Getting to Grips with Incident Response Management

Security breaches are part and parcel of running a modern organisation. Research completed by the Clark School at the University of Maryland showed that hackers attack every 39 seconds. With organisations exposed to such a high volume of threats, Incident Response has become just as important, if not more important than threat prevention. 

The main reason for the growing importance of Incident Response is that an organisation can’t defend against every threat vector, which means companies need to have the ability to remediate incidents quickly to reduce downtime. However, most companies struggle with incident response, with the average time to detect and contain a data breach being 280 days.  

In this article, we're going to look at what Incident Response is, the 6 key phases of the incident response process, why organisations need to outsource it to an external provider, and the pitfalls of managing it internally.  

What is Incident Response? 6 Phases of Incident Response Management Explained   

Incident Response is an organisation's reaction to an incident where a device has gone offline and refers to the actions taken to get that infrastructure back online from detecting and remediating a threat to restoring affected devices. A mature Incident Response process can be broken down into several key phases: 

• Phase 1: Preparation - Making sure that playbooks, training, and security tools are available to manage future breaches. That includes creating a full Incident Response plan and having security analysts run mock incidents regularly.  
  
• Phase 2: Identification - Identifying the “who, what, why, when, where, and how” of a data breach. Answering these questions enables a team to identify the disruption and ways to contain it. 
  
• Phase 3: Containment - Beginning to safely and efficiently contain a breach to prevent it from causing further damage to the business.  
  
• Phase 4: Eradication - A security analyst identifies the root cause of the breach and eliminates it to prevent the disruption of business continuity.  
  
• Phase 5: Recovery - Restoring all affected devices and business processes to enable the organisation to return to normal operations.  
  
• Phase 6: Lessons learned - Gathering information obtained from the incident to determine where the organisation's response was successful and what to improve in the future. This is arguably the most important phase of the incident response process.  
  

The individuals that guide an organisation through each of these phases are categorised as incident responders. Incident responders have an interdisciplinary role that borrows techniques from other cyber security disciplines like cyber security engineers, vulnerability analysts, forensic analysts, penetration testers, risk analysts, and SOC analysts to respond to data breaches on a case-by-case basis.  

Want to watch our Incident Response team filter out the noise that surrounds incident response? Click here to watch.

Assessing Your Need for IR: Why It’s Important to Use an External Incident Response Service  

Managing Incident Response internally isn't recommended for most organisations because most companies don't have the resources to maintain a team of cyber security specialists on-demand 24 hours a day. For these companies, it's much more cost-effective to partner with a managed service provider who can provide 24/7/365 access to an experienced team of cyber security professionals.  

If you’re unsure about whether you have the resources needed to manage Incident Response in-house, there are some key questions you can ask yourself to assess your need for an Incident Response service: 

• Is your Incident Response team available 24/7?  
  
• Do you have a dedicated Incident Response manager to manage incidents? 
  
• Do you have 24/7 access to vendor or tool-specific expert advice?  
  
• Does your organisation have access to the latest real-time threat intelligence?  
  
• Does your organisation already have an automated Incident Response process? 
  
• Does your team have time to create well-written reports following a breach?  
  
• Do your employees know what stakeholders to inform during a breach? 

If the answer to any of the questions above is no, then using external Incident Response services are vital to make sure that you're fully protected in the event of a security breach. A reputable provider will help you manage security incidents safely from start to finish so that you can remediate disruptions quickly and return to normal operations. 

The Pitfalls of Managing IR Internally  

Those companies that do decide to manage Incident Response internally typically confront some common pitfalls that leave them unprepared to resolve security incidents. Some of the main pitfalls organisations face at each stage of the incident response process include:  

• Preparation phase: Failing to create a fully documented incident response playbook, meaning that employees don’t know how to respond to breaches effectively.  
   
• Identification phase: Lacking internal expertise to answer the “who, what, where, why, when and how,” questions surrounding an event, which can lead to further issues, such as identifying legitimate applications as malware and deleting them.  
   
• Containment and eradication phases: Tendency to under contain or over contain events. For instance, an employee failing to configure secure firewall rules following a breach or shutting down an entire office when they only needed to contain a single machine. 
   
• Recovery phase: Taking too long to bring systems back up (usually due to a lack of a disaster recovery plan) and significantly increasing the length/cost of downtime.  
   
• Lessons learned phase: Failing to learn lessons from past security breaches, increasing the risk of falling victim to similar breaches in the future.  

When combined together, all of these challenges mean that it’s much easier for an organisation to outsource incident response to an experienced managed service provider who already has a battle-tested process in place with professionals who’ve helped hundreds of companies to manage security events.  

Don’t be Afraid to Seek Help!  

Defending against modern cyber threats isn't easy, and it's ok if your organisation doesn't have the onsite resources needed to stop the next generation of online threats because most organisations don't. By seeking help from an Incident Response provider, you can give your team peace of mind that your organisation is protected against the latest threats.  

That means when there is a breach, you’ll be able to have on-demand access to a team of experts who will tell you exactly what you need to do to protect you and your customer’s information, so that your employees can get back to work safely.  

This blog and its content are provided as a general guide to the subject matter. You should always seek specialist advice about your specific situation.