1.7: Incidence Response

Incident Management in Cyber Security

In the field of cybersecurity, incident management can be defined as the process of identifying, managing, recording, and analyzing the security threats and incidents related to cybersecurity in the real world. This is a very important step after a cyber disaster or before a cyber disaster takes place in an IT infrastructure. This process includes knowledge and experience. Good incident management can reduce the adverse effects of cyber destruction and can prevent a cyber-attack from taking place. It can prevent the compromising of a large number of data leaks. An organization without a good incident response plan can become a victim of a cyber-attack in which the data of the organization can be compromised at large.

There is a five-step process for incident management in cybersecurity given by the ISO/IEC Standard 27035. They are as follows.
Step-1 :
The process of incident management starts with an alert that reports an incident that took place. Then comes the engagement of the incident response team (IRT). Prepare for handling incidents.

Step-2 :
Identification of potential security incidents by monitoring and report all incidents.

Step-3 :
Assessment of identified incidents to determine the appropriate next steps for mitigating the risk.

Step-4 :
Respond to the incident by containing, investigating, and resolving it (based on the outcome of step 3).

Step-5 :
Learn and document key takeaways from every incident.

Some tips for security incident management :

• Each and every organization needs to have a good and matured plan for the security incident management process, implementing the best process is very useful to make a comprehensive security incident management plan.
• Create a security incident management plan with supporting policies including proper guidance on how incidents are detected, reported, assessed, and responded. It should have a checklist ready. The checklist will be containing actions based on the threat. The security incident management plan has to be continuously updated with security incident management procedures as necessary, particularly with lessons learned from prior incidents.
• Creating an Incident Response Team (IRT) which will work on clearly defined roles and responsibilities. The IRT will also include functional roles like finance, legal, communication, and operations.
• Always create regular training and mock drills for security incident management procedures. This improves the functionality of the IRT and also keep them on their toes.
• Always perform a post-incident analysis after any security incident to learn from any success and failure and make necessary adjustments to the program and incident management processes when needed.

Necessary part of incident response :
Always make a habit of collecting evidence and analyze forensics which is a necessary part of incident response. For these circumstances, the following things are needed.

1. A well-defined policy to collect evidence to ensure that it is correct and very much sufficient to make it admissible in the Court of Law.
2. It is also importantly needed to have the ability to employ forensics as needed for analysis, reporting, and investigation.
3. The personnel of the IRT must be trained in cyber forensics, functional techniques and would also have some knowledge in the legal and governance.

Adapted from:
"Incident Management in Cyber Security" by user_7wot, Geeks for Geeks is licensed under CC BY-SA 4.0