登录查看更多内容

What are the most common mistakes in incident response?

由人工智能和领英社区提供技术支持

Incident response is the process of identifying, containing, analyzing, and resolving security incidents that affect an organization's IT systems, data, and operations. A well-planned and executed incident response can minimize the impact of a breach, restore normal operations, and prevent future attacks. However, incident response is not easy and often involves many challenges and mistakes that can compromise its effectiveness. In this article, we will discuss some of the most common mistakes in incident response and how to avoid them.

此文章中的业界达人

由社区从 5 条内容中精选。了解更多

Norbert John Kubilus

Transformational Leader | Technologist | Mentor | Visionary

1 Lack of preparation

Making a mistake in incident response can be costly, and one of the biggest blunders is not having a clear and up-to-date plan. Such a plan should outline roles, responsibilities, procedures, and tools for responding to different types of incidents. It should also include a list of key stakeholders with their contact information, a communication strategy with an escalation protocol, policies and standards for incident classification, reporting, and documentation, a checklist of actions and tasks for each phase of the incident response lifecycle, a repository of tools and resources for incident detection, analysis, containment, eradication, and recovery, as well as a training and testing program to ensure the readiness and skills of the incident response team. Having such a plan in place can help to avoid wasting time and resources or making wrong decisions.

添加您的观点

Norbert John Kubilus

Transformational Leader | Technologist | Mentor | Visionary
举报内容
A response plan is all well and good, but it's useless if left on the shelf to be adored. Testing is the key to preparedness. I remember an incident response study I did for NYPD 911 in the late 1980s. They had a really good plan with a fully outfitted designated backup location. When I visited the backup site, the commander was very proud of the facility and its ability to transfer operations quickly from NYPD HQ in Lower Manhattan. The first thing I did was start picking up telephones at the 911 desk. Dead. Dead. Dead. They were never connected to New York Telephone circuits. This was a major embarrassment to NYPD and the Mayor's Office.

已翻译

赞

加载更多内容

2 Poor communication

A common mistake in incident response is not communicating effectively and timely with the relevant parties, such as management, staff, customers, regulators, media, or law enforcement. This can lead to confusion, misinformation, panic, or legal issues. To communicate properly during an incident, you should establish a clear and consistent message that explains the nature, scope, and status of the incident. You should also use appropriate channels and formats for different audiences and purposes, provide accurate and updated information while avoiding speculation or exaggeration. Additionally, acknowledge the impact and responsibility of the incident while expressing empathy and commitment to resolve it. Finally, seek feedback and input from stakeholders and address their questions and concerns.

添加您的观点

Norbert John Kubilus

Transformational Leader | Technologist | Mentor | Visionary
举报内容
Timely and accurate communications are critical. One feature I write into all of my incident response plans is an information officer who is charged with this function.

已翻译

赞

3 Hasty actions

A third common mistake in incident response is taking hasty or inappropriate actions that may worsen the situation or create new problems. For instance, deleting or modifying evidence, alerting the attacker, disrupting normal operations, or violating policies or laws are all examples of hasty actions that should be avoided. To do this, you should follow a structured and documented process to guide you through each phase of incident response. Thoroughly analyze the incident and gather sufficient evidence before taking any action. Additionally, validate and test any action before implementing it, and coordinate and consult with experts and authorities before making a decision. Lastly, document and justify any action taken and its outcome.

添加您的观点

Norbert John Kubilus

Transformational Leader | Technologist | Mentor | Visionary
举报内容
Knee-jerk reactions are the death of incident response plans. There has to be a rubric that's followed when responding to an incident.

已翻译

赞

4 Insufficient follow-up

A fourth common mistake in incident response is not following up properly after resolving the incident, which may leave vulnerabilities or issues unresolved or miss opportunities for improvement or learning. To follow up effectively, you should perform a root cause analysis to identify weaknesses and gaps that led to the incident. Additionally, corrective and preventive measures should be implemented to address the root causes and prevent recurrence. The performance and effectiveness of the incident response process and team should also be evaluated, while lessons learned and best practices should be identified and documented. Furthermore, the incident response plan and tools should be updated and revised based on feedback and findings, followed by a debriefing and training session to share knowledge with the team and organization. Incident response is a critical and complex task that requires careful planning, communication, action, and follow-up; by avoiding these common mistakes, you can improve your capabilities and protect your organization from cyber threats.

添加您的观点

Norbert John Kubilus

Transformational Leader | Technologist | Mentor | Visionary
举报内容
Postmortems following an incident are critical. What worked? What didn't work? Much of my incidence response consulting has been conducting a postmortem. After the Loma Prieta earthquake in 1979, we conducted two client postmortems in San Francisco. Both acknowledged that their incident response plans worked as designed, but both needed improvement before the next incident. Both clients accepted our recommendations.

已翻译

赞

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

IT Services

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the most common mistakes in incident response?

1

2

3

4

5

1 Lack of preparation

2 Poor communication

3 Hasty actions

4 Insufficient follow-up

5 Here’s what else to consider

IT Services

给文章评分

感谢您的反馈

更多IT Services相关文章

更多相关阅读内容