How to Write an Effective Cyber Incident Response Plan
In today's digital age, there is a constant threat of cyberattacks. As a business, it is essential that you take proactive steps to protect your confidential data. There is, however, no silver bullet to ensure your organization doesn't fall victim to a data breach. That's why it is equally important to ensure you have an incident response plan (IRP).
Let's imagine a worst-case scenario takes place. You go into work one morning and find you've been hacked. What do you do?
Refer to Your Incident Response Plan
Your first step when there is a suspected incident is to locate your incident response plan. The incident response plan will outline whom to contact, including internal contacts, your digital forensics and incident response (DFIR) team, legal counsel, and law enforcement, if necessary. It will also provide step-by-step instructions on containing and eradicating the threat to get your business back up and running.
Print Your IRP!
To ensure you always have access to your incident response plan, have multiple copies available in digital and print formats. Digital copies can be stored on the company network, intranet, or in the cloud. The key is that each member of the incident response team can locate it quickly.
A printed version of your IRP is just as important, if not more so, than a digital copy. Depending on the nature of the breach, digital copies may not be available. Ransomware is a great example. Once deployed, all data connected to the infected machine or network becomes encrypted and can no longer be accessed. Having a printed IRP guarantees it will be available when you need it the most.
While having copies of your IRP in multiple locations is generally a best practice, version control becomes imperative. When you make an update to one document, that change must be recognized in each subsequent location.
Respond to the Threat
So once you have your incident response plan in hand and you've contacted the necessary people, the next step is to respond to the threat. Your IRP will walk you through the process of identifying the threat and preserving critical evidence. This evidence can help during the next phase and may also be required in potential future litigation.