{"id":33495,"date":"2019-09-05T12:28:43","date_gmt":"2019-09-05T11:28:43","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=33495"},"modified":"2019-09-10T08:51:46","modified_gmt":"2019-09-10T07:51:46","slug":"taking-action-on-cybersecurity-the-incident-response-programme","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/09\/05\/taking-action-on-cybersecurity-the-incident-response-programme\/","title":{"rendered":"Taking action on cybersecurity: The incident response programme"},"content":{"rendered":"\n

Organisations across the globe are grappling with an unprecedented number of cyberthreats. It means that, for CISOs, risk management is a key strategic objective. Anna Mazzone, MD and GM of UK and Ireland, MetricStream, discusses why cybersecurity incident response programmes are so crucial in today\u2019s business world. <\/em><\/p>\n\n\n\n

Across all industries,\ncompanies of all sizes recognise the importance of cybersecurity. After all, data\nis at constant risk. Protecting it is imperative, not just because stringent\nregulations demand it, but because failure to do so can be incredibly damaging\nto organisations and their stakeholders. <\/p>\n\n\n\n

Yet, there are still\ngaps in how enterprises approach cybersecurity and, in many cases, they are not\nas prepared as they should be. Establishing a Computer Security Incident\nResponse Team (CSIRT) can help plug the gap, enabling organisations to respond quickly,\nshould an incident require it. <\/p>\n\n\n\n

According to Cyber Security Ventures<\/a>, the annual cost implication of cybercrime is projected to reach US$6 trillion by 2021. It\u2019s a staggering figure that demonstrates the collective impact of cyberincidents and that all organisations \u2013 large and small \u2013 are at risk. In fact, last year\u2019s cost of cyberattacks across UK small businesses has been estimated at \u00a313.6bn.<\/p>\n\n\n\n

By and large, companies recognise the threat. The annual cyber governance health check of the UK\u2019s leading 350 companies found that 72% of boards consider cyberthreats a very high or high risk. Yet, despite this, only around one in five had undertaken a crisis simulation on cyber-risk in the last 12 months.  <\/p>\n\n\n\n

Cyberattacks can have long and\nfar-reaching consequences. Initially, there is an immediate impact from dealing\nwith the incident. This can include service disruption and a potentially high\ncost of fixing the issue. <\/p>\n\n\n\n

However, financial impact can be\nlong-term, resulting from reputational and brand damage, not to mention\npotentially hard-hitting fines should the organisation be adjudged to have\nfallen foul of its responsibilities and relevant regulations.   <\/p>\n\n\n\n

The potential for cyber-related\nincidents to occur therefore, poses a serious threat to businesses. It follows\nthat the absence of a sophisticated cyber-resilience programme can put organisations\nin jeopardy.<\/p>\n\n\n\n

What\u2019s more, the cyberthreat\nconstantly evolves. It would be a mistake to think that any response plan can\nbe created and then effectively held in cold storage. It should be a living\nplan: constantly revised, updated, checked and tested. It is an investment in\nthe business\u2019 ability to prevent, mitigate and respond to cyber incidents and\ncould help minimise financial damage and help protect the organisation and its\nreputation. <\/p>\n\n\n\n

The Computer Security Incident\nResponse Team (CSIRT)<\/strong><\/p>\n\n\n\n

The CSIRT is a centre of\ninformation security, incident management and response within an organisation.\nIt is designed to quickly respond to incidents such as cyberattacks. <\/p>\n\n\n\n

While it has a very practical\napplication, the existence of such a team also helps foster a culture of\nsecurity within the business, which is incredibly important if all employees\nare to develop and maintain risk mitigation and compliance behaviours. <\/p>\n\n\n\n

However, before launching a CSIRT\nprogramme, it\u2019s important to consider all operational and technical issues.\nThese include equipment, security and resourcing. <\/p>\n\n\n\n

Start by conducting a gap analysis\nof your current cyber programme: include your capabilities to respond to\nincidents and the mitigations that are currently in place to deal with cybersecurity\nincidents. <\/p>\n\n\n\n

With this in hand, you can seek\nmanagement support and buy-in to the programme, which will be essential for it\nto be successful. <\/p>\n\n\n\n

Once you have this, you can begin\ndetermining the CSIRT strategic plan and go on to: <\/p>\n\n\n\n

