Cyber Security Incident Response

Kroll is a leading provider of end-to-end cybersecurity, digital forensics and breach response services – responding to over 3,000 security events every year. Our goal is to quickly contain the compromise and smoothly guide you to recovery, to leave your team in the strongest position possible, with minimal business disruption and your reputation intact.

While the nuances of an incident response plan will vary according to the nature and scale of your organisation, the process is generally based on the following key steps:

1. Preparation of systems and procedures

This is a critical step in the incident response planning process as it ensures that every aspect of the plan, from execution to resources, is approved and organised in advance. It involves the creation of key processes, the development of incident response drill scenarios and the assessment of your incident response plan. This stage also involves ensuring that your employees are properly prepared and trained for their incident response roles and responsibilities.

2. Identification of incidents

This is the stage of incident response at which you identify whether your organisation has been breached and the level, if any, of the compromise of your systems. If a breach has occurred, it should be documented and reported as quickly as possible, as part of your formal breach notification process. Following your breach notification protocol will enable you to respond quickly and effectively to data breaches. You should also gather evidence in preparation for the next stage of the process and ensure that all the relevant people are prepared to take action. In the event of a breach, you should look to address key aspects such as who discovered it, its scope, its impact on operations and the potential source.

3. Containment of attackers and incident activity

This is the incident response stage at which an organisation takes action to limit any additional damage from the incident, as well as prevent the destruction of evidence. It involves three key aspects:

– Short-term containment: The actions taken to limit any potential damage as quickly as possible

– System back-up: The use of forensic software to capture a snapshot of the affected systems as they were during the incident in order to preserve evidence and provide insights into the nature of the compromise

– Long-term containment: Temporarily repairing the affected systems so that they can continue to be used, alongside rebuilding clean systems to ensure the removal of accounts or backdoors left by attackers and installing security patches

4. Eradication of attackers and re-entry options

The eradication stage of incident response involves identifying the cause of the incident and removing malware or other threats introduced by the attacks, as well as restoring all the affected systems. Its core aim is to ensure the prevention of similar attacks in the future.

5. Recovery from incidents, including the restoration of systems

This stage involves restoring and returning affected systems and devices to their past status. As the phase in which organisations can begin operating again without creating the risks of further incidents, it involves checking whether systems have been patched, hardened and tested, if they are being restored from trustworthy back-ups and adopting tools to help prevent similar attacks.

6. Lessons learned and the application of feedback to the next round of preparation

The final stage of the incident response process takes place once the investigation is complete. All incident response team members should discuss learning points from the specific incident, alongside analysing and documenting everything about the breach. This is the opportunity to understand what was successful in an incident response plan and what was perhaps less effective.