Incident Response Plan – How to handle ransomware & security breaches

What are the steps in the Incident Response Process?

Based on the NIST framework, GlacisTech utilizes a 7-step Incident Response Process which includes:

1. Preparation 

This phase of the incident response process is one of the most critical steps and includes;

Completing an in-depth risk assessment to uncover vulnerabilities and weaknesses

• Implementing required software tools to shore up potential weaknesses, updating and patching where necessary
• Identifying Incident Response Plan team and documenting roles and responsibilities
• Preparing or updating organizational security policies and processes- including the detailed incident response steps, disaster recovery, access controls, cyber insurance, and documenting the organization’s policy on negotiating and paying ransom demands
• Training employees through proven cyber awareness training techniques
• Running penetration tests, mock drills, and table-top exercises to verify IRP system tools and processes

2. Detection

The second phase of the IR process is discovering and detecting a cyber incident or breach. Detection is accomplished through a set of AI-empowered and advanced detection tools, in addition to 24/7 monitoring of the network to spot anomalies and potential intrusions. Detection is integrated with automated alert systems that immediately notify the appropriate stakeholders of a potential security breach and automatically initiate analyzing and classifying the incident in preparation for the next step. Document all detection steps and details for post-incident reporting.

3. Containment

The third phase of the incident response process involves isolating and quarantining the malware to mitigate damage. It is critical to preserve all physical and digital evidence for forensic analysis, so containment of the impacted systems is quarantined in a controlled environment for further investigation. Communication to affected parties is initiated based on the policies and processes developed in the Preparation phase based on initial analysis of the impact. Document all containment steps and details for post-incident reporting.

4. Investigation

In the quarantined, controlled environment, further investigation of the cyber incident is conducted to identify a baseline of normal activity, collect data points on anomalies, identify attacking host and threat actors, analyze critical services and stakeholders impacted, and conduct communication with the threat actor based on the documented policies and procedures to determine the remediation strategy and tactics required. Document all investigation steps and details for post-incident reporting.

5. Remediation

The remediation strategy and tactics utilized will depend on the specific incident, systems and critical functions impacted, and potential damage assessments. Once all evidence is documented for forensic analysis, the removal or eradication of all elements of the incident proceeds. This could include removing all malware, securing access controls, and resetting passwords. Document all remediation steps and details for post-incident reporting.

6. Recover & Restore

Based on the disaster recovery processes designed and documented in the preparation phase of the IR process, begin recovering data and systems from protected backups to restore normal operations as quickly as possible. This phase will also include any additional updates, patches, and retesting to ensure the systems won’t be impacted again. Document all recover and restore steps and details for post-incident reporting.

7. Post-Incident Activity

Once the cyber incident is remediated, and under control, a series of post-incident activities are completed and could include:

• Collection and organization of all documentation from previous steps for post-incident reporting – this could consist of forensic investigations, reports to regulatory agencies, law enforcement, board, executive stakeholders, or other entities
• Conduct internal reviews to examine data and garner information on what worked and where improvements to policies, processes, and toolsets could help prevent and mitigate future exposures
• Conduct follow-up tests of anti-malware software, content & spam filters, and advanced protection systems
• Perform software updates and patches as necessary based on insights gleaned from post-incident activities
• Review incident response plan and update as necessary based on insights

It’s important to note that each step of the incident response process should contain feedback loops to provide learnings in a non-linear manner. In other words, organizations should view the process as an ‘always evolving’ process for doing, learning, and tweaking to ensure a robust and up-to-date process that provides organizational resilience to cyber threats. After all, bad actors continue to evolve their methods. And cybercrime is a highly organized, efficient, and lethal business model that mandates 24/7 organizational vigilance to prevent falling prey.