Incident Response is an essential part of protecting your business. Below we look at the six-step process and use compromised email software as an example\u00a0<\/span><\/p>\n Incident Response is preparing for the unexpected.\u00a0<\/span><\/p>\n It is a set of procedures aimed at identifying and responding to potential threats to your business.\u00a0<\/span><\/p>\n A well-crafted Incident Response plan contains strategies to prevent incidents from occurring, and steps to manage and address the aftermath if they do.\u00a0<\/span><\/p>\n Incident Response can be broken down into a six-step process:\u00a0<\/span><\/p>\n \u2714\ufe0fIdentify<\/span><\/p>\n \u2714\ufe0fProtect<\/span><\/p>\n \u2714\ufe0fDetect\u00a0<\/span><\/p>\n \u2714\ufe0fRespond<\/span><\/p>\n \u2714\ufe0fRecover<\/span><\/p>\n \u2714\ufe0fPost-Mortem<\/span><\/p>\n These six steps are the best steps to take to protect your business:\u00a0<\/span><\/p>\n Still, businesses must be aware that no Incident Response plan should look the same.\u00a0<\/span><\/p>\n How you respond to a power outage will look different from how you react to a cyber attack.\u00a0<\/span><\/p>\n Incident Response requires a tailored plan for any possible incident, as no two situations can be responded to in the same way.\u00a0<\/span><\/p>\n However, all plans should follow the general steps outlined below.\u00a0<\/span><\/p>\n 91% of all cyber attacks start with a phishing email and will be used as an example to demonstrate the six stages of Incident Response.<\/span><\/p>\n The most significant part of Incident Response planning is identifying and prioritising your systems.\u00a0<\/span><\/p>\n The hardest part is getting started.\u00a0<\/span><\/p>\n Essential questions to ask yourself at this phase include\u00a0<\/span><\/p>\n ???? What technology do I and my employees rely on in order to effectively run our day-to-day operations?? (e.g. Internet)<\/span><\/p>\n ????What if this technology stops working, can we continue to operate without it? (e.g. Payroll system is online could you create checks by hand?)<\/span><\/p>\n ????If not, how long can we operate without it? (e.g. paying staff?)<\/span><\/p>\n ????How does it affect your employees, your finances, and your customers? (e.g. employees will quit)<\/span><\/p>\n Evaluate your assets and identify what type of protection is necessary to protect them. You could do this by answering these questions:<\/span><\/p>\n ????What kind of data do we store?<\/span><\/p>\n ????Whose data is it\u2014ours or somebody else\u2019s?<\/span><\/p>\n ????What would the consequences be if the data were hacked or lost?\u00a0\u00a0<\/span><\/p>\n At this stage, you should clearly understand where your business’s weaknesses lie. This will help you understand which incidents are most likely to occur.<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n 91% of all cyber attacks start with a phishing email. The best way for managing an email compromise is to prevent it from happening in the first place.\u00a0<\/span><\/p>\n ????Good housekeeping is key. Keep your email system up to date by auditing your email systems regularly for unused accounts and disabling or deleting them if they\u2019re no longer needed. Many email compromises occur due to old or unused email accounts. If you don\u2019t need the account, don\u2019t create it<\/span><\/p>\n ????Engage other members of the organization to get more input.<\/span><\/p>\n ????Make a possibly serious situation fun. Role-play an email compromise scenario to get everyone thinking. This will help you get a few levels down with identifying how a real compromise will affect your organization.\u00a0<\/span><\/p>\n By thoroughly identifying your business’s weaknesses and blind spots in the first phase, you can implement strategies to protect your business and avoid incidents from having lasting impacts on your systems and procedures.\u00a0<\/span><\/p>\n Protection strategies include:\u00a0\u00a0<\/span><\/p>\n \u2699\ufe0fUsing backups.\u00a0<\/span><\/p>\n \u2699\ufe0fImplementing security controls like firewalls.\u00a0<\/span><\/p>\n \u2699\ufe0fTraining employees on security best practices.<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n To protect your business from email compromises, you might implement the following tactics:\u00a0<\/span><\/p>\n \u2699\ufe0fMake sure your email system is configured properly and MFA is installed on all licensed accounts, and shared mailboxes are configured to block access.<\/span><\/p>\n \u2699\ufe0fImplement Microsoft Defender for 365\u00a0<\/span><\/p>\n \u2699\ufe0fImplement email tagging. These are messages you see on emails like \u201cthis email originated outside the organization\u201d. It\u2019s simple to do and free to set up on Microsoft 365 and Gmail.\u00a0<\/span><\/p>\n \u2699\ufe0fImplement a cyber security awareness program for your organization. Awareness is the #1 deterrent against cybercrimes.\u00a0<\/span><\/p>\n Once you have identified your business’s vulnerabilities and put measures in place to protect them, you should be able to detect threats relatively quickly.\u00a0<\/span><\/p>\n Setting up procedures and systems to actively monitor your assets and identify unusual activity is vital at this phase.<\/span>\u00a0<\/span><\/p>\n Detecting irregularities quickly\u2014such as an email that just doesn’t look right\u2014is essential to limiting the damage and getting your systems back up and running.