Building an incident response strategy in 2024

At a time when cyberattacks are commonplace, every company needs a solid and up-to-date incident response strategy. With excellent response plans, companies can respond promptly, communicate with relevant stakeholders, and ensure regulatory requirements are met.

A good strategy can also help limit reputational damage in the event of a cyberattack. Ultimately, this helps reduce the cost of a breach.

But incident response is changing. With the threat landscape evolving and technologies like AI bringing their own dangers, leaders need to develop the most watertight incident response strategy possible, even when under budget pressure.

Incident response strategy: steps to success

Previously, incident response aimed to address threats at the organization’s perimeter. But as the lines between internal and external environments blur, strategies need to adapt, Ridley says. “With the increasing use of cloud services in various business processes, the traditional concept of a clearly defined perimeter has become obsolete,” he says.

But experts agree that there is no one-size-fits-all approach to developing an incident response strategy. Key components include defined terms to explain what commonly used words and phrases mean, says Sarah Pearce, partner at Hunton Andrews and Kurth.

This could include rules covering specific types of incidents or defining personal data and an escalation process and requirements, she says.

At the same time, companies need to understand the regulatory obligations, says Adam Harrison, managing director of the cybersecurity department at FTI Consulting. “It is important Compliance obligations identified in advance, especially since many strict reporting requirements with tight deadlines.”

Regulation must be considered depending on the industry and region. For organizations operating or serving customers in the EU, compliance with General Data Protection Regulation (GDPR) is crucial, especially in dealing with personal data breaches and reporting them to the relevant local authorities, says Harrison.

In Great Britain, for example Data Protection Commissioner (ICO) requires companies to report data protection breaches no later than 72 hours after becoming aware of them.

In addition, Harrison emphasizes the role of insurance.”Cyber insurancecan play an important role in the event of an incident for organisations that have it. Knowing how and when to involve an insurer and being aware of the help they can provide is often overlooked.

At the same time, communication is a key part of incident response, says Jeff Watkins, chief product and technology officer at xDesign. “With team members, with HR, with your customers and their customers, and with regulators like the ICO. How you manage this will have a huge impact on trust in your business, and if you do it well, you won’t end up in the news for the wrong reasons.”

Incident Response Strategy: The Good and the Bad

Without the right incident response strategy, cyberattacks can escalate into larger incidents, legal requirements can be overlooked, and Reputation can be seriously damaged.

One only has to look at past cyberattacks to see the benefits of excellent incident response. The 2015 TalkTalk data leak is probably the best-known example of a poorly executed crisis response plan in the UK, says Bharat Mistry, technical director for the UK and Ireland at Trend Micro. “The internet service provider (ISP) took several days to report a breach, communicated inadequately, missed key details, and its executives downplayed the severity of the attack.”

Another recent example of inadequate incident response is the LastPass security vulnerabilityfirst became known in August 2022, says Philip Ridley, head of security response at Adarma. “The initial report was announced as a small incident limited to the application development environment. However, by December, the true scope of the breach had expanded to include company names, email addresses, billing information, and more.”

US telecommunications companies AT&T responded poorly to the hacker attack, says Vanessa Horton, Cyber Incident Responder at GRCI Law. “There was a data breach in 2021, but that was only recently acknowledged.”

Conversely, the Cyberattack on Norsk Hydro in 2019 is often seen as a prime example of a well-executed incident response plan, says Mistry. “Norsk demonstrated robust business continuity plans and a high level of engagement with stakeholders, customers and regulators following the ransomware attack.”

Meanwhile, the British Library did “exemplary work” in Share lessons learned and threat intelligence after its latest ransomware attacksays Horton. “When it comes to cybersecurity, we all have to do our part. The library’s recent report has been a massive help in raising awareness of threats and is a great educational resource.

Incident response strategy: Successful despite a small budget

It’s possible to develop an incident response strategy even on a tight budget. To reduce costs, prioritization is key, says Harrison. “Focus on protecting and building the most resilience in the areas that matter most to your business.”

He points out that “relatively small and inexpensive steps” can help improve your cybersecurity and response readiness. “Employee training, Incident simulationand developing processes and policies can make a significant difference without breaking the bank.”

Anyone can create a basic incident response plan, even if the budget is small or nonexistent, says Christian Scott, COO and CISO at Gotham Security. He points to “a wealth of materials” available from the Cybersecurity and Infrastructure Security Agency (CISA) and the Center for Internet Security (CIS). “These include incident response plan materials, simulation games, and various tools to help you assess your security posture.”

The UK National Cyber Security Centre (NCSC) also offers online tutorials with its Exercise in a Box program, which provides materials for testing an organization’s response strategy to events such as a ransomware attack via a phishing message, a data leak, or an insider threat.

In 2023, the NCSC, in collaboration with the CREST cyber community and cyber insurance firm IASME, will launch its Cyber Incident Exercising programme, bringing service providers together with organisations to conduct bespoke cyber exercises designed to test their existing incident response strategies.

It is crucial that organisations practice their crisis response plan regularly, says Martin Borrett, technical director of IBM UK and Ireland Security. “Many organisations have moved from no preparation at all to annual practice sessions. While this is an improvement, we should aim to practice cybersecurity practices at least twice a year.”

To ensure the team is prepared and the plan remains effective and relevant, exercises and practice scenarios should be conducted regularly, Harrison agrees. In addition to simple business games, companies can also run more complex, large-scale simulations, which should ideally take place “at least once a year,” he advises.

A regularly tested strategy also ensures that employees’ skills do not become rusty, says Horton. “In a stressful situation such as an incident, employees need to be sure of what actions to take.”

“For example, you must not do what is an instinctive act for many people: shut down their computer. If you do that, important evidence in RAM will be lost.”

Every organization must ensure that its plan is updated regularly. Incident response is not a one-time activity, and those who treat it as such could be setting themselves up for failure or greater damage in the event of a breach.

Harrison tells ITPro that it is best to treat incident response as an ongoing process: “Develop a plan and proceed in stages. Remember that solving all problems simultaneously will strain both resources and finances. A measured improvement program is likely to be easier to implement.”

Related Posts

Gang member arrested after beating man unconscious in Porterville | YourCentralValley.com

Motorcyclist dies in accident on I-5 in Tacoma

Student from Yadadri district in Telangana state killed in accident in Florida, USA