6 Cyber Myths for Small Businesses Debunked

Incident response is a key part of your cyber security strategy, and part of the wider cycle of business protection. As detailed by the National Institute of Standards & Technology (NIST), this cycle includes: Identify, Protect, Detect, Respond, Recover. Your incident response plan is related to disaster recovery, and your crisis management, and they all come into play when the incident is momentus enough to cause serious disruption and damage to your company.

According to the National Cyber Security Centre, your incident response plan should include:

1) Key contacts, such as your IT provider, senior management team, your solicitors, digital PR company, HR department and insurance company. It’s recommended that you have at least 2 contact methods and at least 2 contacts for each of these, just in case 1 of them isn’t available.

2) Escalation criteria – Matrices should be developed to identify the seriousness and priority level of an incident, as this can then inform how quickly it needs to be taken care of, and who it needs to be escalated to. As an example, a high or critical severity incident should likely go to the board level, whereas a low priority event could be handled by your IT team.

3) Processes – such as the incident response cycle, which includes:

Analyse: This includes everything from technical analysis through to reviews of any online and offline reactions, so that they can be handled correctly. It’s key that these tasks are prioritised and that any findings are reviewed, as this could lead to new tasks.

Contain/Mitigate: The next step is reduce any impact or fallout from any incidents, and also lessen the chances of them getting worse. This could involve: Blocking access/activity, isolating related systems and resetting accounts and passwords, as well as any media handling. Two key things to take into account here:

You may need to make critical decisions here regarding key business systems, and the consequences of this.
It’s possible that your cyber attacker may react badly to actions, and make further attempts to hinder your network security. Therefore, it may be better to monitor and analyse the current situation before taking further action. 

Remediate / Eradicate: This is where you aim to remove the cyber threat from your systems and networks. 

Recover: Once the cyber threat has been contained, and systems have returned to normal, clean systems and data are put back online, and any further regulatory, legal or PR-related problems are handled.

4) Have at least one conference number to hand, and this should always be available to make any urgent calls.

5) Basic guidance on both relevant legal or regulatory needs, and knowledge of when to utilise legal support and your HR department, as well as how to follow guidelines that will ensure you stick within the law.