Cyber incident response plans (CIRP)

 Cyber incident response plans (CIRP) 

 

What is a cyber incident response plan? 

A cyber incident response plan (CIRP) is an in-depth document created by companies to outline and advise what to do in a major cyber incident. Such incidents could include large or sensitive data breaches, data loss, outages and ransomware attacks. 

 

Preparation 

Arguably the most important phase of a cyber incident response plan. The main premise of this step is to ensure that a CIRP is in place well before an attack happens and relevant staff are briefed on what to do. The incident response team should be listed along with their contact information in case they need to be notified in a cyber incident. 

 

Detection and analysis 

This phase focuses on detecting and analysing cyber incidents once they occur. Security policies, monitors and features should be set up along with staff training on how to detect and recognise cyber incidents happening. Incidents can be detected based on precursors (events that happen before the incident such as brute forcing attempts from a hacker) or indicators (events that happen during or after the incident such as ransomware notices). Once an incident is detected, it should be prioritised and affected parties need to be notified in compliance with GDPR regulations. 

 

Containment and eradication 

Whilst devising a containment strategy, the company needs to be aware of how the strategy will affect the everyday operations. Events such as operational downtime, potential damage to resources and the need for evidence preservation should be considered. Gathering and documenting evidence should also be done at this stage to preserve the attack and help with identifying the attacking host. Eradication strategies will depend on the type of attack that occurs such as removing malware, disabling accounts or patching vulnerabilities in the affected systems. An effective eradication strategy works quickly and patches the entry point for the attack. 

 

Recovery 

After the incident has been dealt with, the incident response team should hold a meeting afterwards to review the cyber incident response plan and make improvements and changes where necessary. The damage and severity of the issue should also be reviewed especially in cases where an attack was successful. 

 

Cyber incident drills 

To test the cyber incident response plan, drills should be held where a cyber incident is simulated, and the plan is followed like a real situation. This will help to train members of staff what to do in a cyber incident along with testing the robustness and effectiveness of the cyber incident response plan.