Overview
24/7 response - anytime, anywhere
Kroll is a leading provider of end-to-end cybersecurity, digital forensics and breach response services – responding to over 3,000 security events every year. Our goal is to quickly contain the compromise and smoothly guide you to recovery, to leave your team in the strongest position possible, with minimal business disruption and your reputation intact.
Incident response planning
What is an incident response plan?
An incident response plan (IRP) is a document which establishes a strategy to guide your organisation’s actions following a security incident.
Your incident response plan should clearly and comprehensively communicate the actions your organisation needs to complete after a cyber-attack. It should identify and set out tasks, procedures and responsibilities relating to each stage of the incident and include defined roles for specific activities.
LEARN MORE ABOUT PLANNINGsteps
What are the incident response steps?
While the nuances of an incident response plan will vary according to the nature and scale of your organisation, the process is generally based on the following key steps:
1. Preparation of systems and procedures
This is a critical step in the incident response planning process as it ensures that every aspect of the plan, from execution to resources, is approved and organised in advance. It involves the creation of key processes, the development of incident response drill scenarios and the assessment of your incident response plan. This stage also involves ensuring that your employees are properly prepared and trained for their incident response roles and responsibilities.
2. Identification of incidents
This is the stage of incident response where you identify whether your organisation has been breached and the level, if any, of the compromise of your systems. If a breach has occurred, it should be documented and reported as quickly as possible, as part of your formal breach notification process. Following your breach notification protocol will enable you to respond quickly and effectively to data breaches. You should also gather evidence in preparation for the next stage of the process and ensure that all the relevant people are prepared to take action. In the event of a breach, you should look to address key aspects such as who discovered it, its scope, its impact on operations and potential source.
3. Containment of attackers and incident activity
This is the incident response stage at which an organisation takes action to limit any additional damage from the incident, as well as prevent the destruction of evidence. It involves three key aspects:
– Short-term containment: The actions taken to limit any potential damage as quickly as possible.
– System back-up: The use of forensic software to capture a snapshot of the affected systems during the incident in order to preserve evidence and provide insights into the nature of the compromise.
– Long-term containment: Temporarily repairing the affected systems so that they can continue to be used, alongside rebuilding clean systems to ensure the removal of accounts or backdoors left by attackers and installing security patches.
4. Eradication of attackers and re-entry options
The eradication stage of incident response involves identifying the cause of the incident and removing malware or other threats introduced by the attacks, as well as restoring all the affected systems. Its core aim is to ensure the prevention of similar attacks in the future.
5. Recovery from incidents, including the restoration of systems
This stage involves restoring and returning affected systems and devices to their past status. As the phase in which organisations can begin operating again without creating the risks of further incidents, it involves checking whether systems have been patched, hardened and tested, if they are being restored from trustworthy back-ups and adopting tools to help prevent similar attacks.
6. Lessons learned and the application of feedback
The final stage of the incident response process takes place once the investigation is complete. All incident response team members should discuss learning points from the specific incident, alongside analysing and documenting everything about the breach. This is the opportunity to understand what was successful in an incident response plan and what was perhaps less effective.
Incident response services
Remote and on-site
incident response services
Whether you need help in an emergency or long-term support to enhance your organisation’s cyber incident response procedures, our experts are on hand 24/7 to provide assistance across the incident lifecycle.
Our cyber security incident response services include:
Features
Cyber incident response service features
Get the help your team needs to quickly respond to incidents and minimise damage and disruption, but also support to formulate an effective cyber incident response plan for the future.
24/7 support and assistance
Deep forensic investigations
Detailed reporting and remediation guidance
Incident response planning and validation
Incident response FAQs
Frequently asked questions
- What is incident response?
-
Incident response is the process of responding to, managing, and mitigating cyber security incidents. The purpose of incident response is to limit the damage and disruption of cyber-attacks and, where necessary, restore operations as quickly as possible.
- What is a security incident?
-
A cyber incident or cyber security incident is an event that could lead to a compromise of confidentiality, integrity or availability. In practical terms, this could include an unauthorised data breach, unlawful data processing, the altering of data without consent, or a malicious attempt to disruption or denial of service.
- How should you respond to a security incident?
-
When a security incident occurs, it is important not to let panic set in. Effective incident response requires a clear and robust incident response plan which outlines the actions key stakeholders need to take in a variety of scenarios.
- What is an incident response plan?
-
An incident response plan is a set of actions and procedures that outlines an organisation’s response to security incidents. An incident response plan is designed to facilitate timely and effective incident mitigation by making it clear what steps should be taken and by whom.
- What should an incident response plan include?
-
An incident response plan should include guidance for:
- the assignment of responsibilities between responders
- the outlining of technical protocols and escalation points
- planning for resource gathering and documentation
- establishment of communications and notification procedures
- determining a review and testing schedule
- What is a CSIRT?
-
A Computer Security Incident Response Team, or CSIRT, is a group of experts responsible for responding to security incidents. A CSIRT will include the security, IT and digital forensics staff responsible for other cyber security functions, but may also include PR, HR or legal personnel to help with breach reporting and notification requirements.
- Why is an incident response plan important?
-
As the National Cyber Security Centre (NCSC) states:
“Incident response (IR) is complicated by two factors. Firstly, no two incidents are ever the same. Secondly, all responses require people, process and technical elements to work together in order to be successful.
Planning your incident response ahead of time is essential. This will be a major determining factor in the final outcome of any real world incident.”
Your incident response plan is your strategic roadmap outlining the steps your organisation should take in the event of different types of attacks. It ensures that you are able to take fast, decisive action to defend your organisation’s reputation and financial well-being.
Set out clearly and executed in a timely way, it can make the difference between responding effectively to an incident and experiencing significant organisational disruption. An incident response plan also communicates to stakeholders and regulators that your organisation is fully committed to addressing new and emerging threats.
- What are the six steps of incident response?
-
The six steps of incident response are as follows:
- Preparation – incident response planning and process creation
- Identification – information gathering and incident analysis
- Containment – patching and damage limitation
- Eradication – threat removal and mitigation
- Recovery – returning systems to full operation
- Learnings – identification of improvements, further testing
Get immediate incident response assistance
Kroll EMEA hotline: +44 (0) 808 101 2168
Incident response support
The support to manage security incidents, whatever the scale
Building a cyber security incident response plan to deal with breaches as and when they arise is fraught with unknowns. Our unique and extensive frontline experience means we can help you make informed decisions at every stage. Kroll’s team of incident response and forensics experts have the expertise to investigate cyber incidents of all types – no matter the type, complexity or severity. We can deploy remote solutions quickly and/or be onsite within hours.
Common threats our cyber incident response services help to address:
- Business Email Compromise
- Advanced Persistent Threats
- Malware, keyloggers and backdoors
- Ransomware
- Insider threats
- Web application attacks
- Targeted IP theft
- Supply chain attacks
Incident response retainer
Flexible incident response retainers
To help your organisation better plan for and respond faster and more effectively to security incidents, Kroll’s incident response retainer provides elite digital forensics and incident response capabilities on-demand. Kroll’s services are flexible and configurable to the needs of your environment, regardless of the technologies you use.
With a transparent pricing model to ensure you get value for money, a Kroll cyber risk retainer provides peace of mind that security and forensics experts are on hand to support incident investigation, notification, containment and remediation.
Get more infoAbout us
Why choose Redscan and Kroll
for incident response
- Flexible, on-demand services to suit a wide range of security needs
- Recognised by CREST and the PCI Council
- A team of over 450 DFIR experts globally
- >3,200 security incidents responded to every year
More on incident response
Request assistance
Complete the form for a prompt response from our team.
Resources