Incident Management: Planning and Response

Do you know that the right response to a major cyber incident can mean the difference between your organization's survival and its downfall? The story of the infamous 2017 Equifax data breach is one stark reminder of the catastrophic consequences of mismanaging a cyber incident. Within a few weeks, the incident had wiped off over $5 billion of Equifax's market value.

Incident Management: Planning and Response is a unit designed to equip learners with the knowledge and skills to prevent such a disaster.

A Look at the Setup: Site, Staffing, and Arrangements

When a cyber incident strikes, a well-planned response involving a specific site, skilled personnel and strategic organizational arrangements can make all the difference. For instance, a dedicated office space equipped with secure computer systems and staffed by a team of cyber security specialists can expedite the response process. Sony Pictures, in response to their 2014 cyber-attack, established a clean room for investigators to work on their systems, highlighting the importance of a pre-planned site.

Forming an Organizational CERT Team

A crucial part of incident management is the formation of a Computer Emergency Response Team (CERT). This is a group of experts trained to respond to cyber incidents. When GitHub suffered a DDoS attack in 2018, its internal CERT team played a pivotal role in the mitigation process. The team was able to quickly respond, analyze the situation, and reduce the impact of the attack.

Landing on the Right Personnel and Equipment

The right personnel and equipment are another critical factor in incident planning and management. Cyber security analysts, network engineers, forensic experts, threat intelligence analysts are just a few roles that form a competent CERT team. Moreover, it is essential to have the right equipment like intrusion detection systems, firewalls, threat intelligence platforms, and forensics tools to facilitate incident response.

An Exploration into Incident Management Sub-Disciplines

Learners will delve deeper into the core sub-disciplines of Cyber Incident Management. This includes disciplines like disaster recovery, business continuity, and crisis communications among others. Real-life incidents such as the Dyn DDoS attack of 2016 serve to illustrate the importance of these disciplines. Dyn was able to recover quickly and restore services due to its strong disaster recovery practices.

In conclusion, understanding and implementing the elements of Incident Management: Planning and Response can go a long way in safeguarding an organization from the fallout of a major cyber incident. As the digital landscape continues to evolve, so does the complexity and frequency of cyber attacks, making this knowledge more relevant than ever.