Incident response is the network’s first line of defense against cybercrime. To achieve your own incident response, you need to create an incident response plan, an abbreviated incident response playbook, an incident response team, and support the operation with incident response tools. Read on this article by Gilad David Maayan to learn about each of these unique components of incident response.
What Is Incident Response (IR)?
Incident response is a set of practices and tools implemented when organizations respond to cybersecurity incidents.
The goal of incident response is to ensure the fastest response to cybersecurity events, thus preventing, blocking, and fixing threats before a breach can threaten the network.
Incident response teams use practices and tools to identify cyberattacks, remediate swiftly, apply fixes, and sometimes perform analysis and offer optimization insights.
4 Components of Incident Response Incident response is composed of four elements—a plan, a playbook, a team, and tools. Each organization applies these components differently, and may opt to leverage some but not all of these elements.
Learn More: Threat Hunting: How to Actively Monitor Your SystemOpens a new window
1. Incident Response Plan
An incident response plan is a process that describes in detail all steps, practices, tools, and resources used while responding to security events.
Incident response plans are typically based on two types of frameworks, offered by SANS and NIST.
The 6-Step SANS Incident Response Process
A 20-page handbook written and published by the SANS Institute, which is ranked as a global leader in cybersecurity education and training.
Here are the six steps every SANS-based incident response plan should follow:
- Preparation—what to do before incidents occur
- Identification—how to distinguish real security incidents from false positives
- Containment—which steps to take for the purpose of blocking an incident
- Eradication—take measures to remove the root cause of the incident
- Recovery—recover systems, bring them back online, and test for issues
- Lessons learned—analyze the incident and make plans to prevent future occurrences
The 7-Step NIST Incident Response Process
NIST is operated by the U.S. Department of Commerce. The NIST Handling Guide offers incident response guidelines, which are focused on creating incident response teams.
Here are the seven steps every NIST-based incident response plan should follow:
- Prioritize and scope—assess and rank assets based on a hierarchy of importance
- Orient—conduct a vulnerability and threat assessment
- Create a current profile—document your current cybersecurity baseline
- Conduct a risk assessment—analyze previous, current, and possible risk management
- Create a target profile—outline your desired cybersecurity outcomes
- Determine, analyze and prioritize gaps—create a prioritized action plan for gaps
- Implement action plan—begin applying steps to achieve your target profile
See this incident response stepsOpens a new window guide for more information about creating your incident response plan.
Learn More: 10 Ways to Identify and Fix Open Source Vulnerabilities in 2019Opens a new window
2. Incident Response Playbook
An incident response playbook is a guide that outlines the quick action steps teams need to take when responding to cybersecurity events.
The incident response playbook is based on the incident response plan. The main difference is length—a plan is a long and detailed document, whereas a playbook contains short and actionable action steps for specific incident scenarios.
There are typically two types of incident response playbooks:
- Manual playbook—a document outlining step-by-step instructions for each scenario, defining the person in charge, the responders, and specific response steps.
- Automated process—a technological tool that integrates with systems that require protection. This tool runs a script that executes the playbook automatically.
You can opt for one of the above options, or use them together. Typically, an automated incident response process is integrated into the process as a supplement to the response team.
3. Computer Security Incident Response Team (CSIRT)
A Computer Security Incident Response Team (CSIRT) is composed of cybersecurity professionals. The core responsibility of the CSIRT is responding to cybersecurity incidents.
Here are the most common jobs carried out by a CSIRT:
- Creating an incident response plan
- Managing and responding to cybersecurity events
- Performing post-event research
- Providing and applying optimization guidelines for the response process
- Creating educational resources such as training guides and papers
- Mediating between the organization and the press during events
- Controlling internal communications during security events
- Recommend the implementation of new and additional cybersecurity policies and tools
CSIRT units are typically categorized into four main types:
- Centralized—this is an in-house CSIRT unit that handles the organization’s incident response operation.
- Distributed—third-party CSIRT units that collaborate while responding to events. Distributed CSIRT units are usually managed by a coordinating team.
- Coordinating—a CSIRT unit that manages multiple CSIRT units. This team doesn’t respond to events, only coordinates between distributed teams.
- Hybrid—a collaboration between centralized, distributed, and coordinating CSIRT units. The centralized team is usually the coordinating team that manages distributed units.
Learn More: A Deep Dive Into Kubernetes MonitoringOpens a new window
You can learn more about CSIRT units hereOpens a new window .
4. Incident Response Tools
Incident response tools serve the organization’s incident response efforts. These tools can be dedicated incident response solutions, or general cybersecurity tools. There’s a wide range of free and paid tools, which is why it’s important to introduce only the tools that fit your operation, environments, systems, skillset, and objectives.
Here are a few common tools used for incident response:
- Automated vulnerability management—scans the systems for vulnerabilities and prompts action based on pre-configured prioritization.
- Automated event notification—scans the systems for malicious behavior and prompts action based on pre-configured policies.
- Automated incident response—monitors the systems, sends alerts, and responds when possible.
- AI-based User Behavior Analytics (UBA)—monitors behavior and identifies malicious behavior based on pre-established sets of normal behavior.
Each of the above tools serves a unique and important function in the incident response process. Some tools are restricted to one of the above functions, while others offer end-to-end solutions. Figure out what you need, what is your budget, and then choose accordingly.
Conclusion
Incident response is the process that protects your network, systems, data, and user during cybersecurity events. In today’s chaotic digital sphere, which is filled with cybercrime, it’s crucial to ensure the protection of your network and its contents.
Each network should be assessed and then protected based on its needs and limitations. Hopefully, this article has helped you understand the importance of incident response, and how to take your first steps towards implementing or optimize your incident response process.
Let us know if you liked this article on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!