Creating a great and effective Incident Response plan is very critical. There are many reasons why people struggle to get one properly implemented despite a lot of different materials out there.
Challenges:
- Lack of Comprehensive Planning:
DO NOT rush into this, it will be different for every organization based on different factors. This is not a “check box” activity. DO NOT rush to put an Incident Response Plan and Procedure in place to fulfill a requirement. - Limited Resources and Budget Constraints:
I get it, you are a small organization or an organization that hasn’t put much value into cybersecurity or incident response. “We are too small of a company to be targeted”, “We have nothing they want”. Get something together from a high level, keep working to get it better. Cybersecurity is about continuous improvement, this will take genuine effort to make this process better and from multiple people, communication will be a key factor in success. - Skills Shortage and Training Gaps:
Are you the lead? Train thru practice. Get your baseline created and then test the users that you will need to communicate with during an Incident Response scenario. Your lessons learned after the scenario will better prepare your team and get them to think about “what ifs” and “how can I better prepare”. - Complexity of IT Environments:
Not only is this a common obstacle but it is also a huge reason why preparation is key. Know your environment, the better you know and the better it is documented the easier it will be to notice when something is wrong. Identify your critical assets or “crown gems”, doing that will help you understand what needs to be done to create better Defense in Layers. - Effective Communication and Coordination:
This is the most common obstacle I find and the most important thing I want everyone to work on. If something bad happened right now and you wanted to alert your Incident Response Team how would you do it? If you message in Teams or Slack and don’t have a dedicated place to do this, good luck getting their proper attention that it is an emergency. Have an Incident Response area so that users know “If I post here I need your immediate attention because it is a RED LEVEL EMERGENCY”.
PICERL Incident Response Framework
PICERL is a well-structured framework for incident response that guides organizations through the process of handling security incidents.
PREPARE
Fail to Prepare, Prepare to Fail. When not actively responding to an incident, you are in this phase. Strive to get better with continuous improvement and attack surface reduction. System hardening, vulnerability management, patching, monitoring, documentation, training and practice are some things you should focus on.
IDENTIFY
Something has happened, act quickly and accurately to assess the situation and properly determine if it really is in incident. Make sure to categorize the incident and prioritize the incident based on severity, risk and impact. Make sure to escalate if needed to ensure the proper incident responders are working any confirmed incidents.
CONTAIN
The goal here is to stop the attack from spreading. Do not rush into this to ensure there are no holes in your containment. You need to prevent things from getting worse by being decisive with your actions.
ERADICATE
Get the attacker completely out and keep them out in the future. This should be the more permanent fix that happens after the threat has been contained. Complete any hardening, patching and additional configuration required. Make sure to continue monitoring.
RECOVER
Restore affected systems back to their previous state with additional measures in place to ensure the incident or a similar incident cannot happen again. Test monitor and validate your systems as they are restored. Get things back to normal.
LESSONS LEARNED
Document and Learn. What happened in the incident? How did the incident happen? How was the incident dealt with? What went well with the incident response? What went bad with the incident response? What needs to be changed in the incident response plan?
Stop reading this, go plan your Incident Response!