Incident response is one of the final frontiers of security that the majority of businesses have yet to explore. Although most have the written policies and the proper technologies, many enterprises are ill-prepared for that unexpected and often undetected security incident. This general lack of preparedness has created a “wing it” attitude over the years. Even worse, IT and security teams frequently lack clear goals, and executive management and board members are too disconnected from the security function to bridge this gap.

Management often assumes that IT and security have everything under control. After all, good money was spent on security, so things should be locked down and incidents shouldn’t occur, right? On the other hand, many IT and security professionals believe they can handle an incident and everything that comes with it. That may be true from a technical perspective, but dealing with the people and business side of a security incident is an entirely different matter that requires different people and various skill sets within the organization.

Listen to the podcast: Get Smarter About Disaster Response — Five Resolutions for 2018

Who Is Involved?

So, who needs to be on your incident response team? The answer is straightforward in many ways. Computer security-related incidents are like other business crises: You have the right people in the right roles to execute a predeveloped plan that will minimize the impact on the business.

Still, it is security, so there’s going to be politics, resistance and downright ignorance among those involved. Here are the roles that I’ve seen taking part in the response process in fully functioning security programs:

  • Legal counsel to provide oversight and guidance on steps to take or not take;
  • Executive management for decision-making at the executive/board level;
  • IT and security teams for technical guidance and execution of the initial incident response phases;
  • Compliance for assistance with incident oversight and follow up, including any breach notification or reporting that may be required;
  • Business operations for guidance and communications across departments and teams;
  • Human resources for facilitating internal communications and assisting with user-centric security policies that may have been violated;
  • Public relations expertise from someone who has experience in this area and a prepared message;
  • Outside consultants who can provide incident response, forensics and security testing expertise;
  • Vendors such as internet service providers (ISPs), cloud service providers and managed security service providers (MSSPs); and
  • Business partners that have close technical ties to your environment.

Leading With Prevention

Incident response planning should focus on prevention. It requires proactively monitoring for incidents. After the incident occurs, it involves proper containment and clean up. It may impact sensitive information and thus require a formal investigation. The process and findings need to be communicated to all the parties involved — potentially including the general public. It has to have follow up, adjustment and ongoing oversight. Every single role in the list above is required to make these things happen.

When you look at some of the biggest breaches, it seems that incident response was a fleeting thought up until the moment of detection. In many cases, it is then, and only then, that response procedures are ever considered. There’s irony in the fact that executive management and legal suddenly take an interest in security if the news media gets involved and shareholders come calling. That’s certainly not the time for security buy-in to finally happen.

Along the lines of the Chinese proverb, the best time to start developing, testing and fleshing out your incident response plan was 20 years ago. The second best time is now. The former applies to organizations that have already suffered breaches. The latter applies to everyone else.

Start Now

Get started on incident response today. The time’s going to pass anyway, so why not start now to make things right? Round up the necessary people, come up with a plan or update your existing one and run tabletop exercises with the team to see how it will all come together. Your main goal should be to maximize the chances of the plan working once it’s executed in a real-world scenario. If it does, you will come across as a true professional with a bit of security wisdom. If it doesn’t, you will come across as a harried beginner who doesn’t take security as seriously as others assumed.

In the end, your incident response team should be made up of people who are the best fit for your organization’s needs. Just make sure it’s people outside of IT and security. As Einstein said, “We cannot solve our problems with the same thinking we used when we created them.” Change before you’re forced to. Getting all the right people involved with incident response will make a tremendous difference in your efforts not if, but when, the big incident occurs.

Learn More About IBM’s Incident Response and Intelligence Services

More from CISO

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…

Reporting Healthcare Cyber Incidents Under New CIRCIA Rules

Numerous high-profile cybersecurity events in recent years, such as the Colonial Pipeline and SolarWinds attacks, spurred the US government to implement new legislation. In response to the growing threat, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in March 2022.While the law has passed, many healthcare organizations remain uncertain about how it will directly affect them. If your organization has questions about what steps to take and what the law means for your processes,…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…