Network security incidents can disrupt your business operations, damage your reputation, and expose you to legal and regulatory risks. How can you ensure that your business can continue to function and recover from a network security incident? Here are some best strategies for business continuity during a network security incident.
The first step is to identify your critical assets and processes that support your business objectives and customer needs. These include your data, applications, systems, networks, and devices that are essential for your operations. You should also identify the dependencies, interconnections, and vulnerabilities of your critical assets and processes. This will help you prioritize your protection and recovery efforts and allocate your resources accordingly.
Identifying the most critical aspects of your business requires you to look at what makes me who I am. Example, for a bank it will be the core banking system and it's dependencies, for a Telecom operator it will be the mobile money, core voice, core packet, and telecom infrastructure. You can also define what is core by looking at the cash cow, what brings most money to my business. Then look for the building components of those core systems, here you will find smaller systems, people, processes etc. Now, from among the identified aspects, build a priority list and start working on the different scenarios which can bring the services fully or partially down, here you essentially move to further steps of planning to tackle the scenarios.
Identify your crown jewels and their relationship with business and make sure to conduct a business impact assessment so that all the related people, process and technologies are identified
Identifying the interconnections and dependencies is very crucial part of Critical Asset identification. This needs to be clearly documented and inform to Asset Owners of critical assets and interconnect assets.
It is ideal to recorgnise an incident in real time often recovery after such an event is futile due to the extensive loss of data at the time of application of necessary solutions,as such communication with the essential customers in an organization is of great priority so that action will be taken should security issues emerge throughout the organization i think of it as greasing the wheels
Identifying the top… absolutely most critical systems and third party services is vital to cyber resilience. Teams who think through the prioritization of the absolutely most critical systems and services, and the order in which they must be defended / preserved / restored, are most successful at triaging critical decisions during active cyber incidents
The second step is to develop an incident response plan that defines the roles, responsibilities, and procedures for responding to a network security incident. This should include a clear definition of what constitutes a security incident and its severity levels, along with a communication strategy for notifying and updating internal and external stakeholders. Additionally, the plan should have a response team with the necessary skills, authority, and access to handle the incident and coordinate with other teams and external experts. Furthermore, it should have predefined actions and tools for detecting, containing, analyzing, eradicating, and restoring your network security. Finally, it should have a process for documenting, reporting, and reviewing the incident and its impact.
Establish an incident response plan that outlines the steps to be taken in the event of a security incident with clear roles and responsibilities for the incident response team, including communication channels and escalation procedures.
The third step in protecting your critical assets and processes is to implement backup and recovery solutions. Your backup policy should specify what, how, when, where, and how often you should back up your data and systems. Additionally, a backup verification process should be in place to ensure the backups are complete, accurate, and usable. Furthermore, a recovery strategy should be established that outlines the recovery objectives such as the recovery point objective (RPO) and the recovery time objective (RTO), as well as the recovery methods such as full, incremental or differential backups. Finally, a recovery testing process should be conducted to validate that your recovery solutions can meet your objectives and function properly.
Um bom Backup é algo fundamental, eu diria até que é algo primordial para você e sua empresa escaparem (quase) ilesos de uma crise provocada por um incidente cibernético. é um processo que precisa ser levado a sério, e testado com a maior frequência possível, em um ambiente o mais próximo possível do de produ??o, para que na hora de se enfrentar um incidente cibernético real, como um fulminante ataque de ransomware, todos saibam o que fazer e consigam prever o tempo necessário para o enfrentamento da crise e a volta à normalidade operacional do negócio.
During an active security incident it is late to implement DR, it has to be there long before. Hence this piece of advice is defunct and is AI error
Regularly back up critical data, configurations and ensure that backups are encrypted, immutable, stored in a secure and isolated environment. Also test data restoration processes and most importantly also test the time taken to recover the system frequently. Just having the backup will not fulfill the business requirement.
Backup restoration exercise to be performed regularly to avoid surprises during actual outage. This is a most common gap observed.