<\/span><\/p>\n A key part of detection is ensuring that all your employees are trained to identify potential threats.\u00a0<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n In the case of an email compromise, you may have the following detection procedures in place:<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>???? Awareness training is vital, so your team is educated and can detect a possible compromise.<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????Configure your email system to alert you for suspicious activities such as creating forwards or logins from unexpected locations.\u00a0<\/span><\/p>\n You need to have a plan to respond to detected cyber incidents to ensure that your business does not experience lasting effects.\u00a0<\/span><\/p>\n This plan should include strategies for containment, investigation, and resolution.<\/span><\/p>\n It\u2019s critical to ensure that all staff are aware of the incident response plan and know their roles and responsibilities in the event of an incident.<\/span><\/p>\n When creating your response plan, regardless of what the incident is, ask the following questions:\u00a0<\/span><\/p>\n ????How quickly can we isolate and cut off impacted systems?<\/span><\/p>\n ????Do we have an emergency backup procedure in place?<\/span><\/p>\n ????What systems contain the most sensitive data?\u00a0\u00a0<\/span><\/p>\n ????Do we have a 24\/7 response team available?<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n In the case of an email compromise, here is a possible response strategy:\u00a0<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????\u200d???? Block Access<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????\u200d???? Check and remove Illicit Consent Grant<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????\u200d???? Check and remove malicious Inbox Rules<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????\u200d???? Determine who should be contacted based on the incident, your cyber insurance carrier, the authorities (do you have their contact information), and of course clients that were affected by a mass email.\u00a0\u00a0<\/span><\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0????\u200d????Communicate timely, honestly, clearly, and often with everyone affected by the incident.Do not say anything you are uncertain about. Just the facts.\u00a0<\/span><\/p>\n Following any incident, businesses must have a plan in place to resume normal business operations as soon as possible to avoid disruptions.<\/span><\/p>\n This phase is about restoring and returning affected or damaged systems and devices to your business environment.<\/span><\/p>\n A well-crafted incident response plan will help you resolve an incident, minimize the damage caused and restore normal operations quickly and effectively.<\/span><\/p>\n Steps to include in your recovery plan:\u00a0<\/span><\/p>\n \u2699\ufe0fRestoring systems affected by the attack.<\/span><\/p>\n \u2699\ufe0fImplementing security controls to prevent the incident from happening again.<\/span><\/p>\n \u2699\ufe0fContact your cyber insurance company\u00a0<\/span><\/p>\n \u2699\ufe0fTake legal action against perpetrators.<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n In the case of an email compromise, the following steps may aid in recovery:\u00a0<\/span><\/p>\n The sixth step is an added layer of reflection. When you have experienced an incident, the goal is to prevent them from happening again.\u00a0<\/span><\/p>\n It is essential to understand what happened and why so that you can do better next time and minimize the risk of the incident occurring again.\u00a0<\/span><\/p>\n When looking at an incident that has occurred, ask yourself:\u00a0<\/span><\/p>\n ????What happened?<\/span><\/p>\n ????Why did it happen?<\/span><\/p>\n ????How did we handle it?<\/span><\/p>\n ????How can we prevent this from occurring again?<\/span><\/p>\n ????How can we do better next time?<\/span><\/p>\n Y<\/span>ou will also want to find out the answers to these questions and document them:<\/span><\/p>\n ????Who has access to the infected servers?<\/span><\/p>\n ????Which network connections were active when the incident occurred?<\/span><\/p>\n ????How was the incident initiated?<\/span><\/p>\n An incident response plan should be reviewed and updated regularly to remain relevant and practical. Cyber incidents can occur anytime, so it\u2019s crucial to be prepared.<\/span><\/p>\n \u2705 Sorbis Tips fo<\/b>r Managing Email Compromises\u00a0<\/b><\/p>\n ????<\/span>Update everyone on the details of the incident as they are known<\/span><\/p>\n ????<\/span>Determine if additional preparation could have prevented the incident, detected it sooner or expedited the incident response process<\/span><\/p>\n ????<\/span>Determine if there were any difficulties or confusion in following this plan or related procedures<\/span><\/p>\n Running a business is tough and cyber incident response planning can often fall to the bottom of priority lists.<\/span><\/p>\n Getting started is the hardest part, but we at Sorbis can help you by:\u00a0<\/span><\/p>\n<\/h2>\n
What is Incident Response\u00a0<\/span><\/h2>\n
The Six Stages of Incident Response\u00a0<\/span><\/h2>\n
<\/h3>\n
???? Identify<\/span><\/h3>\n
<\/h3>\n
????Protect<\/span><\/h3>\n
<\/h3>\n
????Detect<\/span><\/h3>\n
<\/h3>\n
????\u200d????Respond<\/span><\/h3>\n
<\/h3>\n
\u2699\ufe0fRecover<\/span><\/h3>\n
\n
<\/h3>\n
????Post-Mortem<\/span><\/h3>\n
<\/h2>\n
Work With an IT Service Provider Like Sorbis<\/span><\/h2>\n
\n