What does an Incident Response Analyst do?
An incident response analyst explores computer-related crimes within an organization. Incident response analysts attempt to shield and improve the security of an organization’s security by avoiding, forestalling and mitigating security breaches. An incident responder’s job involves system checking, valuation, testing and investigations targeted at detecting and amending probable security threats. Also, an incident responder often formulates security plans, protocols, strategies and training that help organizations be ever ready to respond competently and efficiently to live incidents or events.
The incident response field is large with different job opportunities ranging from cyber incident responder, incidence response engineer, computer network defense incident responder, to network intrusion analyst, forensics intrusion analyst and intrusion detection expert. Most organizations hire incident response analysts to protect their reputation and revenue from losses arising from cybercrimes.
What Is the Purpose of an Incident Response Plan?
Regardless of the size of a security breach, it is essential for organizations to have a well-prepared incident response plan to mitigate the possibility of becoming a victim of the newest cyberattack. To draft a well-defined incident response plan, you must be able to efficiently detect, reduce the damage and eradicate the cost of a cyberattack, while discovering and mending the cause to avert further attacks. All through the incident response process, members of the security team will encounter several unknowns and a whirl of commotion. In such scenarios, they may fail to adhere to appropriate incident response methodology to efficiently minimize the threat. The following are the three essential goals of an incident response plan:
To Protect Your Finances
A detailed incident response plan defends your company from potential financial losses. According to a 2019 survey, the global average cost of a data breach was estimated to be $3.92 million US Dollars, a 1.5 percent increase from the 2018 survey. The U.S. suffered the most severe data breaches in the world costing about $8.19 million, which is more than the global average. A cybersecurity plan is important as it can take up to 279 days for organizations to detect and moderate a data breach life cycle. The finances of your SMB business can be greatly affected by a data breach.
To Guard Your Data
The security of your data is crucial both for personal and professional reasons. When your data gets into the wrong hands your propriety information can be leaked and used for malicious purposes. However, with a detailed incident response process, your incident response analyst or CIRT can proactively protect your data from cyberattacks.
To Defend Your Reputation and Enhance Your Consumer Trust
A detailed response and reputation management program will help your company survive any security breach. Even though most consumers are ready to forgive companies that have experienced major data breaches, it is often difficult to regain their trust. A survey suggests that only about half of medium and large companies are developing resistance against cyberthreats and other live incidents. This can prove dangerous for the reputation of a company. Without solid consumer trust, an organization is well on its way to experiencing a business death. Thus, reputation management is an indispensable aspect of an effective incident response plan.
What Are the Three Steps for Responding to a Cybersecurity Threat?
A cybersecurity plan or incidence response plan is an organized procedure for tackling cyber threats, insider threats, external attacks, breaches, policy violations and security incidents. At EC-Council’s Certified Incident Handler (ECIH) program, we’ve identified three tested steps for responding to a cybersecurity threat:
Step One – Confront Your Security Issues
The first step in responding to a cybersecurity threat is to confront your security issues. You will need to create and implement proper security measures to protect your business assets. The most effective way to do this is to make a list of your assets and then assign asset owners. The purpose of this is to recognize your core business assets and authenticate who is accountable for their upkeep and security. You should also examine and record all of your business assets based on their functions, including the type of data it stockpiles, who can assess the data, how significant the data is to your company, and what level of protection is presently available to defend it from cyberattacks.
Step Two – Create an Incident Response Plan
The second step is to create a comprehensive incident response plan. Regardless of the current strength of your cyber security mechanisms, you need an incident response plan. With a well-crafted incident response methodologies, you can mitigate losses and minimize damages by formulating a solid incident response process that best suits the size of your company. You need to hire a cyber incident response team (CIRT), incident recovery team (IRT), incident response analyst, or alternatively you can train your IT staff about incident response processes. Their role is to gather, preserve and examine incident-related data. You will also need an effective communication platform, such as a centralized communication forum where your IRT or CIRT can evaluate and systematically document live incidents.
