As of 2022, 83% of organizations have had more than one data breach, costing those organizations millions of dollars in damages. In today’s cyber-landscape, companies are no longer wondering if they will ever experience a breach but when a breach will occur.

Developing an Incident Response Plan is imperative for when an organization thinks they may have experienced a data security breach or security incident. One of the most important aspects of incident response is the collection and evaluation of evidence. Just because a laptop computer seems to be missing, the organization does not have conclusive evidence that they have actually suffered a data security breach. So, when an organization believes they have experienced a security incident, the incident must be carefully evaluated, following a professional, disciplined approach to gathering and evaluating evidence, to conclude whether or not a data breach has occurred.

It’s often wise to ensure that all of the details of any investigation into a data breach are maintained as confidential. Keep in mind that your legal adversary may disagree with your own evaluation of the security incident and evidence. So, when an organization is conducting an incident response plan, ensure that all the investigators have signed an appropriate non-disclosure agreement, and to have legal counsel engaged in the investigation. Often times, if counsel is involved in the investigation, they can cloak the investigation into something known as an attorney work product. This is very similar to attorney-client privilege, and a form of confidentiality that is enforced in law.

Once you’ve conducted your incident response plan, gathered and evaluated all necessary evidence, you may then determine if a security incident has occurred, and the appropriate next steps for responding to the incident.

To learn how KirkpatrickPrice can help you with your compliance objectives, contact us today!

What is an Incident Response Plan?

An important part of the incident response when an organization thinks it might have a data security breach is the collection and evaluation of evidence. Just because a laptop computer can’t be found, for example, doesn’t necessarily mean that the organization has conclusive evidence that it has in fact suffered a data security breach for which it must give notice of under different kinds of laws. Therefore, as an organization sees that is has an incident that needs to be evaluated more carefully, the organization is wise to follow a professional, disciplined approach to gathering evidence and then evaluating that evidence to conclude whether if in fact a breach has occurred for which your organization needs to give notice.

An important factor to bear in mind as your organization conducts an incident response is that the legal adversary of the organization may disagree with the organization’s own evaluation of the incident and the evaluation of the evidence. For example, a legal adversary could be a class action plaintiff’s lawyer or it could be a government regulator. These adversaries, if they were able to gain access to the organization’s full investigative details, might say, “Wait, you had all of this information that shows that you had a breach and that you should’ve given notice, therefore, you’re bad and we should sue you or punish you.” On the other hand, from the point of view of the organization, the organization may actually review the same evidence and conclude, “No, there was not a breach under the law, therefore we should not have given notice.”

So, here’s the point: when an organization is conducting an incident response, it’s often wise to ensure that all the details of that investigation are maintained as confidential. Ways to maintain confidentiality would be 1) ensure that all of the investigators have signed an appropriate nondisclosure agreement and 2) your organization may be wise to actually reach out to legal counsel and have legal counsel engaged in the investigation. Often times, if counsel is involved in the investigation, then counsel can cloak the investigation into something that’s known as an attorney work product. An attorney work product is very similar to an attorney-client privilege. It’s a form of confidentiality that can be enforced in law, so if an attorney is substantially involved in incident response and evidence is collected, and the organization doesn’t want the results of the investigation’s evidence to go to legal adversaries, the attorney work product doctrine will help the organization achieve that goal.

There were many missteps that led to the Capital One breach, but what’s the one thing that went as planned? From our perspective, Capital One’s incident response plan seemed to function as intended. Incident response is incredibly important following a breach – that’s why having a plan and team in place is required by so many information security frameworks. The data proves the importance of incident response plans as well. IBM’s 2019 Cost of a Data Breach reports that organizations with an incident response team and extensive testing of their plans could save, on average, about $1.2 million on the typical data breach. In Capital One’s case, though, this incident will cost $100 to $150 million in 2019 alone. Is developing and testing an incident response plan worth millions to your organization?

Capital One’s Incident Response Plan

The Justice Department’s Compliant includes the report that was submitted to Capital One’s Responsible Disclosure program on July 17, 2019. By the end of that month, Capital One announced the breach to the public and explained what they knew, the mitigation work they’d already performed, and which customers were impacted.

From Capital One’s announcement, we can determine they took the following steps to validate and mitigate the reported findings:

  • Immediately fixing the configuration vulnerability
  • Working with the FBI to arrest the person responsible
  • Determining exactly what type of information was compromised and how many individuals in the US and Canada were impacted
  • Performing an analysis to determine if the information was shared or used for fraud
  • Notifying customers
  • Answering FAQs like: What was the vulnerability that led to this incident? When did this occur? Was the data encrypted and/or tokenized? Did this vulnerability arise because you operate on the cloud?
  • Making information about the incident available on their online and easily accessible

When a household name like Capital One has a major breach, it makes headlines for years. There are major legal and regulatory ramifications for Capital One to answer to, but as far as basic incident response goes, we admit that Capital One seems to have had a thoughtful, tested incident response plan. This was vital in reassuring the public that, even though their AWS configurations had a vulnerability, Capital One knew how to handle the situation.

