Incident response is one of the final frontiers of security that the majority of businesses have yet to explore. Although most have the written policies and the proper technologies, many enterprises are ill-prepared for that unexpected and often undetected security incident. This general lack of preparedness has created a “wing it” attitude over the years. Even worse, IT and security teams frequently lack clear goals, and executive management and board members are too disconnected from the security function to bridge this gap.

Management often assumes that IT and security have everything under control. After all, good money was spent on security, so things should be locked down and incidents shouldn’t occur, right? On the other hand, many IT and security professionals believe they can handle an incident and everything that comes with it. That may be true from a technical perspective, but dealing with the people and business side of a security incident is an entirely different matter that requires different people and various skill sets within the organization.

Listen to the podcast: Get Smarter About Disaster Response — Five Resolutions for 2018

Who Is Involved?

So, who needs to be on your incident response team? The answer is straightforward in many ways. Computer security-related incidents are like other business crises: You have the right people in the right roles to execute a predeveloped plan that will minimize the impact on the business.

Still, it is security, so there’s going to be politics, resistance and downright ignorance among those involved. Here are the roles that I’ve seen taking part in the response process in fully functioning security programs:

• Legal counsel to provide oversight and guidance on steps to take or not take;
• Executive management for decision-making at the executive/board level;
• IT and security teams for technical guidance and execution of the initial incident response phases;
• Compliance for assistance with incident oversight and follow up, including any breach notification or reporting that may be required;
• Business operations for guidance and communications across departments and teams;
• Human resources for facilitating internal communications and assisting with user-centric security policies that may have been violated;
• Public relations expertise from someone who has experience in this area and a prepared message;
• Outside consultants who can provide incident response, forensics and security testing expertise;
• Vendors such as internet service providers (ISPs), cloud service providers and managed security service providers (MSSPs); and
• Business partners that have close technical ties to your environment.

Leading With Prevention

Incident response planning should focus on prevention. It requires proactively monitoring for incidents. After the incident occurs, it involves proper containment and clean up. It may impact sensitive information and thus require a formal investigation. The process and findings need to be communicated to all the parties involved — potentially including the general public. It has to have follow up, adjustment and ongoing oversight. Every single role in the list above is required to make these things happen.

When you look at some of the biggest breaches, it seems that incident response was a fleeting thought up until the moment of detection. In many cases, it is then, and only then, that response procedures are ever considered. There’s irony in the fact that executive management and legal suddenly take an interest in security if the news media gets involved and shareholders come calling. That’s certainly not the time for security buy-in to finally happen.

Along the lines of the Chinese proverb, the best time to start developing, testing and fleshing out your incident response plan was 20 years ago. The second best time is now. The former applies to organizations that have already suffered breaches. The latter applies to everyone else.

Start Now

Get started on incident response today. The time’s going to pass anyway, so why not start now to make things right? Round up the necessary people, come up with a plan or update your existing one and run tabletop exercises with the team to see how it will all come together. Your main goal should be to maximize the chances of the plan working once it’s executed in a real-world scenario. If it does, you will come across as a true professional with a bit of security wisdom. If it doesn’t, you will come across as a harried beginner who doesn’t take security as seriously as others assumed.

In the end, your incident response team should be made up of people who are the best fit for your organization’s needs. Just make sure it’s people outside of IT and security. As Einstein said, “We cannot solve our problems with the same thinking we used when we created them.” Change before you’re forced to. Getting all the right people involved with incident response will make a tremendous difference in your efforts not if, but when, the big incident occurs.

Learn More About IBM’s Incident Response and Intelligence Services