Incident response is one of the final frontiers of security that the majority of businesses have yet to explore. Although most have the written policies and the proper technologies, many enterprises are ill-prepared for that unexpected and often undetected security incident. This general lack of preparedness has created a “wing it” attitude over the years. Even worse, IT and security teams frequently lack clear goals, and executive management and board members are too disconnected from the security function to bridge this gap.

Management often assumes that IT and security have everything under control. After all, good money was spent on security, so things should be locked down and incidents shouldn’t occur, right? On the other hand, many IT and security professionals believe they can handle an incident and everything that comes with it. That may be true from a technical perspective, but dealing with the people and business side of a security incident is an entirely different matter that requires different people and various skill sets within the organization.

Listen to the podcast: Get Smarter About Disaster Response — Five Resolutions for 2018

Who Is Involved?

So, who needs to be on your incident response team? The answer is straightforward in many ways. Computer security-related incidents are like other business crises: You have the right people in the right roles to execute a predeveloped plan that will minimize the impact on the business.

Still, it is security, so there’s going to be politics, resistance and downright ignorance among those involved. Here are the roles that I’ve seen taking part in the response process in fully functioning security programs:

  • Legal counsel to provide oversight and guidance on steps to take or not take;
  • Executive management for decision-making at the executive/board level;
  • IT and security teams for technical guidance and execution of the initial incident response phases;
  • Compliance for assistance with incident oversight and follow up, including any breach notification or reporting that may be required;
  • Business operations for guidance and communications across departments and teams;
  • Human resources for facilitating internal communications and assisting with user-centric security policies that may have been violated;
  • Public relations expertise from someone who has experience in this area and a prepared message;
  • Outside consultants who can provide incident response, forensics and security testing expertise;
  • Vendors such as internet service providers (ISPs), cloud service providers and managed security service providers (MSSPs); and
  • Business partners that have close technical ties to your environment.

Leading With Prevention

Incident response planning should focus on prevention. It requires proactively monitoring for incidents. After the incident occurs, it involves proper containment and clean up. It may impact sensitive information and thus require a formal investigation. The process and findings need to be communicated to all the parties involved — potentially including the general public. It has to have follow up, adjustment and ongoing oversight. Every single role in the list above is required to make these things happen.

When you look at some of the biggest breaches, it seems that incident response was a fleeting thought up until the moment of detection. In many cases, it is then, and only then, that response procedures are ever considered. There’s irony in the fact that executive management and legal suddenly take an interest in security if the news media gets involved and shareholders come calling. That’s certainly not the time for security buy-in to finally happen.

Along the lines of the Chinese proverb, the best time to start developing, testing and fleshing out your incident response plan was 20 years ago. The second best time is now. The former applies to organizations that have already suffered breaches. The latter applies to everyone else.

Start Now

Get started on incident response today. The time’s going to pass anyway, so why not start now to make things right? Round up the necessary people, come up with a plan or update your existing one and run tabletop exercises with the team to see how it will all come together. Your main goal should be to maximize the chances of the plan working once it’s executed in a real-world scenario. If it does, you will come across as a true professional with a bit of security wisdom. If it doesn’t, you will come across as a harried beginner who doesn’t take security as seriously as others assumed.

In the end, your incident response team should be made up of people who are the best fit for your organization’s needs. Just make sure it’s people outside of IT and security. As Einstein said, “We cannot solve our problems with the same thinking we used when we created them.” Change before you’re forced to. Getting all the right people involved with incident response will make a tremendous difference in your efforts not if, but when, the big incident occurs.

Learn More About IBM’s Incident Response and Intelligence Services

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…