Step Three – Communicate Cyber Incident Responsibilities
The last, but certainly not least, step is to effectively convey cyber incident duties at all levels. Although every member of your staff has a duty to ensure that your company is safe and secure, not everyone will be responsible for incident recovery, encryption or network segmentation in their daily responsibilities. Nevertheless, you must ensure that everyone in your company knows their roles and what is required of them. You may have to provide regular training to substitute skill gaps, monitor security improvements, and provide incentives to your CIRT for excellent security accomplishments.
What Are the Five Steps of Incident Response?
There are five essential steps you must take during the incident response lifecycle. Note that, incident response is a unified process and not an isolated occurrence. Your incident response analyst or CIRT must apply an organized and harmonized approach to this plan. These five steps must align with the NIST Computer Security Incident Handling Guide (SP 800-61).
1. Preparation The first step is to prepare in advance how to avert security breaches by developing a solid incident response plan.
<iframe width=”560″ height=”315″ src=”https://www.youtube.com/embed/WpGWSAPZqrA” frameborder=”0″ allow=”accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture” allowfullscreen></iframe>
Your incident response analyst should create a well-tested plan before a major data breach or cyberattack occurs. This plan will support the efforts of your IRT. An effective incident response plan must include the following:
◉ Assign a team leader whose general responsibility is to respond to cyber incidents. Your incident response analyst may be able to handle this threat depending on the size of your SMB business.
◉ Create strategies, procedures and contracts for the incident response analyst or team.
◉ Evaluate your existing threat recognition competence, and renew your risk assessment and improvement programs.
◉ Carryout unending assemblage, investigation and harmonization of your threat intelligence feeds.
◉ Articulate communication guidelines to allow continuous communication throughout and after the incident.
◉ Perform operational threat hunting drills or simulations to detect incidents happening within your environment, for a more proactive incident response.
2. Detection & Analysis The incidence response analyst you’ve hired should first determine the cause of the incident before she/he can attempt to contain it. The incident responder, together with the CIRT team will monitor possible attack trajectories, detect signs of an incident, document initial incidence, assign incident classification, report incidences, and prioritize responses. An incident response analyst can detect and analyze incidents through a number of indicators including:
◉ Anti-malware programs.
◉ SIEMs and other security products that produce warnings based on examination of log data.
◉ Logs and audit-related data for detecting anomalous activities with applications, cloud services, users, external storage, real-time memory, etc.
◉ System administrators, security staff, users, network administrators, and others.
◉ Document reliability inspecting software.
3. Triage & Analysis
This phase is crucial because all efforts to adequately understand the cause of the incidence are evaluated. The incident responder collects data from systems and machines for additional examination and determines your points of breach. The incident response analyst must have comprehensive proficiencies and a thorough understanding of live incident responses, digital forensics, malware analysis and memory analysis. The incident analyst must focus on three essential aspects including Binary Analysis, Endpoint Analysis and Enterprise Hunting.
4. Containment, Eradication, & Recovery Once the incident has been detected and the cause ascertained, the incident responder must endeavor to contain the damage. Once the incident analyst has identified the cause of the incident, she/he must disable network access for systems that have been compromised by viruses or other malware, wipe the infected devices, and mount security reinforcements to resolve network exposures and malware issues. Your team may also have to create new passwords for users with compromised data or disable the accounts of insiders responsible for the incident. Your CIRT should create a backup for all devices that were breached to reserve their present condition for future forensics.
5. Post Incident Activity
Once the incident has been contained and eradicated, you should review the lessons learned to avoid experiencing the same occurrence in the future. You will then apply appropriate changes to your security procedures and training for your employees. The incident response plan must be reviewed and updated to reflect any new precautionary procedures.
Final Thoughts
Every company will have a diverse incident response process based on its distinctive IT setting and business requirements. However, It’s vital to follow the NIST incident handling guide for mandatory processes.
Source: eccouncil.org
Posts
0 comments:
Post a Comment