Incident Response Planning: In Depth

What is Incident Response Planning?
Incident Response Planning (IRP) serves as a critical framework within organizations that aims to manage and mitigate potential security incidents. At its core, the establishment of a clear IRP
comprises three essential components – Plan, Policy, and Procedure.

The Policy delineates the overarching principles and guidelines governing incident response efforts.
The Plan outlines specific strategies and actions to be undertaken in response to different
types of incidents, ensuring a structured approach to incident resolution.
The Procedure delineates the step-by-step processes and protocols to be followed during
incident detection, analysis, containment, eradication, and recovery phases.

A successful IRP prioritizes the importance of information sharing, both internally at all levels,
and externally with appropriate entities. This information sharing fosters collaboration and swift
incident resolution. By integrating these elements, organizations can fortify their resilience against security threats and minimize the impact of potential incidents on their operations and
assets.

Below is our in-depth guide to what you should consider when setting up an IRP.

What is the goal of an IRP?
The primary goal of an IRP is to identify the types of threats and vulnerabilities that are specific
to your organization. it should prioritise these threats in terms of their potential impact on your
operations, data integrity, and reputation, and identify how to mitigate them. This documented
plan should facilitate resource allocation and strategic planning, ensuring that critical threats
receive prompt attention and are handled appropriately.

Businesses often precede IRP with a thorough Business Impact Analysis (BIA) and the formulation of a Business Continuity Plan (BCP). These documents work in concert with the IRP to provide planning and preparation at different levels and for different audiences.

Who is responsible for the IRP?
Within the framework of Incident Response Planning (IRP), the formation of an effective
IRP/Security Team stands as a cornerstone for swift and coordinated incident management.

You should begin by selecting individuals with expertise across relevant domains such as IT,
cybersecurity, legal, human resources, and executive leadership. This diverse group is needed to bring all relevant insights and skills vital for planning responses to different types of incident
scenarios. Furthermore, understanding organizational dependencies is key to ensure collaboration during incident response efforts. By advocating for the interdependencies between departments, systems, and processes, the team can streamline communication channels, optimize resource utilization, and mitigate potential disruptions to critical business functions.

Through proactive planning and collaboration, the Security Team enhances the organization's readiness to effectively address and mitigate the impact of security incidents, safeguarding its assets, reputation, and continuity of operations.

Note that a team working on IRP might be merged with the other security functions such as BCP
(Business Continuity Planning), DRP (Disaster Recovery Planning), and any other teams bearing
responsibility for managing security at your organization. It is acceptable for a general Security
Team to be responsible for all of these as all plans should work in concert with one another to
achieve the same outcome.

What should the IRP contain?
Incident preparation
Preparation serves as a foundational pillar for effective response to potential security breaches or disruptions within an organization. The preparatory phase involves equipping the team to handle an array of potential incidents that could impact business operations or compromise data integrity.

You should have two distinct parts to your incident preparation:

Response preparation that outlines how you react in the event of an attack. This will be the bulk of your IRP
Preventative mitigations that will reduce your chances of attack. These actions may be shared with your general BCP and other cyber security planning.

Finally, it is essential that your IRP establishes clear criteria for escalating incidents to the
appropriate stakeholders or authorities to ensure timely and appropriate intervention in response
to emerging threats.

Part 1 – Response preparation elements

Detection & analysis

Establish how you might be targeted
Put processes in place to help you assess and prioritize incidents as they are under way
Establish a plan to prioritize where resources go and when
Consider what mandatory reporting is required internally and externally for an incident

Firstly, your IRP team should anticipate how the organization might be targeted. This analysis
should envision the appearance of an attack, and its potential methods and vectors. Document
the potential attacks, and the resources you would need to detect them (anti -virus, EPP etc.), to
ensure you are well equipped.

Secondly, you should put in place meticulous procedures to analyze and assess potential attacks, to ensure a swift and accurate response. This includes processes for identifying where the point of access is, and what network components are impacted.

Next, establish prioritization mechanisms, to enable the organization to allocate resources based on the severity and impact of incidents. You should also decide how you will communicate these priorities inside the organization, and which teams, or external authorities, need to be made aware and how to do this.

Throughout the detection, consider your need to adhere to relevant laws, regulations, and
industry standards is paramount, guiding the organization's response and ensuring compliance
throughout the incident management process.

As you go through this process, know that any list you come up with now will likely not be
comprehensive. This is ok - threat actors constantly try to find novel attack opportunities, and
you will always be playing catch up to an extent. This preparation will give your organization the
best chance of anticipating an attack, but you should intend to improve and refine it over time as
you learn more.

Containment & eradication

Identify what tools are available to contain and neutralize an incident. Who operates them and how are they activated?
How will your teams document the incident for future decision making?
How and when will you identify the root cause of the issue?

During the critical phases of containment & eradication, you must swiftly and decisively neutralize threats and restore normalcy to operations. You will need to plan how to localize the incident through containment measures, preventing its spread, and limiting further damage to the organization's systems and data. At this stage consider the resources and tools you may need to do this (EDR, Sandboxes, etc).

