The two key ways businesses can ensure this happens are;
• Have supporting ‘how-to’ guides in place. Having common scenarios documented gives teams access to information that provides more context to possible attacks.
• Businesses should invest time in undertaking regular incident response exercises. This involves identifying likely incident scenarios and building exercises that test your business’s ability to manage them.
This leads on to thinking about the people element of cyber security, and its impact on keeping an incident response plan alive within a business. When cyber-attacks occur there is real life experience which the learnings from can be built into the future of the plan. Alongside this is the need for teams to be keeping themselves abreast of what is happening within your industry sector regarding cyber security and cyber-attacks.
The 2021 UK Government Cyber Security Breaches Survey shows that the most common response to any cyber-attack is to make technical changes. This could suggest that fully investigating the root cause of incidents, or preventing people causing issues again, is ignored. It is increasingly important to encourage proactive investment in protecting your business, as so often we see organisations only doing this post-attack to protect themselves in the future. Further to this, during and after an attack there would be a greater understanding of the situation and what is required of everyone in the organisation, so applying these lessons learned to the incident response plan ongoing is a key step.
It’s important to remember that according to the 2021 X-Force Threat Intelligence Index from IBM, human error was a major contributing cause in 95% of all breaches reported in their research, so to continually invest in staff awareness around cyber security can bolster all other efforts in the business ahead of any attack.
Lastly, never forget that Incident Management should have a recovery and learning focus and not be about blame.