{"id":1724,"date":"2019-04-11T12:04:03","date_gmt":"2019-04-11T11:04:03","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1724"},"modified":"2020-08-07T13:53:03","modified_gmt":"2020-08-07T12:53:03","slug":"incident-response-process-matters","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/","title":{"rendered":"Incident Response – Process Matters"},"content":{"rendered":"

In the last month, there has been news about a range of cybersecurity breaches. The Register reported over 620 million hacked accounts<\/a> being available from breaches on popular apps like MyFitnessPal and ShareThis. At the same time ransomware continues to disrupt healthcare<\/a>, government<\/a> and private companies<\/a>. It seems a redundant truth to say breaches are inevitable. This means incident response is a critical business process for every organisation. Incident Response really does matter<\/a>.<\/p>\n

\"Incident
PICERL – Common incident response process \/ framework<\/figcaption><\/figure>\n

When it comes to building an Incident Response process, you need to decide on a framework. This can be anything you want. The key is pick one you understand and covers the important stages. PICERL (shown left) is one of the more common frameworks used to build an incident response process. In this, the flow runs P<\/strong>reparation, I<\/strong>dentification, C<\/strong>ontainment, E<\/strong>radication, R<\/strong>ecover and then L<\/strong>essons Learned. Future blog posts will look at each stage of PICERL in a bit more detail.<\/p>\n

If you are starting off, all that matters is that you have<\/strong> a process. <\/p>\n

Incident Response Process Matters<\/h2>\n

Key areas to consider are the fundamental areas of incident response – the things you do before the incident, how you respond to the incident and what you do after the incident. It may seem strange but all three areas are equally important so make sure you don’t just focus on the bit in the middle. The more effort you, or your response team, put into the first and last stages, the better and faster the middle bit will happen.<\/p>\n

Once you have built a framework (or adopted an existing one) you can start to flesh out the details. Avoid perfection here and don’t think that once a document is written, it has to be set in stone. You can’t predict every incident in advance and trying to do so is the path to madness. Start with some likely events and document how you want your incident response team to respond. Then, over time build new ones. When you have incidents, update and modify your process documents. <\/p>\n

When you adopt new technology, or change business processes, update and change your documents. When you get new staff into the incident response team, have them read & review the documents to see if they have any suggestions for improvements. It doesn’t matter how you do it, just need to keep the documents living and current. <\/p>\n

Avoid the trap of thinking you need a finalised version for Audit or Compliance (you might do, but that is a different problem), and focus on having a version which works, can be used by your responders and relates to your current business. <\/p>\n

Summary<\/h2>\n

As always, if you want specialised training for your IR team, we can provide tailored courses on or off-site for your staff, as well as table-top scenarios and red team exercises to ensure practical experience. Alternatively, you can look to send your staff on public training such as SANS SEC504<\/a> and SANS FOR508<\/a>.<\/p>\n

If you want to find out more, as always, get in touch<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic to your organisation.<\/p>\n","protected":false},"author":1,"featured_media":1730,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[5],"tags":[159,151,74,137,171,170,173,172],"class_list":["post-1724","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cyber-security","tag-dfir","tag-incident-management","tag-incident-response","tag-ir-process","tag-irm","tag-picerl","tag-process","entry","has-media"],"jetpack_publicize_connections":[],"yoast_head":"\nIncident Response - Process Matters - Halkyn Security Blog<\/title>\n<meta name=\"description\" content=\"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Incident Response - Process Matters - Halkyn Security Blog\" \/>\n<meta property=\"og:description\" content=\"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\" \/>\n<meta property=\"og:site_name\" content=\"Halkyn Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-11T11:04:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-08-07T12:53:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"719\" \/>\n\t<meta property=\"og:image:height\" content=\"718\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Halkyn Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:site\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Halkyn Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\"},\"author\":{\"name\":\"Halkyn Security\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\"},\"headline\":\"Incident Response – Process Matters\",\"datePublished\":\"2019-04-11T11:04:03+00:00\",\"dateModified\":\"2020-08-07T12:53:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\"},\"wordCount\":524,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"keywords\":[\"Cyber Security\",\"DFIR\",\"Incident Management\",\"Incident Response\",\"IR Process\",\"IRM\",\"PICERL\",\"Process\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\",\"name\":\"Incident Response - Process Matters - Halkyn Security Blog\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\"},\"datePublished\":\"2019-04-11T11:04:03+00:00\",\"dateModified\":\"2020-08-07T12:53:03+00:00\",\"description\":\"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.\",\"breadcrumb\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Halkyn Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Incident Response – Process Matters\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"name\":\"Halkyn Security Blog\",\"description\":\"Specialist Security & Risk Management Consultants\",\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\",\"name\":\"Halkyn Consulting\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"width\":\"990\",\"height\":\"170\",\"caption\":\"Halkyn Consulting\"},\"image\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/2329571\",\"https:\/\/twitter.com\/HalkynSecurity\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\",\"name\":\"Halkyn Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"caption\":\"Halkyn Security\"},\"description\":\"Halkyn Security Consultants.\",\"sameAs\":[\"http:\/\/www.halkynconsulting.co.uk\/\"],\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Incident Response - Process Matters - Halkyn Security Blog","description":"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/","og_locale":"en_GB","og_type":"article","og_title":"Incident Response - Process Matters - Halkyn Security Blog","og_description":"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.","og_url":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/","og_site_name":"Halkyn Security Blog","article_published_time":"2019-04-11T11:04:03+00:00","article_modified_time":"2020-08-07T12:53:03+00:00","og_image":[{"width":719,"height":718,"url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1","type":"image\/png"}],"author":"Halkyn Security","twitter_card":"summary_large_image","twitter_creator":"@HalkynSecurity","twitter_site":"@HalkynSecurity","twitter_misc":{"Written by":"Halkyn Security","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#article","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/"},"author":{"name":"Halkyn Security","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2"},"headline":"Incident Response – Process Matters","datePublished":"2019-04-11T11:04:03+00:00","dateModified":"2020-08-07T12:53:03+00:00","mainEntityOfPage":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/"},"wordCount":524,"commentCount":0,"publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"keywords":["Cyber Security","DFIR","Incident Management","Incident Response","IR Process","IRM","PICERL","Process"],"articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/","url":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/","name":"Incident Response - Process Matters - Halkyn Security Blog","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website"},"datePublished":"2019-04-11T11:04:03+00:00","dateModified":"2020-08-07T12:53:03+00:00","description":"Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic.","breadcrumb":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/04\/incident-response-process-matters\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Halkyn Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/"},{"@type":"ListItem","position":2,"name":"Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/"},{"@type":"ListItem","position":3,"name":"Incident Response – Process Matters"}]},{"@type":"WebSite","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","name":"Halkyn Security Blog","description":"Specialist Security & Risk Management Consultants","publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization","name":"Halkyn Consulting","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","width":"990","height":"170","caption":"Halkyn Consulting"},"image":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/2329571","https:\/\/twitter.com\/HalkynSecurity"]},{"@type":"Person","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2","name":"Halkyn Security","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","caption":"Halkyn Security"},"description":"Halkyn Security Consultants.","sameAs":["http:\/\/www.halkynconsulting.co.uk\/"],"url":"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9yHvD-rO","jetpack_likes_enabled":true,"_links":{"self":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/comments?post=1724"}],"version-history":[{"count":16,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1724\/revisions"}],"predecessor-version":[{"id":1798,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1724\/revisions\/1798"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media\/1730"}],"wp:attachment":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media?parent=1724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/categories?post=1724"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/tags?post=1724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}