Cybersecurity Incident Response Plan: Why the First 24 Hours Matter

Posted May 13, 2019

Nobody wants the phone to ring at 3AM. If the phone is ringing in the pre-dawn hours, chances are something has gone very, very wrong. Unfortunately, thanks to the dramatic rise in the number of cybersecurity incidents, more CEOs and CISOs are being awoken from their slumber than ever before. The message they often hear at the other end of the line?

“We have an incident.”

If they’ve got a cyber incident response plan, they know what their first move should be. If they don’t, the panic is quickly going to set in.

Cyber Incident Response Plan: Why the First 24 Hours After an Incident Matter

You’ve heard the expression “time is money.” It is particularly true when it comes to incident response. The faster an incident or breach is identified and contained, the lower the cost to the organization. In the Ponemon Institute’s “2018 Cost of Data Breach” study, they found that the average cost for each lost record in a breach was $148. Their research found that deploying an incident response team reduced the cost by as much as $14 per compromised record.

And if that incident response team is working quickly? The report noted that companies that contained a breach in less than 30 days saved over $1 million versus those that took more than 30 days.

In short, companies with a strong cyber incident response plan save money. Taking the appropriate steps within the first 24 hours of an incident is crucial for preventing business continuity issues and reducing legal or financial repercussions. Incident response isn’t just about information security – it’s about the financial health of your business.

Now let’s address one thing:

You will experience a cybersecurity incident.

It’s not “if,” it’s “when.” In today’s complex threat environment, it is only a matter of time. We don’t say this to scare you. It’s important to face reality so you can prepare ahead of time and create a cyber incident response plan to guide you. Incident response should never be figured out “on the fly.” Whether you experience malicious programs, ransomware, phishing, Denial-of-Service (DoS), or any other type of cyberattack, there are resources available to you.

If you’re currently experiencing a security incident, call GreyCastle Security immediately at (800) 403-8350.

The immediacy and skill of your incident response team will have a big impact on the end result of any security incident. Despite the growing prevalence of cybersecurity awareness programs within organizations, there is often a failure to prepare and plan for incidents. Limiting damage requires groundwork.

Is your organization “too small” for incident response?

No.

The Ponemon Institute’s “2018 State of Cybersecurity in Small and Medium Size Businesses” study found that small and medium businesses are facing the same cyber risks as larger organizations – but only 28% of respondents rated their ability to mitigate risks as “highly effective.” The study also showed that 67% of small and medium businesses experienced a cyberattack over the last 12 months while 58% experienced a data breach.

Organizations of all sizes are at risk and the financial and reputational consequences of an incident can be crippling to a small business. Cybersecurity needs to be the responsibility of everyone in your organization.

What might the first 24 hours of a cybersecurity incident look like?

It’s important to remember that no two incidents are exactly the same. However, whether you get the dreaded 3AM phone call or receive an alert during the course of a normal work day, one principle is the same: rapid response is key.

In the early stage of any cybersecurity incident, senior leadership needs to be looped in and security teams need to go into action. This is where that cyber incident response plan comes into play. It should be somewhere easily accessible – a plan does no good if you can’t find a physical binder or, even worse, have no idea where it lives in the cloud. (You should have also been periodically testing your plan throughout the year.)

Know where you plan lives. Turn to page one.

Being able to react efficiently, skillfully, and appropriately will be key to saving money, time, and the organization’s reputation. A tiered response plan can help you prioritize actions in an escalating situation. A serious breach may require digital forensics as well as legal and public disclosures.

Sticking to your cyber incident response plan will be key to remediation and your incident response team should work quickly to identify and contain the incident. Their work will help terminate the activity. The first step is often to isolate affected systems and, if necessary, deploy backups to ensure business continuity. This may be followed by the need to perform a risk analysis and determine if it is necessary to shut down critical systems. Downtime can result in lost revenue, so these decisions must be weighed carefully.

As the incident response team works to contain the incident, communication components of the incident response plan are triggered. Information about the security incident needs to be shared with executive leadership, the board of directors, legal departments, public relations teams, and other affected departments. These discussions, particularly those among leadership and legal, will evaluate the requirement to disclose the breach to relevant stakeholders and/or the public. Post-crisis, your incident response team will likely need to collaborate with your legal team and compliance officers.

After the incident…

Just because the incident has been contained and remedied doesn’t mean the work is over. Take the time afterward to ask yourself these questions:

Have we completely recovered?
Why and how did this security incident happen?
What can we do to prevent this in the future?
How can we improve our cyber incident response plan based on this occurrence?

You won’t be able to predict when you will experience an incident, but having the ability to respond swiftly and skillfully could make the difference between a successful outcome and a total loss. We recommend making an investment in governance and risk management well before you need to deploy your incident response plan. When you have an internal framework in place, you are more effective at evaluating risk, can track compliance, and will improve your position for detecting and dealing with a security incident.

Is your organization ready to face a security incident? Don’t wait until that 3AM moment. Email GreyCastle Security at intel@greycastlesecurity.com or give us a call at (518) 274-7233 today and we will help you develop an incident response plan that ensures the resilience of your business.