INCIDENT RESPONSE PLAYBOOKS

An incident response plan is the final line of defense before disaster declaration. Incident response playbooks provide the tools and training necessary for cyber security response teams to act according to a pre-established plan of action. Furthermore, proper handling of incidents is necessary to reduce business impact and to avoid damage to information that supports follow-up investigations and digital forensics.

A proactive response, swift containment, and the effective remediation of cyber incidents delivers value for an organization by circumventing or reducing business impact. Having a functioning playbook reduces the likelihood of successful attacks and preserves the organizations brand while maintaining client and investor confidence. Business resilience will consequently improve by including a comprehensive response plan in the organization’s risk management process.

To be effective, playbooks document the processes and standard operating procedures to capture data needed for detection, containment, recovery, and forensics. Additionally, following an incident, the procedures for post-incident activity provide the means for ongoing improvements to the incident plan.

As the ongoing maturity of an incident response plan is determined by its level of orchestration and effectiveness, organizations should further ensure that governance activities improve the operational efficiencies of their security practices and continuously increase in value at risk.

We begin by conducting a gap analysis on the people, processes, and technology related to incident detection and response capabilities.

We then work with our clients to help them select and prioritize the development of incident response playbooks based on business impact and covering one or more of the incident categories below:

The service establishes the roles and responsibilities of key personel involved in incident response and its management. It also establishes escalation paths for both internal and external stakeholders. We then review and establish standard and custom threat indicators for detecting threats and a process for categorizing them. We document the evidence-collection and recording procedures and the factors contributing to triaging risk appropriately. The service reviews and establishes controls and mitigation procedures for containing and eradicating threats. It also includes the procedures for performing data forensics and recovering systems following an incident. We finally establish post-incident reviews and methods for documenting improvement plans by establishing Key Performance Indicators (KPIs).