Organizations that have a documented incident response plan and an IR team, whether it’s internal, external or a combination of both, can respond to a breach more quickly than those who don’t. Organizations that are able to complete an investigation in 30 days or less save an average of USD 1,000,000 over those who don’t.
Furthermore, organizations that document their plans and test them quarterly or biannually are able to more effectively prepare for security incidents and practice their response actions in advance of a real attack. This allows these enterprises to accelerate the process of response and investigation, greatly reducing data exposure and financial losses.
An effective response plan should contain a broad scope of technical and nontechnical actions that need to be conducted by all stakeholders within the environment. This requires leaders to ask questions such as:
- Does the information security team have the data needed to perform live responses on hosts in the environment? Is that data searchable from a central location? Are analysts able to pull data from or images of remote hosts when needed?
- Does the organization have contracts in place with external crisis communications firms, outside legal counsel specializing in privacy and experienced incident response firms who can supplement the internal teams?
- How do stakeholders within the organization communicate with each other when there is concern that email systems may be compromised by an unauthorized actor?
- What information are employees authorized to communicate to third parties during a breach, if any? Are employees aware of this policy?
- What type of communications will be shared with the news media by the organization? Are there holding statements already crafted that can be used in a crisis?
Documenting and regularly testing a variety of scenarios helps organizations determine where gaps may exist. Most importantly, this enables security teams to fix vulnerabilities in advance of a breach.
