What Is Incident Response?

In cybersecurity, incident response refers to the tools and techniques through which an organization detects, analyzes, and remediates cyberattacks. Incident response typically includes multiple stakeholders, including IT, security, corporate communications, finance, and legal. The core goal of incident response is twofold.

First, it aims to minimize the impact of disruptive cyber events by detecting and repelling threat actors before they fulfill their objectives—or, failing that, by ensuring that an organization is resilient enough to avoid lasting damage from an attack. An incident response program also analyzes each disruptive event to determine how an organization might prevent similar incidents in the future.

What Is an Incident Response Plan?

An incident response plan is what defines an organization’s incident response program. It outlines all incident response procedures, responsibilities, and mitigation tactics. In most cases, an incident response plan also identifies which cyberattacks an organization is most likely to face—and which have the greatest capacity to cause severe damage if left unaddressed.

Other factors typically covered by an incident response plan include:

The chain of command during and after an incident
Metrics and key performance indicators
How the incident response plan ties into the organization’s core business objectives
Tools and technology such as crisis communication platforms, secure data vaults, and disaster recovery solutions
Post-incident documentation requirements
Post-incident assessment processes
Procedures for dealing with litigation or regulatory penalties.
Incident response training procedures

Why an Incident Response Plan Is Important

Picture two organizations targeted by the same strain of ransomware.

The first organization has a clear strategy for dealing with the threat. Its security team immediately isolates infected systems, identifies the ransomware strain, then determines whether those systems should be sanitized or wiped entirely. The attack is resolved almost as soon as it begins, and the company immediately communicates what transpired to customers and stakeholders.

After the attack, the organization examines what transpired and applies what it learned to improve its security.

Lacking an incident response plan, the second organization takes considerably longer to mobilize and respond to the threat. As a result, the ransomware has the opportunity to spread through significantly more of its infrastructure, locking down multiple business-critical systems in the process. Communication with stakeholders—if it occurs at all—is vague and inconsistent.

These examples make it clear why you need an incident response plan. Without one, whether or not your team can respond efficiently and effectively to a cyberattack is primarily a matter of luck. Given the lasting impact these incidents can have on your business’s reputation, that’s a risk you cannot afford to take.

Put another way, an incident response plan helps your organization minimize reputational and financial damage, comply more effectively with industry regulations, decrease its incident response time, and improve its overall security posture.

In What Scenarios Are an Incident Response Plan Applicable?

Many situations necessitate an incident response plan, including:

Ransomware
Distributed Denial of Service (DDoS) attacks
Malware
Supply chain attacks
Data breaches caused by either malicious or negligent insiders
Phishing and spear-phishing

Incident Response vs. Incident Management

Incident response is part of incident management, though many organizations use the terms interchangeably. The primary difference between the two is that incident management has a broader and more strategic focus. Incident response, on the other hand, is more technical and immediate, focused on directly addressing a cyberattack as it happens.

An incident management strategy typically covers the following:

Preparing management and response plans before cyber incidents
Overseeing incident response efforts during disruptive events
Calling on third-party expertise as necessary
Managing crisis communication channels and plans
Defining the chain of command that should be followed in an incident
Post-incident forensics and follow-up

Incident response, on the other hand, encompasses the following:

Monitoring and initial identification of a potential cyberattack
Notifying relevant personnel of the incident—either internally, via an MSSP, or through an automated threat detection platform
Determining an attack’s specific nature and objective and the most effective way to shut it down
Restoring any compromised systems and data from backups

Who Is Responsible for an Organization’s Incident Response Process?

Although an organization’s security team or IT department typically leads the charge when defining an incident response plan, effective incident response requires input from across the entire organization. Per Gartner, this generally takes the form of a Cyber Incident Response Team (CIRT). In addition to technical experts, Gartner recommends that an organization’s CIRT include “experts who can guide enterprise executives on appropriate communication in the wake of [security] incidents.”

The analyst further notes that an organization’s CIRT usually collaborates with other groups, such as security, disaster recovery, and public relations.

Incident Response Plan Steps

According to the SANS Institute’s Incident Handler’s Handbook, a typical cyber incident plan can be broken down into six steps or phases, each with its own best practices.

Preparation

Ensure your incident response plan is clearly defined and flexible enough to adapt to unexpected cyber events
IR documentation should be readily available to all personnel and lay out all policies, strategies, and processes
Deploy IR tools wholly isolated from your business’s ecosystem and regularly test them for efficacy
Incorporate incident response training and preparedness into organizational culture

Identification

Maintain consistent, real-time visibility into your attack surface through solutions such as Extended Detection and Response (XDR)
Proactively hunt down threats and vulnerabilities within your ecosystem
Embrace Zero Trust Network Access (ZTNA) along with some form of intrusion detection and prevention

Containment

Leverage technology such as advanced Endpoint Protection Platforms (EPPs) that can swiftly and effectively identify and isolate threats
Ensure every system, asset, and device can be swiftly air-gapped from your ecosystem
Maintain comprehensive logfiles for potential use as digital forensics

Eradication

Sanitize or wipe clean all infected systems
Before you restore from backup, make absolutely certain your backups don’t contain the just-eliminated threat
Lock down any potential avenues through which a threat actor might regain access to your organization

Recovery

As you restore operations, continue to monitor, test, and validate all assets and data for signs of compromise
Set a realistic roadmap for full recovery; communicate this to your stakeholders with the potential short- and long-term impacts

Assessment

Review the entire incident to answer the following questions:
- What happened?
- How did it happen?
- How can we prevent this from happening in the future?
Evaluate the effectiveness of your incident response plan and identify any potential areas that may be improved for future incidents

BlackBerry for Incident Response

Get immediate help from BlackBerry Cybersecurity Services—whether you're under cyberattack, need to contain a breach or want to develop an incident response plan. Report an incident or call us now at +1-888-808-3119.

Report an Incident