Developing Your Incident Response and Recover Plans
Your small business can face many different incidents. Some examples include:
Ransomware
Ransomware is a type of malware that locks you out of files or systems until you pay a ransom to a threat actor. Payment does not guarantee that you will regain access to your information.
Data theft
Data theft occurs when threat actors steal information stored on servers and devices. The data is most commonly accessed using stolen user credentials. Advanced persistent threats (APTs) refer to threat actors that are highly sophisticated and skilled. APTs are able to use advanced techniques to conduct complex and protracted campaigns in pursuit of their goals. The APT designator is usually reserved for nation states or very proficient organized crime groups.
Active exploitation
Active exploitation takes advantage of unpatched software, hardware, or other vulnerabilities to gain control of your systems, networks, and devices. These attacks can go unnoticed before you have the opportunity to apply a patch or update. Your plan should provide instructions for mitigating active exploitation, such as temporarily suspending Internet access or ceasing online activity.
Part 1: The ‘Respond’ Component
- Preparation – Have a Simple Plan & Key Contacts Ready
- Detection & Analysis – Know & Understand an Incident
- Containment – Stop the Bleeding!
- Eradication & Recovery – Remove the Threat
- Post-Incident Activity – Learn & Improve
Part 2: The ‘Recover’ Component
- Recovery Planning – Your Safety Net
- Recovery Execution – Getting Systems Back Online
- Communications During Recovery
- Improvements – Learning from Recovery
Essential Tips for Success…
Outsource When Possible
Employee Training is Gold
Partner with a managed service provider for access to expertise and tools.
Regular, simple training on phishing and passwords is one of the most effective investments you can make.
Consider Cyber Insurance
Document & Review Regularly
Partner with a managed service provider for access to expertise and tools.
Regular, simple training on phishing and passwords is one of the most effective investments you can make.