Let's take a look at incident response.
The outcomes of a business continuity management system are that we
have plans in place for incidents through incident response planning
which address things like life safety, containment of the incident,
documentation of the incident, and the ability to return to normal operations.
Business continuity planning is based on a business impact analysis,
the critical business functions, the recovery time objective,
the data recovery point objective,
and the requirements to enable recovery of systems.
Disaster recovery planning,
the relocation of IT and other services to an alternate location.
When we look at an event, an event can be defined as any measurable occurrence,
something happened, somebody walked in, somebody walked out.
That's an event.
An incident is a type of event with a potential to affect business mission.
In other words, we could call it an adverse event.
All incidents are types of events,
but certainly not all events are types of incidents.
Our goal is to build resilient systems.
We see all that used a lot today in the ability of business resilience means we
can continue operations even during adverse circumstances.
We have response plans in place to address especially
things that have happened in the past.
If it's happened before, there is a chance it could happen again.
We also have to know what are the current trends and threats,
what are the types of attacks being used today? Is today's problem,
say ransomware or DDoS attacks?
We should know what the current, should we say, tool of choice of hackers is.
And of course,
we should look at areas of change because everything
worked well until we made a change.
In many cases, it's when we have a change in staff,
a change in procedures, a change in equipment that we get more incidents as well.
Incident management is a structured process that starts with preparation.
Let's be prepared in case something happens,
then we can prevent it as much as possible if we
know the things that can happen.
But we have to be alert to the fact that things can still happen,
even though we are prepared and have prevented,
so we need good detection.
When something happens, we need to stop it from spreading,
and that, of course, is containment.
Then we want to get back to normal, restoration,
and apply lessons that were learned.
We can see, for example, a fire is an example of an incident.
We're prepared by having equipment and alarms and smoke detectors.
We try to prevent fires through good practice of not
overloading electrical circuits or having dangerous
circumstances that could lead to fire,
but we have those detectors so if there is a fire we'd know about it.
The first thing we want to do if there is a fire is to contain it,
stop it from spreading, close fire doors,
for example.
After the fire is out, we need to rebuild,
restoration, and then, of course,
learn how could we make sure that this doesn't happen again.
The idea of preparation starts with policy.
Do we have policies about how to deal with things and who
has the authority if there is an incident?
So it's not such that in a case of a crisis,
everybody is wondering well, who can make the decisions?
Who's in charge?
We have defined team members, each with their own role,
and of course, with the procedures of how we would do things.
We want to make sure that everything is documented
because when we have things documented,
we'll be able to go back and review what went well,
what could we improve on, for example.
And of course,
we want to have regular reporting back to management and our customers and
employees of what is the current status of the incident.
The idea of prevention, of course,
is to have learned what are the things that could happen,
so hopefully we reduce the vulnerabilities or re‑reduce the
likelihood of something happening again.
The better we can be at prevention,
the better we can be hopefully at avoiding having to deal with incidents at all.
We know that a lot of this is learning from what are the bad guys doing.
The types of attacks they're using are the things I
should especially be watching for, in other words,
offense drives defense.
We need to monitor and know what's happening on our systems,
networks, applications, and users.
We see far too often that the problem is the attack had
gone on for months and nobody recognized it because nobody
knew what was normal activity.
We should test our controls to make sure they're working,
and certainly we should have awareness programs so people know what
to watch for and what to do if something happens.
The key points review.
The secret to incident management is preparation,
manage the incident and don't let the incident manage you.
Prevention is better than recovery,
and learn from past incidents how to be better prepared.