{"id":1742,"date":"2019-05-11T11:12:46","date_gmt":"2019-05-11T10:12:46","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1742"},"modified":"2020-07-29T23:36:18","modified_gmt":"2020-07-29T22:36:18","slug":"incident-response-phases-preparation","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/05\/incident-response-phases-preparation\/","title":{"rendered":"Incident Response Phases – Preparation"},"content":{"rendered":"

In a previous post<\/a> we discussed the importance of having an Incident Response (IR) process and our preference is one that runs Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned (PICERL). In this post, we are going to be looking a bit more into the Preparation phase of IR.
\n

\"Incident
PICERL – Common incident response process \/ framework – Starts with Preparation!<\/figcaption><\/figure><\/p>\n

Preparation<\/h2>\n

Lots of people overlook this phase because it isn’t “dynamic” and doesn’t have the technical excitement of other phases, but the reality is you are either preparing for an incident<\/em> or responding to an incident<\/em>. What matters is how you spend your time in this phase. If you use this time well, every incident you deal with will be better managed with a significantly improved outcome. However, if you waste this time, every incident will be significantly harder, more costly and cause greater impact. Really the choice is yours!<\/p>\n

Fail to Prepare, Prepare to Fail<\/h2>\n

It really is that simple.<\/p>\n

Preparation Guide<\/h2>\n

There is a lot of work to do in this phase, even though some will think it is a case of Incident Responders not doing their job. The exact activity will be organisation specific but there are some key activities everyone should follow. If you are looking for even more succinct guidance, FireEye, a world leading IR company, have an excellent article on IR Preparation<\/a>. <\/p>\n

Key Elements<\/h3>\n

When we assist an organisation in building an IR capability, we focus on technical and non-technical elements of preparation. This allows defenders to have realistic goals – if you are new to this, it can seem like an insurmountable hurdle – and allows management to have good visibility of progress towards a continuously improving target. <\/p>\n

Remember, you never finish the Incident Response Cycle. You remain in preparation<\/strong>, striving to get better until there is an incident. Then you respond, learn from it and improve your preparation for the next one. <\/p>\n

Technical Preparation<\/h4>\n

Attack Surface Reduction<\/strong>. Also referred to as “system hardenin<\/em>g” or “vulnerability management<\/em>” and lots of other terms. This is the ongoing process of trying to minimise the entry points for an attacker. It is also looking at your internal systems, making sure that an attacker who gets in cant easily move around. Typical activities here include patching, turning off unnecessary services and account management. If you are fortunate enough to have a dedicated IR team, they should work closely with your SOC or IT Service Management teams to limit the scope of attacks.
\nMonitoring<\/strong>. If you can’t see an attack, you can’t respond. It isn’t good enough to think<\/em> monitoring is in place, you need to check this. Check:<\/p>\n