{"id":7498,"date":"2021-07-22T09:53:03","date_gmt":"2021-07-22T09:53:03","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7498"},"modified":"2021-07-22T09:53:04","modified_gmt":"2021-07-22T09:53:04","slug":"guide-to-cyber-security-incident-response-planning","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/","title":{"rendered":"A Guide to Cyber Security Incident Response Planning"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7498\" class=\"elementor elementor-7498\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">In 2020, 39% of businesses in the UK <\/span><a href=\"https:\/\/assets.publishing.service.gov.uk\/government\/uploads\/system\/uploads\/attachment_data\/file\/972399\/Cyber_Security_Breaches_Survey_2021_Statistical_Release.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">reported a cyber security breach or attack<\/span><\/a><span style=\"font-weight: 400;\">. When an attack takes place, it kicks off a cyber security incident response effort aimed at mitigating the impact of the event, limiting the damage to the organisation\u2019s operations, finances, and reputation. However a successful cyber attack incident response begins long before an attack actually takes place.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">A cyber security incident response involves understanding where an attack could come from, preparing for that attack, implementing early warning systems, and finally ensuring that the right team is in place to deal with the incident when it takes place.<\/span><\/p><h2><span style=\"font-weight: 400;\">Phishing is the most common form of cyber incident<\/span><\/h2><p><a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\"><span style=\"font-weight: 400;\">Phishing<\/span><\/a><span style=\"font-weight: 400;\"> is still the most common form of cyber incident faced by organisations of all shapes and sizes. The UK Government\u2019s <\/span><a href=\"https:\/\/assets.publishing.service.gov.uk\/government\/uploads\/system\/uploads\/attachment_data\/file\/972399\/Cyber_Security_Breaches_Survey_2021_Statistical_Release.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Cyber Security Breaches Survey 2021<\/span><\/a><span style=\"font-weight: 400;\"> identified phishing as the most common form of threat by a long way. 83% of respondents to the survey reported that they had identified phishing attacks against their organisation.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">By contrast, the second most common form of cyber attack identified in the survey is \u201cOthers impersonating organisation in emails or online\u201d, at 27%. Furthermore, the proportion of organisations reporting phishing activity has increased from 72% in 2017, suggesting that phishing is still getting the desired results.<\/span><\/p><p><span style=\"font-weight: 400;\">The other forms of cyber attack identified include: viruses, spyware or malware; <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/\"><span style=\"font-weight: 400;\">ransomware<\/span><\/a><span style=\"font-weight: 400;\">; denial of service attacks; hacking or attempted hacking of financial accounts; unauthorised accessing of files or networks by staff or outsiders, and more.<\/span><\/p><h2><span style=\"font-weight: 400;\">Preparation is key\u2026 But what does that mean?<\/span><\/h2><p><span style=\"font-weight: 400;\">That\u2019s a question that many organisations are still trying to answer. Again, the Cyber Security Breaches Survey 2021 found that just 31% of businesses and 27% of charities include cyber security in their business continuity plans. In addition, simply having an incident response plan in place doesn\u2019t mean that they are effective.<\/span><\/p><p><span style=\"font-weight: 400;\">Tips for preparing for a cyber attack include:<\/span><\/p><p><b>Put in good detection controls<\/b><span style=\"font-weight: 400;\"> &#8211; You can\u2019t respond to incidents you don\u2019t detect. Make sure to get early warning of an attack through effective detection controls and have an efficient security operations centre who can mobilise quickly in an attack.<\/span><\/p><p><b>Create incident response playbooks<\/b><span style=\"font-weight: 400;\"> &#8211; Go a step further than creating an <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\"><span style=\"font-weight: 400;\">incident response plan<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; create a playbook. A playbook will include all the information, contact details, step by step tasks the cyber attack incident response team need to carry out in order to respond to the incident.\u00a0<\/span><\/p><p><b>Move incident response plans off the page<\/b><span style=\"font-weight: 400;\"> &#8211; Test incident response plans with tabletop exercise, or rehearse them with full cyber attack simulations to see what works and what doesn\u2019t work. Acting out cyber attack incident response plans will ensure that everything is covered in the plan, and that everyone knows what to do in the real thing.<\/span><\/p><p><b>Help employees stay safe<\/b><span style=\"font-weight: 400;\"> &#8211; It\u2019s no coincidence that phishing and other forms of <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/6-social-engineering-tactics-in-action-in-2021\/\"><span style=\"font-weight: 400;\">social engineering<\/span><\/a><span style=\"font-weight: 400;\"> are the most common form of cyber incident. Humans have long been seen as the weakest link when it comes to cyber security, and attackers exploit their lack of awareness. Engage employees with the cyber security programme, and train them to become security champions, protecting themselves and the organisation\u2019s network.<\/span><\/p><p><b>Review cyber security incident response plans regularly<\/b><span style=\"font-weight: 400;\"> &#8211; Things change. So don\u2019t forget to update plans when they do. When new systems come online, add them to the playbook. Review the list of incident responders and their contact details to ensure that it is as up to date as possible.<\/span><\/p><h2><span style=\"font-weight: 400;\">Get an early warning of cyber attack<\/span><\/h2><p><span style=\"font-weight: 400;\">There\u2019s no fail safe way to become aware of cyber incidents, and that\u2019s why organisations usually rely on several notification methods. As well as the technology in place, information security teams are also expected to tap into the wider community and threat intelligence resources. These are not as scary as they sound and can include <\/span><a href=\"https:\/\/www.ncsc.gov.uk\/section\/keep-up-to-date\/threat-reports\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">threat bulletins<\/span><\/a><span style=\"font-weight: 400;\">, peer groups, and the industry press.<\/span><\/p><p><span style=\"font-weight: 400;\">Again, employees can be a great resource and should be encouraged to report unusual activity to their information security teams as soon as they first see something suspicious.<\/span><\/p><h2><span style=\"font-weight: 400;\">What should go into a cyber security incident response plan?