What is Incident Response?

Why is Incident Response Important?

Cyberattacks are on the rise and pose a threat to companies of all sizes across all industries. Any organization could be the victim of a data breach or ransomware attack and needs to have the tools and processes required to manage a cybersecurity incident effectively.

Incident response is important because it allows an organization to determine the scope and impact of an incident and to take steps to remediate it. Incident responders will investigate the intrusion, contain and remediate infected systems, and restore normal operations after the threat has been eliminated.

Incident response can have a dramatic impact on the cost of a data breach or other cybersecurity incident if the organization is prepared to handle it properly. On average, companies with an incident response team and a tested incident response plan have an average data breach cost 54.9% lower than companies without either of these.

The Incident Response Process

The goal of incident response is to take an organization from knowing little or nothing about a potential intrusion (other than that it exists) to complete remediation. The process of achieving this goal is broken up into six main stages:

1. Preparation: Preparation is key to effective incident response and minimizing the cost and impact of a cybersecurity incident. To prepare for incident response, an organization should create an incident response team, and define and test an incident response plan that outlines how each stage of the incident response process should be handled.
2. Identification: Incident response begins with detection of a potential incident, so the team has little or no information about the scope of the intrusion. In the identification stage, incident responders investigate the potential incident to determine what has happened, affected systems, potential regulatory impacts, etc.
3. Containment: After identifying a system impacted by the incident, the incident response team quarantines that system from the rest of the network. Cyber threat actors and their malware will commonly attempt to move laterally through the corporate network to achieve their goals or maximize the impact of the attack. Quarantining infected systems early on helps to limit the cost and damage caused by an attack.
4. Eradication: At this point in the process, the incident response team has performed a complete investigation and believes that it has a complete understanding of what has occurred. The incident responders then work to remove all traces of the infection from compromised systems. This may include malware deletion and removal of persistence mechanisms or a complete wipe and restoration of affected computers from clean backups.
5. Recovery: After eradication, the incident response team may scan or monitor the infected systems for some time to ensure that the malware has been completely eliminated. After this is complete, the computers are restored to normal operation by lifting the quarantine isolating them from the rest of the corporate network.
6. Lessons Learned: Cybersecurity incidents occur because something went wrong, and it’s important to remember that incident response doesn’t always go off flawlessly. After the incident has been remediated, the incident responders and other stakeholders should perform a retrospective to identify security gaps and shortcomings in the incident response plan that could be fixed to reduce the probability of incidents and improve incident response in the future.

The Benefits of Outsourced Incident Response Services

Incident response is most effective when it is performed rapidly by experienced responders. In many cases, organizations lack the resources to keep a full incident response team on staff around the clock. One alternative is to engage with an organization that provides specialized incident response services.

This provides a few benefits, including:

• Availability: The earlier that an incident response team starts their work, the lower the cost and impact of an attack to an organization. Cybersecurity incidents can occur at any time, and it may be difficult to contact incident response team members outside of business hours. Specialized incident response providers will have multiple teams on staff, providing better coverage and increased availability.
• Experience: Incorrectly handling a security incident can increase the cost and damage to an organization. For example, ransomware attacks can make infected systems unstable, meaning that a restart could render the encrypted data unrecoverable. Professional incident responders have the necessary experience to handle a security incident efficiently and correctly.
• Specialized Expertise: Incident response commonly requires specialized expertise, such as forensic analysis or malware reverse engineering. Most companies have no need to possess these skill sets in house, but a professional incident response team will have access to the specialists that it needs to handle any cybersecurity incident.
• Managing the Entire Incident Response Process: An outsourced incident response provider should support all of an organization’s incident response needs. This includes preparing for incident response, managing detected intrusions, and working to mitigate future attacks. Let’s break down the process:

#1. Preparation. A qualified Incident Response Team must be capable of providing assistance BEFORE an incident occurs including but not limited to:

• Incident Response Planning
• Tailored “Threat” Consulting
• Table Top Exercise
• Policy Creation
• Intelligence Sharing
• Attack Surface Evaluation
• Customized Threat Management
• SOC Training/Playbook Creation

#2. Response. Once a threat has been identified, the incident response team should manage the complete incident response process, including:

• Attack Mitigation
• Full Incident Handling
• Malware Forensics
• Endpoint/Network/Mobile Forensics
• Threat Intelligence
• Attack Landscape Analysis
• Full Actionable Reporting

#3. Mitigation. True threat detection and response goes beyond managing known security incidents to discovering, remediating, and preventing unknown threats. An outsourced incident response provider should also offer:

• Domain Takedown Services
• Compromise Assessment
• Threat Hunting Engagement
• Active Actor Management
• Attack Disruption Services

Incident Response Services with Check Point

Check Point Incident Response is available 24x7x365 to help companies manage security incidents. If your organization is undergoing a cyberattack, call the Check Point incident response hotline for assistance.

Check Point also provides support for organizations wishing to proactively protect against and prepare for potential future cyberattacks. Check Point’s Cybersecurity Risk Assessment provides a full risk analysis across an organization’s entire environment (cloud, network, endpoint, mobile, and IoT). Check Point also offers help in detecting past compromises, evaluating cybersecurity maturity, and developing incident response strategies.