Incident Response Plan Paper Example

Incidents response (IR) is considered a structured methodology that plays a significant role in managing cyber threats, security breaches, and security incidents. For efficiency and effective operation, a well-defined incident response plan provides better opportunity to work on identifying, minimizing the damage, and reduce the cyber attack cost, while fixing and finding the cause of preventing the attacks that might happen in future.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Save 25%

In the case of a cybersecurity incident, it is important to note that cybersecurity incident, cybersecurity teams will go through many frenzy and unknown activities. In an environment that is hectic, they may not follow effective incident response procedures when it comes to handling the existing damages. In most cases, developing and deploying an IR policy and completing an incident response plan checklist will be of great significance before fully coming up with an IR plan (Alsmadi, 2019).

An incident response plan which is executed by a team that enables a company to determine what happened and performs a damage assessment, a remediation team that removes the attackers from the environment thus enhances a company's security posture, and some form of public relation (Maglaras,Ferrag,Derhab,Mukherje,Janicke & Rallis,2019). Furthermore, an incident response plan enables an organization to be prepared for the unknown as well as the known and is a reliable method for identifying a security incident immediately when it occurs.

There are six critical steps of the incident response plan, which is the preparation of users and information technology staff to handle potential incidents should they arise then determining whether an event is, indeed, a security incident. The third step is containment in which the incident damage is limited and isolating the affected system to prevent further damage. Fourth is finding the root cause of the incident (Mohammed, 2019). Fifth is recovery where the affected system back into the production environment, ensuring no threat remains. Finally, there's completing incident documentation performing analysis to learn from the incident and potentially improve response efforts.

Conclusion

When implementing an incident response plan, the organization will have to identify and prioritize assets, identify potential risks, establish procedures, set up a response team, sell the plan and finally train the staff.

References

Alsmadi, I. (2019). Incident Response. In The NICE Cyber Security Framework (pp. 331-346). Springer, Cham.

Maglaras, L., Ferrag, M. A., Derhab, A., Mukherjee, M., Janicke, H., & Rallis, S. (2019). Threats, Protection and Attribution of Cyber Attacks on Critical Infrastructures. arXiv preprint arXiv:1901.03899.

Mohammed, A. A. (2019). Digital Evidence and Best Evidence Rule Legal-Technological Approach headed for Digital Evidence Admissibility Review. Journal of Engineering and Computer Science (JECS), 19(2).