Cyber-attacks grow steadily each year. Hackers have managed to make the internet their playground, holding the data they steal to ransom and getting pay-offs worth millions of dollars. In order to avoid huge profit loss, companies now prioritize strengthening their cyber security.
Aside from investing in a good behavioral attack detection platform, organizations also come up with incident response plans. An incident response plan is an organized approach to managing a breach or security incident. Its main goal is to minimize damage, reduce the data recovery time, and lessen possible costs. Unfortunately they don’t always work effectively, which puts the company’s network security at risk.
In this article, we’ll discuss the reasons why some incident response plans fail and what companies can do to correct these mistakes.
Failure to Integrate the Plan to All Units
Most incident response plans are drafted by executive boards and network security teams. Other units will just rely on being handed the plans without fully understanding how they were created and how they can be properly implemented. Smaller units also tend to devise their own response plans to cater to targeted attacks. But because most cyber-attacks tend to breach the whole network, these units will have a hard time deciding on which response plan to follow. The longer they take action against a threat, the bigger the damage it could cost the company.
The solution: At the core of every effective incident response plan is a comprehensive blueprint. Companies should draft their own playbook to determine specific roles for each employee and to delegate important tasks in the event of a breach. A representative for each department should be present and contribute in the production of this response playbook. These people should be brought in earlier during meetings for them to be able to share their knowledge and opinions on how to better integrate the response plan within their respective departments. These representatives will also be in charge of explaining to their units the proper way of responding to various cyber-attacks. All staff members must understand their roles and responsibilities in the face of a sudden breach.
Absence of Decision Makers
Even with a detailed incident response plan in place, some companies still fail to act quickly in managing cyber threats. Oftentimes, these plans require an organization to make important decisions ASAP. Are they allowed to wipe all servers in the event of an attack? Are they permitted to block servers when a malware is detected, even without approval? What if there’s no administrator around to make these kinds of decisions? Communicating about the breach to the executives and stakeholders also take time, allowing the hackers to dig deeper into the system they’ve penetrated.
The Solution: Assign an “incident captain” who can immediately get in touch with the necessary people in case of a breach. Have point persons for specific types of cyber-attacks so that they can be given the proper information needed to handle the problem. The company should also provide easily accessible quick-response guidelines to facilitate faster decision making.
Generic Responses to Specific Threats
Every company’s need varies when it comes to cyber security. What may have worked for Company A may not necessarily be effective for Company B. Some companies come up with an incident response plan which tends to be generic and not in keeping with their network security needs. When the incident response plan fails to cater to the company’s specific security need, it can result into mismanaged resources, wasted time and effort, and possible profit loss for the company.
The Solution: Identify the company’s most critical information assets. These assets come in the form of customer data, critical intellectual property, and employee database. The incident response team should know which assets have the biggest impact on the organization’s success, and which ones would deter the company largely when taken down by hackers.
A tendency to repeat past mistakes
Incident response plans revolve mostly into fighting an ongoing cyber-attack. After the threat has been managed and eliminated, these companies fail to document information they learned that could help them in handling future threats. Most organizations don’t realize it, but skilled hackers also reuse the same methods and structures when devising succeeding cyber-attacks. Instead of relying on past information, companies would spend time and money just to ward off the same cyber-threats.
The Solution: Organizations should gather and analyze incident reports and organize them into a central repository. Instead of just being reactive, the company can now study past data that will prove helpful in taking down future cyber-threats. Armed with learning from their past mistakes, incident responders can efficiently investigate anomalies and eliminate them quickly.
The incident response plan should be ingrained within all members of the company. Simulated drills or test runs for incident response plans can help employees review the policies and guidelines when dealing with a network security related problem. These activities can also help in identifying the strengths and areas for improvement of the incident response plan.
With the help of a good cyber-attack detection solution, a proper incident response plan can definitely serve as company’s useful weapon in battling inevitable cyber-attacks.