<\/span><\/h2><p><span style=\"font-weight: 400;\">There are many variables to include in a <\/span><a href=\"https:\/\/www.ncsc.gov.uk\/collection\/incident-management\/cyber-incident-response-processes\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cyber attack incident response plan<\/span><\/a><span style=\"font-weight: 400;\">, but just some of the elements to consider include:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/indicators-of-compromise-analysis-is-half-the-story\/\"><span style=\"font-weight: 400;\">process for identifying the source<\/span><\/a><span style=\"font-weight: 400;\"> of the incident<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The location, sensitivity, and relative value of all sensitive data<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Roles and responsibilities assigned to specific individuals<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A list of critical systems which should be prioritised in any remediation activity<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A step by step playbook for the incident response to enable teams to work in the right order<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">How to restore backups<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A process for formally logging incidents<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Written guidance on who to notify including regulators<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Communications plans for employees, stakeholders, and the public<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The contact details of any third party cyber attack incident response support<\/span><\/li><\/ul><h2><span style=\"font-weight: 400;\">Spring into action &#8211; speed is essential in a cyber security incident response<\/span><\/h2><p><span style=\"font-weight: 400;\">When an attack occurs, time is of the essence. This is when those plans and playbooks are most needed as the incident response team needs to mobilise quickly and methodically. Most of the first few tasks should already be done &#8211; the incident response team should know how they are, the Lead Investigation Officer should already be in place, tasks should be mapped out, and communications plans should be in place.<\/span><\/p><p><span style=\"font-weight: 400;\">With that said, some of the activities that follow a cyber incident include:<\/span><\/p><p><b>Quickly contain the breach<\/b><\/p><p><span style=\"font-weight: 400;\">Understand which servers, devices, systems are impacted and take them off line as quickly as possible. Disconnect everything from the internet while searching for the full scope of the attack, and disable remote access. Change passwords for all systems immediately.<\/span><\/p><p><b>Assess the breach<\/b><\/p><p><span style=\"font-weight: 400;\">Gather more information about the breach. Is it a stand alone attack, or are other organisations also affected?<\/span><\/p><p><b>Log everything<\/b><\/p><p><span style=\"font-weight: 400;\">Keep a comprehensive log of the incident and response, including when the incident occurred, how it was discovered, the actions undertaken to manage it, the members of the incident response team, and more.<\/span><\/p><p><b>Prioritise what to work on when<\/b><\/p><p><span style=\"font-weight: 400;\">Information about the criticality of certain systems, and what to prioritise should be in the cyber security incident response plan. Of highest priority are the systems required to operate, or to return to operations as quickly as possible.<\/span><\/p><p><b>Communicate with stakeholders<\/b><\/p><p><span style=\"font-weight: 400;\">Notify employees, stakeholders, customers, and the public as soon as possible. Contact regulators and insurance providers in the first instance.<\/span><\/p><h2><span style=\"font-weight: 400;\">Leading the way from the front: How should the leadership team respond?<\/span><\/h2><p><span style=\"font-weight: 400;\">While the incident response team are carrying out their work, leadership should also be carrying out their work. Again, requirements from leadership will be set out in the cyber security incident response plan, and they will include such tasks as being the face of the organisation to employees, stakeholders, the media, regulators, and more.<\/span><\/p><p><span style=\"font-weight: 400;\">In addition, the way that leadership behave will set the tone for the incident response. The organisation needs leadership to stay calm and focused on the task at hand, to support the incident response team, and to keep on message both internally and externally.<\/span><\/p><h2><span style=\"font-weight: 400;\">Recovering from a cyber attack<\/span><\/h2><p><span style=\"font-weight: 400;\">The initial response to a cyber attack is only the start of an organisation\u2019s recovery from the incident. Once the heat of the response has ended, that\u2019s when the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/attack-isnt-over-until-post-event-analysis-says-so\/\"><span style=\"font-weight: 400;\">post event analysis<\/span><\/a><span style=\"font-weight: 400;\"> kicks in to avoid it happening again.<\/span><\/p><p><span style=\"font-weight: 400;\">Post event analysis is when an organisation can understand the underlying vulnerabilities that enabled the attack. During this analysis they will want to look at the type of attack, causes, failures, whether it was preventable, and what can be done to protect the organisation from a similar attack in future.<\/span><\/p><p><span style=\"font-weight: 400;\">Analysing the incident response is also important. Organisations will want to understand which containment actions worked, whether the cyber attack incident response plans were effective, and the losses and costs of the attack.<\/span><\/p><p><span style=\"font-weight: 400;\">Finally, there will be a rebuilding exercise for the organisation to return to a position of stability. The rebuilding phase may require support and help from third parties who can work with the organisation to strengthen their <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">security risk and compliance<\/span><\/a><span style=\"font-weight: 400;\">. Technology and controls will need to be updated, additional safeguards should be added, and a program built for regular checks of <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">infrastructure security<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">After all, prevention is better than cure, and learning the lessons from one cyber attack is key to breaking the cycle and avoiding another attack the next time.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>In 2020, 39% of businesses in the UK reported a cyber security breach or attack. When an attack takes place, it kicks off a cyber security incident response effort aimed at mitigating the impact of the event, limiting the damage to the organisation\u2019s operations, finances, and reputation. However a successful cyber attack incident response begins&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7500,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7498"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7498"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7498\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7500"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}