes information on roles and responsibilities, communication protocols and reporting requirements for key stakeholders, such as IT staff, security personnel, executives and external parties;
describes procedures for assembling and activating a cross-functional cyber incident response team, steps for containment and eradication of the threat, and strategies for limiting the spread and potential damage;
details how the organization will communicate with stakeholders such as customers, partners, regulators and law enforcement;
specifies how evidence will be gathered for investigation; and
spells out the steps for restoring normal operations.

Elements of a Cybersecurity Incident Response Plan

Your cybersecurity incident response plan needs to be a thorough and organized approach to address all types of possible cyber threats effectively.

Preparation

To effectively address an incident, preparation is crucial. Even the most skilled incident response team will struggle without pre-established guidelines. It is important to have a robust plan in place to support your team. When it comes to dealing with security events, an incident response plan should encompass the following features:

Develop and Document IR Policies: Establish policies, procedures, and agreements for incident response management.
Define Communication Guidelines: Create communication standards and guidelines to enable seamless communication during and after an incident.
Incorporate Threat Intelligence Feeds: Perform ongoing collection, analysis, and synchronization of your threat intelligence feeds.
Conduct Cyber Hunting Exercises: Conduct operational threat hunting exercises to find incidents occurring within your environment. This allows for more proactive incident response.
Assess Your Threat Detection Capability: Assess your current threat detection capability and update risk assessment and improvement programs.

Detection and Reporting

The main objective of this phase is to observe security events for the purpose of identifying, notifying, and documenting possible security incidents.

Monitor: Monitor security events in your environment using firewalls, intrusion prevention systems, and data loss prevention.
Detect: Detect potential security incidents by correlating alerts within a SIEM solution.
Alert: Analysts create an incident ticket, document initial findings, and assign an initial incident classification.
Report: Your reporting process should include accommodation for regulatory reporting escalations.

Triage and Analysis

During this step, the main focus is on scoping and comprehending the security incident, which requires significant effort. It is important to use resources effectively to gather data from various tools and systems for further analysis and to determine indicators of compromise. The individuals involved should possess extensive expertise in live system responses, digital forensics, memory analysis, and malware analysis.

As analysts collect evidence, their focus should be on three main areas.

Endpoint Analysis
- Determine what tracks may have been left behind by the threat actor.
- Gather the artifacts needed to build a timeline of activities.
- Analyze a bit-for-bit copy of systems from a forensic perspective and capture RAM to parse through and identify key artifacts to determine what occurred on a device.
Binary Analysis
- Investigate malicious binaries or tools leveraged by the attacker and document the functionalities of those programs. This analysis is performed in two ways.
  1. Behavioral Analysis: Execute the malicious program in a VM to monitor its behavior
  2. Static Analysis: Reverse engineer the malicious program to scope out the entire functionality.
Enterprise Hunting
- Analyze existing systems and event log technologies to determine the scope of compromise.
- Document all compromised accounts, machines, etc. so that effective containment and neutralization can be performed.

Containment and Neutralization

The stage of incident response that holds great importance is the one where containment and neutralization strategies are developed. These strategies rely on the intelligence and indicators of compromise collected during the analysis phase. Once the system is recovered and security is verified, regular operations can recommence.

Coordinated Shutdown: Once you have identified all systems within the environment that have been compromised by a threat actor, perform a coordinated shutdown of these devices. A notification must be sent to all IR team members to ensure proper timing.
Wipe and Rebuild: Wipe the infected devices and rebuild the operating system from the ground up. Change passwords of all compromised accounts.
Threat Mitigation Requests: If you have identified domains or IP addresses that are known to be leveraged by threat actors for command and control, issue threat mitigation requests to block the communication from all egress channels connected to these domains.

Post-Incident Activity

Once the incident is resolved, there is still additional work to be completed. It is important to thoroughly record any details that could aid in preventing similar incidents from happening in the future.

Complete an Incident Report: Documenting the incident will help to improve the incident response plan and augment additional security measures to avoid such security incidents in the future.
Monitor Post-Incident: Closely monitor for activities post-incident since threat actors will re-appear again. We recommend a security log hawk analyzing SIEM data for any signs of indicators tripping that may have been associated with the prior incident.
Update Threat Intelligence: Update the organization’s threat intelligence feeds.
Identify preventative measures: Create new security initiatives to prevent future incidents.
Gain Cross-Functional Buy-In: Coordinating across the organization is critical to the proper implementation of new security initiatives.