  1. Gather relevant information<\/li>
  2. Design the CSIRT vision<\/li>
  3. Research best practices<\/li>
  4. Determine the standards and regulations you need to follow and\nadhere to<\/li>
  5. Outline the team and its structure<\/li>
  6. Prepare templates<\/li>
  7. Establish and communicate the CSIRT vision<\/li>
  8. Develop and document the programme, plan and playbooks<\/li>
  9. Train the team<\/li>
  10. Begin implementation<\/li>
  11. Announce the CSIRT<\/li>
  12. Evaluate its effectiveness<\/li><\/ol>\n\n\n\n

    Building the right team<\/strong><\/p>\n\n\n\n

    The CSIRT team should include: <\/p>\n\n\n\n

    • Business managers<\/strong> \u2013 they are the front line of the business\u2019 processes and therefore need to buy-in to what the CSIRT is there to do and the authority it will need to have to make decisions should critical business systems have to be disconnected from the network or shut down<\/li>
    • IT <\/strong>\u2013 IT must be represented as they are custodians of the IT infrastructure and network within the organisation. Clear guidelines must be set on how IT and the CSIRT interact as well as \u2018who does what\u2019 should a response be triggered by an incident. The role of the CSIRT in making recommendations on security should be clear, as should the team\u2019s access to network and systems logs for analysis purposes<\/li>
    • Legal <\/strong>\u2013 clearly, a legal representative is needed to address legal issues. Legal\u2019s involvement in incident response efforts should be determined and stated. On a day-to-day basis, legal staff may need to review non-disclosure agreements, develop appropriate wording for contacting other sites and organisations, and determine site liability for computer security incidents<\/li>
    • HR <\/strong>\u2013 HR representative\/s will develop job descriptions for CSIRT staff and be involved in the policies and procedures around employees\u2019 access to and use of company IT and any associated systems and applications (including any belonging to third parties)<\/li>
    • PR <\/strong>\u2013 PR resources are needed when it comes to external communications, handling media enquiries in the event of an incident and providing guidelines for information disclosure policies and practices<\/li>
    • Security <\/strong>\u2013 existing security groups including physical security; responsibility may be shared between the CSIRT and security teams when it comes to resolving issues such as computer\/data theft<\/li>
    • Audit and risk management specialists <\/strong>\u2013 these will be integral members of the team as threat metrics and vulnerability assessments will play a central role in planning the defence strategy. <\/li><\/ul>\n\n\n\n

      It will be the role of the CSIRT to\nmitigate cybersecurity risks and tackle different types of breach scenarios.\nTherefore, the team must be well equipped to gather and analyse all relevant\ndata and must have management support for the level of security required to\nprotect sensitive information and critical assets from threats. This support\nincludes ensuring budget is there to implement a comprehensive programme. <\/p>\n\n\n\n

      The team will become expert at both\nlooking within the organisation \u2013 understanding its network traffic, its\nsecurity controls, capabilities, resources and where threats can occur \u2013 and at\nlooking outward to the environment the organisation operates in. <\/p>\n\n\n\n

      It will need to collect and develop\ninformation and evidence about attack vectors and threat agents, to deploy risk\nearly warning indicators (REWI) to define security analytics and help align\nsecurity metrics and analytics. <\/p>\n\n\n\n

      It should also work with the wider cyber community for the purpose of better protecting the organisation and contributing to the wider preparedness of the business community to cyberthreats.<\/p>\n\n\n\n

      It is clear that cybersecurity will\ncontinue to form a growing part of risk management and mitigation within\nenterprises. <\/p>\n\n\n\n

      Within this environment, CSIRT\nprogrammes should form a central part of cybersecurity measures, helping\ncompanies equip themselves to safeguard data and information, in order to\nprotect stakeholders and assets and maintain the ability of organisations to\nperform. <\/p>\n","protected":false},"excerpt":{"rendered":"

      Organisations across the globe are grappling with an unprecedented number of cyberthreats. It means that, for CISOs, risk management is a key strategic objective. Anna Mazzone, MD and GM of UK and Ireland, MetricStream, discusses why cybersecurity incident response programmes are so crucial in today\u2019s business world. Across all industries, companies of all sizes recognise […]<\/p>\n","protected":false},"author":28,"featured_media":33625,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,1489,13207,93],"tags":[11086,3466,13345,13346],"class_list":["post-33495","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-thought-leadership","category-top-stories","tag-anna-mazzone","tag-ireland","tag-md-and-gm","tag-metricstream"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/33495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=33495"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/33495\/revisions"}],"predecessor-version":[{"id":33618,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/33495\/revisions\/33618"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/33625"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=33495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=33495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=33495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}