The challenges of incident response plans and procedures

As security professionals, you are fully aware of the vital importance of having an efficient incident response team. However, with the sheer volume of daily alerts many departments experience, it has become increasingly impossible for companies to hire a large enough staff to investigate all the issues in an effective and realistic time period.

With 91% of security experts agreeing that their organization’s spending on incident response will increase over the next two years, let’s take a quick look into some of the most prevalent failures and suggested remedies that incident response teams experience.

Issue #1: Incident response tools are inadequate, unmanaged, untested or underutilized. Incident response activities rely heavily on technology tools to enable discovery of information about systems. Therefore, without proper planning, training and upkeep, even the greatest technology tools can fail and/or be misused.

Pro tip: Keep a centrally maintained list of inventory tools to ensure that license renewal dates and upgrades are properly accounted for. Additionally, employees should be adequately trained on tools either by outside vendors or internal personal to ensure common practices are established across the team and company.

Issue #2: The incident response team lacks a proper balance between skill-set, size and management oversight. With limited security budgets, many organizations assign incident response duties to system and network administrators. These professionals have the technical knowledge and training to understand how the systems work, however, they may have no experience making business-impacting decisions amid a crisis or breach.

Pro tip: Avoid conflicting and overlapping efforts by clearly defining roles and responsibilities for each team member. Any successful incident response team should be spearheaded by a strong leader who encourages collaboration and communication among team members and other departments within an organization.

Issue #3: Processes and procedures related to incident response are not tailored to the organization. The majority of organizations have generic incident response plans that contain extensive steps that should be taken in a potential security incident. Though this thoroughness may seem valuable, it can often overcomplicate the response procedure, completely slowing down process.

Pro tip: Organizations should establish procedures and plans that are specifically tailored to their culture, environment and business concerns. All documentation should be as concise as possible and should constantly be evolving to fit with technology trends and regulation.

For incident response teams, the unpredictability and sheer volume of alerts can make any crisis response process extremely stressful and difficult. However, organizations can distance themselves from failure by laying a solid foundation of response policies and procedures, giving the incident response teams the tools and ability to contribute to the success of the organization.