The fourth step is to train and educate your staff on how to prevent, detect, and respond to network security incidents. It’s important that your staff are aware of the common types and sources of such incidents, such as malware, phishing, denial-of-service, or unauthorized access. They should also be familiar with the best practices and policies for network security like using strong passwords, updating software, encrypting data, and avoiding suspicious links or attachments. Furthermore, they should understand the signs and symptoms of a network security incident like unusual network activity, slow performance, or unexpected alerts or messages. Lastly, they should know the steps and procedures for reporting and escalating a network security incident, such as contacting the response team, preserving the evidence, and following the instructions.
DR exercise should be performed periodically or whenever there is major change (upgrades, change in environment, interconnect changes, dependencies). Lesson Learnt of the exercise to be communicated to all stakeholders, including team members who participated in the exercise. Re-test to be done if required.
Engage with the teams who will actively engage during such incidents and make them part of the DR drills so that they feel the end to end process of a real incidents. Capture the learnings and make sure retrain the teams based on the learnings.
O treinamento deve abranger n?o apenas a identifica??o de amea?as comuns, como malware e phishing, mas também instruir sobre práticas seguras, como o uso de senhas fortes, a importancia de atualiza??es regulares de software e a criptografia de dados sensíveis. Além disso, é vital que os funcionários estejam atentos aos sinais de um incidente de seguran?a, como atividades de rede incomuns ou lentid?o no sistema, e saibam como agir nesses casos. Além disso, a cria??o de uma cultura de seguran?a onde os funcionários se sentem responsáveis e equipados para agir em situa??es de risco.
The fifth step is to review and update your strategies for business continuity during a network security incident on a regular basis. This will enable you to assess the effectiveness and efficiency of your strategies, as well as identify any gaps or weaknesses. Additionally, it will allow you to incorporate the lessons learned and best practices from your previous incidents and other sources. Moreover, it will help you to adapt to the changing business needs, customer expectations, and network security threats and trends. Ultimately, following these best strategies can enhance your business continuity during a network security incident, thus minimizing the potential impact and damage to your business.
I remember working for one mobile operator, one of the business continuity plans at the worst case where the whole network was down was to have a backup simcard from the competitor network. This will help the engineers to communicate when the home network is totally down. This never happened at my time, but one issue we faced everytime was the engineers never recharged those backup simcards with airtime because they hardly used them. I had to make surprise calls every now and then to the backup numbers to test their availability. This should be part and parcel of the periodic tests according to the BCP plan test cases. Finally, the BCP plan should be revised and optimized using the inputs from the regular incidents and periodic bcp tests.
As this is about Network Security, best practice is to divide the network into segments, and limit access between segments. This is a proactive control to help contain the spread of an incident and protects critical systems. Apply the principle of least privilege, ensuring that users and systems only have access to the resources necessary for their functions.
Testing of recovery strategy is important to ensure plan will work as expected during actual incident. Periodic tests as per policy requirements should be carried out. there are three tests: a table-top exercise, a structured walk-through or full disaster simulation testing.
Innovation of methods and strategies is a continuous improvement activity for a business continuity professional and practitioner as well as Leader. Enabling teams to be distributed reduces the risk of isolation due to concentration. ICT systems recovery tests essentially need to be conducted in disciplined, continuous and worst case scenario enacted. Surprise tests must be more than informed tests. Supplier readiness testing is critical Restore of data and applications to meet RPO (recovery point objective) is important RTC assessment is vital. Defining RTO and RPO realistically is the 1st step. When you know what you want to achieve - IT can be achieved progressive. Read my book - Invest- Imbibe- Initiate-Introspect-Innovate
Incident Detection and Monitoring: Realtime monitoring is very important so IDS, SIEM tools, and other monitoring solutions to detect anomalies and suspicious activities are very crucial to notify the incident response team of potential security incidents. Communication Plan: Establish a communication plan for internal and external stakeholders, including employees, customers, and partners. Designate spokesperson and ensure that communication is timely, transparent, and consistent during a security incident. External Support: Establish relationships with external cybersecurity experts and legal professionals and have a retainer agreement with incident response and forensic services when needed
Adicionalmente, é importante realizar uma análise pós-incidente para identificar pontos de falha e áreas para melhoria. Isso ajuda a fortalecer as estratégias de seguran?a e continuidade dos negócios. Outro ponto é criar uma rede de compartilhamento e relacionamento com especialistas externos em seguran?a cibernética para obter insights e suporte adicional. Isso pode incluir servi?os de monitoramento de seguran?a, consultoria e resposta a incidentes.