According to the UK Government’s recent Cyber Security Breaches survey, only 23% of UK businesses have a formal incident response plan in place today, says Ryan McConechy, CTO of Barrier Networks, who sets out 10 steps to help refine cyber response strategy
This is a concerning statistic.
It could suggest that most organisations would be completely unprepared to safely manage the fallout of a cyberattack, making them more vulnerable to long-lasting, potentially irrecoverable, damage.
It’s widely accepted that not all cyberattacks can be prevented today. Organisations can implement advanced defences, but criminals will still find a way to exploit their protections and execute attacks.
As a result, for organisations to strengthen their cyber resilience, they shouldn’t only focus on keeping criminals out of their environments. They must also run comprehensive incident response planning and exercising to safeguard recovery, even in the wake of major attacks.
But what are the best practices organisations should adopt to confirm their incident response planning is a success, ensuring it safeguards the resumption of services, protects customers, staff and stakeholders and limits the possibility of irreparable financial and reputational damage?
Incident response – ten steps for success
1. Have a robust, frequently updated plan, that is accessible
An incident response plan should be clearly written, easy to follow and accessible to all relevant personnel. It must outline how incidents will be detected, reported, assessed, contained and resolved. The plan must also be updated regularly to account for technology and staff changes, and to align with any changes regarding the focus of the business.
2. Keep a physical copy of the plan
In the event of a cyberattack, especially ransomware, or a digital outage, systems and networks can quickly become unavailable. This means having a physical copy of the incident response plan is vital. It is also important to ensure the document can be accessed by key incident response stakeholders, who know how to locate the hard copy.
3. Agree roles and responsibilities
During a crisis, confusion over who is responsible for what can delay response and amplify damage. Assign specific roles well in advance to ensure everyone understands their responsibilities.
4. Establish communication methods in advance
Communication systems may be compromised during a major incident. Define alternative communication channels (e.g., secure messaging apps, satellite phones, out-of-band email systems) and establish protocols for activating them. This ensures coordinated action, even under duress.
5. Rehearse the plan regularly
Having a plan written down in theory is not enough to ensure it works in practice.
Tabletop exercises and simulated attacks allow organisations to test their incident response plan under realistic conditions. These rehearsals uncover gaps, clarify procedures and help the incident response team rehearse their roles and build confidence.
6. Know which systems must be restored first
Restoring all systems at once is often impractical. Identify and prioritise critical systems in advance. Is email the first to be restored, or employee network access, or operational technology, or platforms which facilitate customer access?
These are questions which must be considered and, where possible, answered in advance of incidents.
7. Define communications statements
When a breach occurs, time is of the essence in informing stakeholders, customers and potentially the public. Having pre-drafted holding statements, which can be built upon with specific details around an incident, can speed up the distribution of communications statements. This not only keeps customers and stakeholders updated but it also helps prevent harmful speculation which can damage an organisation’s reputation.
8. Run backups – following the 3-2-1-1-0 rule
Follow the modern 3-2-1-1-0 backup strategy: keep 3 total copies of your data, stored on 2 different types of media, with 1 copy stored offsite or offline, 1 immutable or air-gapped copy and then test the backups to ensure 0 errors after recovery.
This dramatically increases resilience against data loss, corruption and ransomware.
Testing backups is as important as running them, because this is the only way to confirm organisations can rely on them when things go wrong.
Ransomware attackers will typically go after backup services to put them in a more powerful position when demanding payment, so ensuring organisations have offline backups, that are regularly tested, is vital in safeguarding recovery.
9. Understand regulatory notification requirements
Regulators across varying regions have specific reporting requirements on personal data breaches and cyberattacks. Understanding these regulations and being vigilant of reporting timelines for the jurisdictions a business operates in is essential in helping avoid fines.
10. Adopt technical controls to support response, mitigation and forensics
Strong technical controls are essential not only for preventing breaches but also for responding to them. Network segmentation, endpoint detection and forensic logging enable teams to isolate affected systems, limit the spread of malware and investigate what happened, which helps support immediate action and long-term improvements.
In today’s highly-connected digital world, it’s no longer solely about preventing cyberattacks.
It is equally important to prepare for them, as this offers an effective way to lessen damages and safeguard recovery efforts.
This means having incident response plans in place is essential, but organisations must also physically test the effectiveness of their plans, ensuring they provide a rehearsed blueprint to reinstate operations successfully, helping avoid long-lasting damage in the aftermath of attacks.
