Incident Response Plan - Eradication, Recovery, and Lessons Learned Phases
So far, we’ve gone over the first three phases of a cybersecurity incident response plan: preparation, identification, and containment. As a quick refresher, a cybersecurity incident response plan is a document that helps companies understand what they should do if a security breach occurs. But we still have three more phases to go over in this series: eradication, recovery, and lessons learned. Let’s get into it.
LINKS:
____________________________________________
https://etactics.com/blog/interview-q...
____________________________________________
Once you contain the incident, you may need to eliminate remaining components such as malware, or even identify and mitigate any vulnerabilities used. During the eradication phase, you should identify all affected hosts in the organization. This way, you can remediate them.
Check out the following questions that can help you apply more permanent fixes to your infected system:
1. Have we applied new patches to infected systems?
2. Do we need to reconfigure any systems or applications?
3. Have we reviewed all possible entry points/closed them up?
4. Do we need any additional defenses to eradicate the threat(s)?
5. Have we eradicated all malicious activity from the affected systems?
Next is the recovery phase. This is all about restoring your systems to normal operation. You also should confirm these systems are functioning properly and remediate any vulnerabilities to prevent future incidents. This phase may look like restoring systems from backups, rebuilding systems, changing passwords, and more.
Make sure to also review your inventory list as the status and location of items can change.
Here are some baseline questions to incorporate during your recovery phase:
1. Where will recovery and backups pull from?
2. How will we deploy the affected systems back into production?
3. When will we deploy the affected systems back into production?
4. What testing/verifications do we need to do on the infected systems?
5. Is there documentation on the recovery completion steps/inventory check?
Finally, the Lessons Learned phase helps your team to evolve in how they handle pending security threats. A Lessons Learned meeting after a breach is essential to reflect on not only the incident but also possible future threats, improved technology, how well the current intervention worked, and how to improve response time.
A report should cover all phases of your incident report process, remediated threats, as well as what needs to take place in the future to prevent similar infections. Consider these questions at your next Lessons
Learned meeting to better tackle your post-incident analysis:
1. Have we recorded the necessary documentation throughout each incident report phase?
2. Did the response team receive clear authority to segment affected parts of the network to prevent the spread of malware?
3. Were critical systems and restricted data well-insulated from the attack?
4. Did the organization fully or partially recover lost items? If the answer is ‘partially recovered’, was it due to untested and/or corrupted backups?
5. What are some areas of improvement in the incident response process?
In order to respond to a security threat, make sure to use the most effective resources throughout the incident response cycle. That includes asking the right questions. Especially when it comes to the Lessons Learned phase, so you can better prepare for/protect against future attacks.
► Reach out to Etactics @ https://www.etactics.com
►Subscribe: https://rb.gy/pso1fq to learn more tips and tricks in healthcare, health IT, and cybersecurity.
►Find us on LinkedIn: / etactics-inc
►Find us on Facebook: /
#IncidentResponse #IncidentResponsePlan