登录查看更多内容

What are effective ways to collaborate between incident response and IT services teams?

由人工智能和领英社区提供技术支持

When a cyberattack or a security breach occurs, it is crucial that the incident response (IR) and IT services teams work together effectively to contain, analyze, and resolve the situation. However, collaboration between these teams can be challenging due to different roles, priorities, and communication styles. In this article, we will explore some effective ways to collaborate between IR and IT services teams and how to overcome common barriers.

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

Jason Coggins

Head of Sales - EMEA
Arvind Sharma

Technology Strategy & Transformation | Ross MBA
Hung Nguyen An

Engineering Manager / Software Architect / Open Source Enthusiast

1 Define clear roles and responsibilities

One of the first steps to collaborate effectively is to define the roles and responsibilities of each team member and how they relate to the incident response process. This can help avoid confusion, duplication, or gaps in the tasks and actions required to handle the incident. For example, the IR team may be responsible for leading the investigation, collecting evidence, and reporting the findings, while the IT services team may be responsible for restoring the affected systems, applying patches, and implementing remediation measures. By clarifying the roles and responsibilities, each team can focus on their strengths and expertise and coordinate their efforts.

添加您的观点

Arvind Sharma

Technology Strategy & Transformation | Ross MBA
举报内容
Having a well thought out and socialized RACI (Responsible, Accountable, Consulted, Informed) model for critical IT processes such as incident and problem management helps in clarifying who does what. Additionally, interface models clearly define the hand offs between teams for processes.

已翻译

赞
Hung Nguyen An

Engineering Manager / Software Architect / Open Source Enthusiast
举报内容
I believe transparent communication is the most crucial aspect. Every team needs to grasp key information consistently. Additionally, team leaders should enhance teamwork skills. If the upper management does not communicate effectively, it becomes challenging for the lower levels to stay aligned.

已翻译

赞

2 Establish a common language and communication channel

Another key factor for collaboration is to establish a common language and communication channel between the IR and IT services teams. This can help ensure that both teams are on the same page, share relevant information, and avoid misunderstandings. For example, the IR team may use technical terms or acronyms that the IT services team may not be familiar with, or vice versa. To avoid confusion, both teams should agree on the definitions and meanings of the terms and acronyms they use and document them in a shared glossary. Moreover, both teams should agree on the communication channel and frequency they will use to update each other on the incident status, progress, and issues. For example, they may use email, phone, chat, or a dedicated incident management platform to communicate and collaborate.

添加您的观点

Nagesh Rao

Senior ICT Consultant, Management and Technology
举报内容
The incident response (IR) team is responsible for identifying, containing, and remediating security incidents and reporting to various stakeholders, IT services team being one of the major ones. The IR team develops and maintains procedure for reporting incidents – including defining what can constitute an incident and establishing timelines for escalation, providing clear and concise information about the incident, its impact, response plan, and action, which may be needed by IT. Collaboration with IT can be ensured by using clear and consistent incident communication, a central platform, regular updates/meetings, and by fostering openness for questions and concerns.

已翻译

赞

3 Align on the goals and priorities

A third way to collaborate effectively is to align on the goals and priorities of the incident response and IT services teams. This can help ensure that both teams are working towards the same outcome and that they balance the needs and expectations of the stakeholders. For example, the IR team may prioritize finding the root cause and scope of the incident, while the IT services team may prioritize restoring the normal operations and minimizing the downtime. To align on the goals and priorities, both teams should discuss and agree on the objectives, scope, and timeline of the incident response and IT services activities and how they will measure and report their success.

添加您的观点

4 Share knowledge and feedback

A fourth way to collaborate effectively is to share knowledge and feedback between the IR and IT services teams. This can help improve the skills, performance, and relationships of both teams and foster a culture of learning and improvement. For example, the IR team may share their findings, insights, and recommendations with the IT services team to help them understand the nature and impact of the incident and how to prevent or mitigate similar incidents in the future. Likewise, the IT services team may share their challenges, solutions, and suggestions with the IR team to help them optimize their processes and tools and enhance their efficiency and effectiveness. By sharing knowledge and feedback, both teams can learn from each other and improve their collaboration.

添加您的观点

5 Build trust and respect

A fifth and final way to collaborate effectively is to build trust and respect between the IR and IT services teams. This can help create a positive and productive working environment and reduce the potential for conflicts or tensions. For example, the IR team may trust and respect the IT services team's expertise, experience, and opinions and involve them in the decision-making and problem-solving processes. Similarly, the IT services team may trust and respect the IR team's authority, guidance, and feedback and support them in the execution and delivery of the incident response activities. By building trust and respect, both teams can work as a unified and cohesive unit and achieve their goals.

添加您的观点

Hung Nguyen An

Engineering Manager / Software Architect / Open Source Enthusiast
举报内容
Every team is important. No team is more important than another, whether it's the sales team or the technology team. Working together with clear and responsive communication, providing feedback responsibly.

已翻译

赞

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Jason Coggins

Head of Sales - EMEA
举报内容
Anyone responding to this type of emergency or incident should always consider the first ‘Golden Hour’. This is a recognised term in criminal investigations, in that the first hour that follows the incident coming to light, presents often the best opportunity to obtain the most significant evidence that can assist a later investigation or triage. So make sure you consider this when your considering initial response resources and mechanisms.

已翻译

赞
Carlito Cubilla

Governance, Risk & Compliance (GRC) Practitioner *ISO 27001:2022 LA *NIST CSF 2.0 *COBIT? 2019 *ISC2 Certified in Cybersecurity (CC) *OneTrust Third Party Risk Management *ITIL? 4 MP/SL *ITIL? v3 Expert *JWMI MBA
举报内容
Integrate the Continual Service Improvement process in both the IR and IT Services teams. Establish clear communication channels and build a strong relationship between the leaders of both organizations.

已翻译

赞

IT Services

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are effective ways to collaborate between incident response and IT services teams?

1

2

3

4

5

6

1 Define clear roles and responsibilities

2 Establish a common language and communication channel

3 Align on the goals and priorities

4 Share knowledge and feedback

5 Build trust and respect

6 Here’s what else to consider

IT Services

给文章评分

感谢您的反馈

更多IT Services相关文章

更多相关阅读内容