Gartner | 3 Must-Have Tools for Responding to Cybersecurity Incidents

The average cost of a data breach in 2021 reached a 17-year high, and 10% of breaches were caused by ransomware — double the rate of 2020. — *IBM Cost of a Data Breach Report 2021*

Recently, Gartner released the Cybersecurity Incident Response Tool Playbook, reminding enterprise security and risk managers to plan ahead and prepare for cybersecurity incidents. Below are the three essential tools highlighted by Gartner this time.

01

▌Formulate an Incident Response Plan

A general plan for responding to cyber incidents

▶ Draw a Response Flowchart

The incident response plan should specify detailed steps to be followed in an orderly manner when an incident occurs. The incident owner (or similar role) should ensure the full implementation of all steps, tracking progress and communicating on a rolling basis.

▶ Define Incident Severity Levels

All security incidents must be classified and assigned a severity level. This helps guide incident escalation, clarify Service Level Agreements (SLAs), and otherwise inform stakeholders of the potential or actual impact of the incident on the organisation. Severity levels also determine who is notified, escalation paths, and the playbooks to be used.

▶ Clarify Roles and Responsibilities

Effective incident response requires teamwork. The RACI model clarifies all roles and corresponding responsibilities regarding incident response across the organisation. Among these, common stakeholders include the C-suite, legal, privacy, and HR teams.

02

▌Develop Detailed Response Playbooks

Detailed guidance for handling specific incident types

▶ Draft Response Playbooks

The CSIR team should compile detailed playbooks based on common or high-impact incident types (such as ransomware shown in this example). This response playbook aims to provide detailed guidance and processes, distinguishing it from a general security incident response plan.

▶ Formulate a Ransomware Response Process

Map out the ransomware response process and decision trees. This process can be used to develop detailed response procedures, clarify responsibilities, and create other documents for the CSIR team to guide its response efforts.

▶ Record the Response Process in Detail

Collaborate with various Subject Matter Experts (SMEs) to document the ransomware response process in detail. This should include: specific guidance, tools, examples, settings, etc., and should specify the responsible party for each step.

03

▌Conduct Regular Tabletop Exercises

Implementation of routine testing of the incident response plan

▶ Set the Agenda and Invite Participants

Incident response tabletop exercises should involve the leadership and decision-makers across the organisation. Successful tabletop exercises must identify specific objectives, be highly structured, and cover pre-determined scenarios.

▶ Set Incident Scenarios and injects

To achieve the most effective cybersecurity tabletop exercise, its structure should be set as an initial scenario (e.g., malware), followed by a series of injects that add new information to the incident. This structure replicates the uncertain changes of a real event.

▶ Design Challenging Incident Scenarios

Tabletop exercises should replicate the challenging issues that stakeholders must resolve during an actual attack.

By leveraging SecurityMetrix's security metric validation platform, you can choose pre-configured ransomware validation scenarios, which contain different attack techniques based on various ransomware attack stages, including reconnaissance, initial access, malicious DNS requests, C&C callback, information gathering, lateral movement, data exfiltration, malicious file dropping, ransomware execution, etc.

These stages contain the behaviours of all types of ransomware collected by the SecurityMetrix Security Labs, fully simulating the complete attack techniques and malicious samples of various ransomware on a one-to-one realistic scale. You can also customise the stages and types you need to include based on these attack techniques and stages.

Ultimately, you can continuously validate your various security controls for anti-ransomware propagation and anti-ransomware execution to ensure they consistently maintain a high level of defensive capability. At the same time, this allows your incident response team to respond to, trace, and analyse these simulated attacks, ensuring that their response process is correct and effective, while training their tracing and analysis skills to effectively cope with similar incidents that may arise in the future.

| Reference Source

https://mp.weixin.qq.com/s/U85aYxe0AYVqndBBNf_Tpg