It’s the season for security and IT teams to send company-wide emails.
Hackers are stepping up their attacks as many of our employees enter the holiday season. Activity is sure to increase as hackers continue to land his e-commerce scams and holiday-themed phishing attacks. Hackers love to use these tactics to trick end users into compromising not only personal data but also organizational data.
But that doesn’t mean you should spend the next few weeks in constant anxiety.
Instead, use this moment as an opportunity to make sure your incident response (IR) plan is solid.
where do i start?
First, make sure your strategy follows the six steps to complete incident response.
Here’s a refresher:
Six steps of a complete IR
- Preparation: This is the first phase and involves a review of existing security measures and policies. Conducting risk assessments to find potential vulnerabilities. Establish a communication plan that puts protocols in place and alerts staff to potential security risks. The preparation phase of your IR plan is important during the holidays. This gives you the opportunity to communicate vacation-specific threats and put the wheels in motion to address identified threats.
- Identity: The identification stage is when an incident is identified – either it has occurred or is currently ongoing. This can occur in various ways. It can be caused by an in-house team, a third-party consultant, or a managed service provider. At worst, the incident resulted in a data breach or network intrusion. With so many holiday cybersecurity hacks involving end-user credentials, it’s worth dialing up a safety mechanism that monitors how you access your network.
- Containment: The goal of the containment phase is to minimize the damage caused by a security incident. This procedure varies by incident and may include protocols such as quarantining devices, disabling email accounts, and disconnecting vulnerable systems from the main network. Containment measures often have a severe business impact, so it’s imperative to make short- and long-term decisions upfront and avoid last-minute rushes to address security issues.
- eradication: Once you’ve contained a security incident, the next step is to ensure the threat has been completely eliminated. This may include investigative actions to determine who, what, when, where and why the incident occurred. Eradication may involve disk cleaning procedures, restoring the system to a clean backup version, or reimaging the entire disk. The eradication phase may involve removing malicious files, modifying registry keys, and possibly reinstalling the operating system.
- recovery: The recovery phase is the light at the end of the tunnel, allowing the organization to return to business as usual. As with containment, it is best to establish recovery protocols in advance so that appropriate measures are taken to ensure system security.
- Lesson learned: During the lessons learned phase, you should document what happened and record how your IR strategy worked at each step. This is an important time to consider details such as how long it took to detect and contain the incident. Was there any evidence of malware or compromised systems after eradication? Was it a scam related to a holiday hacker scheme? If so, what can be done to prevent it next year?
How Lean Security Teams Can Reduce Stress This Holiday Season
It’s also important to incorporate best practices into your IR strategy. But building and implementing these best practices is easier said than done without the time and resources.
Small security team leaders face new challenges caused by these resource shortages. With minimum budgets exacerbated by not having enough staff to manage security operations, many lean security teams keep organizations safe from the onslaught of attacks common during the holiday season. I feel resigned to the idea that I can’t do it.
Fortunately, there are free resources for security teams in exactly this predicament.
From templates for reporting incidents to webinars that dive deep into IR strategy, you’ll find it all, along with information on the latest cybersecurity threats within Cynet. Incident response hubIn addition, to further assist our lean security team in the event of an incident, free Rapid incident response service.
If you want to check out these free resources, Visit the Accelerated Incident Response hub here.
May your security team enjoy a worry-free vacation and keep the fort safe over the next two weeks.
