13 incident response best practices for your organization

What is incident response and why is it important?

Incident response identifies the activities organizations need to perform to identify, detect and stop a security incident; recover from an incident; and prevent similar future incidents. The ultimate goal of incident response is to reduce the amount of damage a specific incident can cause.

Incident response best practices

Organizations should follow incident response best practices to ensure they're prepared to take action if and when needed. The following best practices should be administered at strategic (framework), tactical (plans/playbooks) and team (people) levels.

1. Build an incident response plan

Develop an incident response plan that outlines the steps the incident response team should follow in the event of an incident. The plan helps teams improve response and recovery times to restore business operations quickly and effectively.

2. Use an incident response framework

Incident response plans are often based on incident response frameworks that outline how to best structure incident response operations. Frameworks are available from NIST, ISO, ISACA, SANS Institute and Cloud Security Alliance, among others. These frameworks outline response operations and how operations are grouped or segmented. When developing an incident response program, review such frameworks to determine which elements are best suited for your organization's needs.

3. Follow the 6 phases of incident response

Incident response frameworks outline the basic phases to handling incidents. The six phases commonly used across incident response frameworks are the following:

• Preparation. This phase involves the creation and periodic review of policies and playbooks, risk assessments, identification of incident response team and other tasks to effectively respond when an incident occurs.
• Detection. This phase includes discovering that an incident is occurring and collecting evidence and assessing the severity of the event.
• Containment. This phase includes tasks to limit the effect of an incident.
• Eradication. This involves the removal of the root cause of the incident.
• Restoration. This phase is returning affected systems and devices to standard operations.
• Post-incident evaluation. This includes documenting the incident to gain insight on how it happened and to apply lessons learned for the future.

4. Create incident response playbooks

Organizations should have a library of incident response playbooks -- documented step-by-step procedures -- on how to address common incidents, such as ransomware and phishing attacks, network intrusions and malware infections. Playbooks help ensure incidents are responded to quickly and consistently across an organization.

5. Build an incident response team

An incident response team is essential to ensuring incident response plans and playbooks are carried out properly. The size, type and name of an incident response team varies depending on individual organizations' needs, but the goals are the same. When creating an incident response team, consider which members to include -- internal and external -- and their roles and responsibilities. A core technical team -- including an incident response manager, security analysts and incident responders -- needs to have supporting members, including communications representatives, external stakeholders and third parties, such as service providers and consultants.

6. Keep lines of communication open

An incident response communication plan helps incident response teams share knowledge on security events and provide updates on incident response progress. Communications might need to be internal and external depending on the incident.

7. Train response personnel

Members of the incident response team must be trained on incident response processes and their specific responsibilities. Conduct periodic trainings to ensure team members know how to respond, and run incident response tabletop exercises to ensure they are prepared when a real incident occurs.

8. Continuously evaluate processes

Incident response processes must be constantly evaluated, reviewed and updated based on changes to IT infrastructure, business operations, personnel and the ever-expanding threat landscape. Outdated plans result in confusion and undermine incident response procedures.

9. Hunt for intrusions

Don't wait for an incident to happen. Use threat intelligence and threat hunting to proactively discover indicators of compromise. Consider using detection systems that alert incident response teams when suspicious behavior is observed.

10. Conduct post-incident reporting and identify lessons learned

Once an incident has been prevented, mitigated or resolved, the incident response team should create a report on what happened, how the incident was handled and any lessons learned -- for example, how to better respond to such an event in the future. Adjust plans and playbooks accordingly.

11. Choose the right tools

Incident response teams need the proper incident response tools to help detect, analyze and manage threats, as well as create reports. Common incident response tools include the following:

• Vulnerability management tools.
• SIEM systems.
• Endpoint detection and response.
• Security orchestration, automation and response.
• Forensics analysis tools.

12. Consider automation

Automation can augment understaffed or overwhelmed incident response teams. Automated incident response tools use AI and machine learning to help security analysts sift through a deluge of data to find and analyze potential incidents. They can also triage lower-level incidents and routine tasks, thus freeing analysts to focus on more pressing issues and analysis.

13. Outsource if needed

Organizations that can't handle in-house incident response may be better suited to outsource some or all incident response tasks. Managed security service providers can manage threat detection and response, assist with communications and PR management, and conduct crisis management for organizations that don't have the staff or resources to do so themselves.