Formulating a Cyber Incident Response Plan

To ensure successful incident response, teams should adopt a coordinated and organized approach towards addressing any incident, as incident response is a continuous process rather than a singular event. It is crucial for every response program to encompass important steps that effectively deal with various security incidents a company may encounter.

Why You Need to Plan Ahead to Successfully Respond to Cybersecurity Incidents

If your organization falls into the category of mid-sized organizations with an active incident response plan, it would be advisable to take this moment to review and revise it. On the other hand, if your organization falls into the category of organizations without an incident response plan, it is crucial that you prioritize adding this project to the top of your to-do list.

Due to being overburdened with day-to-day tasks, the IT staff of numerous smaller organizations often do not possess formal incident response plans. Nevertheless, having a properly organized and well-documented incident response plan can greatly reduce the amount of time and effort required in the future. In the event of a catastrophe, a prompt and efficient response can significantly impact the well-being of your employees, customers, and partners.

To make the process easier, we have summarized important aspects that should be taken into consideration when creating your own incident response plan. It is crucial to understand that the response plan of each organization will vary slightly according to their individual requirements, therefore it is important to avoid implementing a generic plan during times of crisis.

Follow Along and Build Your Plan Now

We have provided a summary of the key components of a cybersecurity incident response plan below. When using any template, be sure to customize the content and sections to meet your organization’s specific needs and adhere to the best practices outlined below.

A Mission Statement

To ensure maximum effectiveness, begin a robust incident response plan with a mission statement that accomplishes a series of high-level goals, just like any business plan.

Clear, simple, and actionable
Agreed to by all major stakeholders and inclusive of relevant business units—not just IT
Practical and flexible, with routine updates as cyberthreats evolve

Preparation

To effectively respond to incidents, adequate preparation is essential. Even the most skilled incident response team cannot effectively handle incidents without predetermined guidelines. It is crucial to have a well-developed plan in place to provide support to your team. For successful resolution of security events, a comprehensive incident response plan should incorporate the following elements:

Develop and Document IR Policies: Establish policies, procedures, and agreements for incident response management.
Define Communication Guidelines: Create communication standards and guidelines to enable seamless communication during and after an incident.
Incorporate Threat Intelligence Feeds: Perform ongoing collection, analysis, and synchronization of your threat intelligence feeds.
Conduct Cyber Hunting Exercises: Conduct operational threat hunting exercises to find incidents occurring within your environment. This allows for more proactive incident response.
Assess Your Threat Detection Capability: Assess your current threat detection capability and update risk assessment and improvement programs.

Detection and Reporting

During this phase, the main objective is to observe security events with the aim of identifying, notifying, and documenting potential security incidents.

Monitor: Monitor security events in your environment using firewalls, intrusion prevention systems, and data loss prevention.
Detect: Detect potential security incidents by correlating alerts within a SIEM solution.
Alert: Analysts create an incident ticket, document initial findings, and assign an initial incident classification.
Report: Your reporting process should include accommodation for regulatory reporting escalations.

Triage and Analysis

During this step, the majority of the effort is focused on properly scoping and comprehending the security incident. The utilization of resources is important to gather data from tools and systems for additional analysis and to identify indicators of compromise. It is necessary for individuals to possess expertise in live system responses, digital forensics, memory analysis, and malware analysis.

As analysts collect evidence, their focus should be on three main areas.

Endpoint Analysis
- Determine what tracks may have been left behind by the threat actor.
- Gather the artifacts needed to build a timeline of activities.
- Analyze a bit-for-bit copy of systems from a forensic perspective and capture RAM to parse through and identify key artifacts to determine what occurred on a device.
Binary Analysis
- Investigate malicious binaries or tools leveraged by the attacker and document the functionalities of those programs. This analysis is performed in two ways.
  1. Behavioral Analysis: Execute the malicious program in a VM to monitor its behavior
  2. Static Analysis: Reverse engineer the malicious program to scope out the entire functionality.
Enterprise Hunting
- Analyze existing systems and event log technologies to determine the scope of compromise.
- Document all compromised accounts, machines, etc. so that effective containment and neutralization can be performed.

Containment and Neutralization

This stage is extremely important in incident response as it serves as the basis for developing the strategy to contain and neutralize the situation. The strategy is formulated by utilizing the intelligence and indicators of compromise collected during the analysis phase. Once the system is restored and security is confirmed, regular operations can recommence.

Coordinated Shutdown: Once you have identified all systems within the environment that have been compromised by a threat actor, perform a coordinated shutdown of these devices. A notification must be sent to all IR team members to ensure proper timing.
Wipe and Rebuild: Wipe the infected devices and rebuild the operating system from the ground up. Change passwords of all compromised accounts.
Threat Mitigation Requests: If you have identified domains or IP addresses that are known to be leveraged by threat actors for command and control, issue threat mitigation requests to block the communication from all egress channels connected to these domains.

Incident Detection Documentation

In order to identify potential incidents, it is crucial to have a tested procedure. Being prompt is crucial in the midst of a live cyber-attack, as even minutes or seconds can have a significant impact.

Include the following detection procedures in your incident response plan, while thinking in a step-by-step manner.

Processes for analyzing alerts generated by security information and event management (SIEM), intrusion detection, and intrusion prevention systems (IDS/IPS)
Log management procedures to help differentiate between cybersecurity events and cybersecurity incidents
An established approach for users to report unusual technological activity and social engineering attempts
A clear, defined incident escalation process that permits the most significant threats to be prioritized and acted upon

An Incident Response Threshold Determination

After documenting your detection process, establish your criteria for declaring an incident. If you define an incident too narrowly, your response to a significant attack may be less impactful. Conversely, if you define an incident too broadly, you may allocate valuable resources to addressing minor incidents.

The U.S. National Institute of Standards and Technology (NIST) provides definitions for a cybersecurity event, cybersecurity incident, and (data) breach, which can be helpful. The SANS Institute offers a slight variation in distinguishing events and incidents. Determine the acceptable level of risk and use these definitions as indicators for when to formally declare an incident. Additionally, the decision may depend on the company’s willingness to allocate more resources to mitigate the consequences.

The determination of whether you would classify a security incident as a data breach is often dictated by industry compliance and data privacy mandates applicable to your organization.