A threat to your network is inevitable. If you are still in the mindset of ‘it won’t ever happen to me’ – think again. Many people underestimate the magnitude of a data breach because they can’t fathom it happening. Nevertheless, losing data (either from a natural disaster or a cyber-generated one) can kill your business, or worse, your reputation. If you’ve had the unfortunate experience of being violated by a bad actor, then you’ve already lived through the aftermath of a cyberattack.
Got IRP?
IRP stands for Incident Response Plan. An incident response plan is an instruction manual for your IT staff to identify, react to, and regain control from a network security incident. This plan is designed to address issues like a data breach, ransomware, and service outages that threaten your daily operations.
How about DRP? DRP, on the other hand, stands for Disaster Recovery Plan. A disaster recovery plan is broader in scope and details how to reduce risk and restore your operations in the event of a disaster (eg. equipment outages caused by a cyberattack, inclement weather or human error). Your DRP should include your IRP, and both are critical to business continuity in the event of an incident. Cyberattacks cost U.S. organizations more than $4 billion in 2020 and have only accelerated in 2021; it’s beyond time to proactively prepare your team for an event.
Where should you start?
Lawyer up. Partner with a law firm equipped to handle cyber incidents. They should have expertise specific to your industry and well as cyber defense experience. When you have an event, your attorney is the first person you call, and then you can call your insurance company.
Get the right kind of insurance. You hope that your insurance will cover a breach, but being financially prepared for a breach is a must. Sit down with your insurance agent about the scope of this policy and what it will cover.
Update your company policy and code of conduct. Document scenarios and identify situations where incidents can be litigated. This is vitally important to defend your company from an inside threat. Have an external counsel review your policies.
Create a communication plan. Who does an employee contact when they find something suspicious? Develop a document outlining out-of-band communication methods should your environment be compromised, and you need to reach people. Take your communication plan to your attorney for review; then take that plan, distribute it, and make a hard copy.
Build a team. Your leadership team needs to be honest with each other. Do you really have the bandwidth to handle a breach? Typically, the answer is no because everyone on the team is already working at full capacity. If your internal team is not capable of triaging a cyber incident, you need to partner with an external Incident Response company who can deploy a team quickly to your location. Again, this would be after you speak to your attorney first.
Review annually. Your plan should be reviewed yearly by the IRP team to assess roles, responsibilities, and plans of action in the event of a breach. An incident response plan often includes:
- Accountability Chart – Start with a list of roles, to whom they are assigned, who is in them, and their detailed responsibilities.
- Critical Tool Inventory – Create a summary of the technologies and physical resources required for the business to run. Document what was affected during the incident.
- Data & Network Recovery Plan – Document all processes that outline how to recover critical data and network assets.
- Incident Communication Plan – Write the script for both internal and external stakeholders.
Know the difference between an IRP and a DRP. Your incident response plan is for one incident. It is the immediate action you take to avoid having to go into disaster mode. Your DRP is a plan that goes into place if your operations have been halted or severely disabled. Here are a few things to remember when defining your DRP:
- Decide what’s most important to protect – Back it up. Make sure there is redundancy in the backup. This will ensure you can restore your operations quickly. We recommend the 3-2-1 backup rule: 3 copies of data on 2 different media with 1 copy off-site.
- Identify your single points of failure – Address them for every single aspect of your organization. For your network, that means more replication and deploying software failover features.
- Ensure your team has the ability to work – We all know the story of companies that were caught flat-footed by the pandemic. The new precedence has been set, so make sure your team has secure access from wherever they work.
- Test your plan – Your DRP goes hand-in-hand with your IRP. Have you ever tested your DRP to know that you have consistent and quality backups? It’s important to maintain secondary equipment to restore your data and preserve evidence.
Keep calm. It’s important not to have a knee-jerk reaction when an incident occurs. You will want to preserve the evidence for your defense. Nefarious actors are very patient and will sit in your environment collecting data. The U.S. Office of Personnel Management (OPM) breaches realized in March 2014 and June 2015 dated as far back as November 2013 because the cybercriminals operated undetected. Thieves want to get as much data on you as they can. The more they have, the more they can up the ransom.
Ready to build your IRP and DRP?
Contact Arctic IT. We can talk through all your options and make recommendations to get you started on your path to developing an IRP and DRP for your organization. Connect with us at [email protected] today to learn more.
By Paul Clark, Principal Solution Architect – Microsoft 365 and Security at Arctic IT