In parallel, document how your teams will go about information gathering, and clearly state your
expectation for teams to actively collect and analyze incident data appropriately. This includes
accurately documenting incidents, to create a comprehensive record that aids in post-incident
analysis and learning, ensuring your logging systems are logging incoming network traffic
appropriately and accurately.

Finally for this stage: identify how you expect root cause analysis to be conducted to identify the
source of the incident, leveraging available resources such as forensic tools, logs, and expertise
within the organization. Factor in whether you consider it important to do this as the event
unfurls, or if it can be done after things have been secured.

Recovery

Establish a Recovery Time Objective (RTO), which outlines the maximum acceptable downtime for critical systems
Establish a Recovery Point Objective (RPO), specifying the acceptable amount of data loss.

Following containment and eradication efforts, the focus shifts towards recovery, with
meticulous planning and execution of steps to restore affected systems and data.

By establishing an RTO and an RPO, you are setting acceptable thresholds or operational
downtime and data loss, which help your organization understand the severity an impact of an
incident by how far under over the metric it has gone.

These metrics guide the restoration process, ensuring that operations resume within acceptable timeframes and minimizing the impact of the incident on business continuity.

For cyber security, a large amount of this process will be managed by your IT specialists and their Disaster Recovery Plan (DRP). This plan may be more of a concern to the IT team, but it should still be reviewed by all representatives from the business (just as the IRP is) to ensure it works in concert with other elements of your security plans such as IRP and BCP.

Review
In the aftermath of a security incident, you must plan to undertake Post -Incident Activities, to
enhance organizational resilience and preparedness for future threats. This should involve all
members of the IRP/Security Team to get perspectives of all parts of the business. Through
examination of the incident, your team should attempt to shed light on weaknesses within the
organization's defenses and operational practices, illuminating areas for improvement.

Initially, there should be a thorough review that follows shortly after the incident to glean insights
from the incident, encompassing both external factors and internal posture.

After that you must plan to analyze beyond the immediate incident, delving into the broader
threat landscape and external factors impacting the organization.

Part 2 – Preventative mitigations

Detection & analysis
Preventative mitigations play a crucial role in reducing risks and fortifying defenses against known threats to the organization and network infrastructure.

By preparing for potential incidents and bolstering preventive measures, organizations can fortify their resilience and minimize the impact of security incidents on their operations and assets.

This includes:

Bolstering internal cybersecurity posture through enhanced security measures, processes, and employee awareness programs.
Protocols established for maintaining and storing evidence, ensuring compliance with legal and internal requirements for potential investigations or audits.
Regular training sessions for the incident response team appropriate to their advanced
responsibilities, and their need to understand core security principles for the whole organization.
Regular training sessions for all employees, emphasizing cybersecurity best practices, incident detection, and response procedures
Continuous Improvement through review and refinement, incorporating insights gleaned from incidents, evolving threats, and changes to the organization's environment.
Tabletop exercises to hone the effectiveness of IRP processes and team readiness by
challenging teams to respond to hypothetical incidents, fostering preparedness and identifying areas for improvement.

Remember - as you become more experienced in Incident Response Planning, these elements will change and evolve to suit your organization’s specific needs. this is done by continuously
reviewing and reflecting on how your organization handles incidents with your Security Team, as
well as conforming to requirements set by regulators, governing bodies, and insurers.

By embracing a culture of continuous learning and improvement, organizations can bolster their
resilience against cyber threats and enhance their ability to detect, respond to, and recover from
security incidents effectively.

Communication
Throughout the IRP you should think about communication at multiple levels, and to multiple
audiences. Internally, meticulous preparation involves establishing tables of internal personnel
and stakeholders to be contacted, delineating specific tasks and responsibilities to be carried out by each individual or team. This ensures clarity and accountability, facilitating swift and
coordinated response efforts.

A security incident is an inherently disruptive and potentially chaotic experience, and this will be
compounded by inadequate communications and a lack of transparency. In some cases you may be compelled by law or regulatory bodies to communicate with individuals in a certain window of time, so it is essential you factor this requirement into the IRP. You will want to consider:

Communication between stakeholders in the IRP/Security team, and how to balance team
interests and the interests of the organization as a whole
Communication with the rest of the organization about what the IRP is, and how to use it in an emergency
Communication with third party vendors and support who may have a vital role to play in
resolution
Communication with authorities – law enforcement, mandated reporting of cyber security
events to certain bodies, legal teams, etc
Communication to the Public – in the event of an attack you may need to make public
statements, give responses to media questions, or respond to public concerns

Conclusions
Developing an effective Incident Response Plan is essential for organizations to mitigate the
impact of cyber incidents and safeguard their assets, reputation, and stakeholder trust. By
considering the key factors outlined above and adopting a proactive approach to incident
preparedness, organizations will enhance their resilience to cyber threats and minimize disruption to business operations.

If you have any questions about the contents of this guide, please reach out to
support@kynd.io where our team will be happy to help.