A few years ago, SANS Institute, one of the trusted resources for information security training as well as cybersecurity certifications and research, published a 6-step framework that companies must keep in mind while building incident response plans. SANS’ 6-steps to an incident response plan:
Preparation: An organization’s CSIRT needs to be aware of their security policies, whom to contact in case of an incident, and have access to the toolkits required to perform the actual incident response process.
Identification: The team should know where the incident occurred, who reported it, and how it was discovered. They must be able to detect the compromised areas, the scope of impact, and the sources of the incident.
Containment: After identification, one of the major steps is to contain the threat and prevent further damage. There are two types of containment—short-term and long-term. In short-term containment, an immediate response is taken to stop the threat from spreading and causing further damage.
Eradication: The next process is to restore the affected systems. In this process, all the systems involved in the incident are reimaged and traces of the security incident are removed.
Recovery: Security teams need to confirm that the affected systems are recovered and functioning properly. Furthermore, they must set timelines to restore operations completely and continue monitoring for any abnormal activity within the network.
Lessons Learned: After an incident occurs, an incident response report must be documented that can help the team to improve its future efforts.