The key to an incident response plan is testing it in tabletop exercises, employee training, and other scenarios to determine if it will actually work. When organizations go through information security audits, their auditor will have high standards for the plan and the testing of the plan. What would’ve happened if Capital One wasn’t prepared to react to this incident? Would data have been used for fraud or compromised even further?

6 Steps to Incident Response

With today’s threat landscape, it’s not a matter of if your organization will fall victim to a cyberattack or data breach, but when it will happen. We believe basic incident response plans should have six steps:

  1. Preparation – What are we doing to prevent an incident? How are we limiting the impact of an incident? Have we tested our policies and procedures?
  2. Detection & Identification – How would we identify and detect malicious activity? How do we report an incident?
  3. Containment – Has the appropriate personnel been notified? What evidence should be collected? Have we fully assessed the scope of the damage? How can we prevent further damage?
  4. Remediation – Has a complete forensic analysis been performed? Can we make changes to prevent a repeat incident?
  5. Recovery – Have we securely restored the system? Do we have continuous monitoring to ensure the problem is resolved?
  6. Lessons Learned –What gaps can we now identify? Have we regained customer confidence? Have we reviewed controls and processes to prevent future attacks?

It’s not only up to IT to develop an incident response plan – many other areas of your organization will be involved, especially C-levels and boards of directors. In Capital One’s case, the CEO responded the public about the breach.

If your organization was breached, would your team know what to do? What would the headlines say about your incident response plan? Are you confident in your plan?

If you want to ensure that everyone at your organization knows their role in incident response, let’s talk today about how to train and test your incident response plan.

More Incident Response Resources

SOC 2 Academy: Incident Response Best Practices

Horror Stories: Timehop’s MFA Mishap

Breach Notification: Who, When, Why

When Disaster Strikes, Will You be Prepared?

To ensure that operations remain up and running during hurricane, tornado, or rainy seasons, businesses must have a Disaster Recovery Plan that has been developed, tested, and is in place and known to all relevant parties. Hurricanes like Matthew and Sandy have devastated businesses over the last couple of years, and without a well-developed Disaster Recovery Plan, many businesses were left inoperable, damaging their revenue and reputation.

What is a Disaster Recovery Plan?

So, what is a Disaster Recovery Plan (DRP)? Disaster Recovery Plans define an organization’s processes for protecting and recovering its business in the event of a disaster, such as a hurricane, flood, tornado, power outage, etc. These documented sets of policies and procedures can be the lifeline of an organization following a disaster, and determine loss of operations, reputation, and revenue. How will your organization stay running in the event of a disaster? Where will employees continue to carry out their work duties? How will incident response be communicated throughout your organization? These are the types of questions you should ask yourself when preparing for a potential disaster.

3 Steps for an Effective Disaster Recovery Plan

When it comes time to develop your Disaster Recovery Plan, there are three main steps to be considered, including:

  • Business Impact Analysis: The first thing your organization should do when preparing your DRP is to conduct a Business Impact Analysis. This process will allow you to review existing business continuity capabilities by evaluating the risk to business process failures, identify critical and necessary business functions and their resource dependencies, estimate any financial and operational impacts of disruption and the required recovery timeframe for critical business functions, and to assess the effectiveness of any existing risk reduction measures.
  • Strategy Selection: Once you’ve identified and prioritized critical functions for business continuity, the next step in the process is to determine which recovery strategy to move forward with. Identify a range of specific recovery strategies that address interruptions of business processes, identify the computing resources that are required to recover the various distributed processing environments, and document alternative recovery strategies.
  • Disaster Recovery Plan Documentation: It’s time to create your physical plan for responding to a potential disaster. This plan should include the following:
  1. Emergency notification and disaster declaration procedures
  2. Recovery team procedures
  3. Facility and business restoration procedures
  4. DRP testing and maintenance cycles
  5. Appendices for master contact lists, equipment inventories, connectivity schematics, etc.

Once you’ve developed, tested, and disseminated your Disaster Recovery Plan, you can rest assured that you’ll be prepared if disaster strikes. For additional help on disaster recovery planning or for help with determining the effectiveness of your current Disaster Recovery Plan, contact us today.

More Disaster Recovery Resources

Business Continuity and Disaster Recovery Planning Checklist

Cloud Security: Business Continuity and Disaster Recovery Planning Checklist

What is Threat and Vulnerability?

With the holiday season always comes a rise in cyber crime and data theft. With that in mind, it’s a perfect time to remind ourselves of important information security tips to keep us safe and secure this holiday. So don’t let the Grinch ruin your holiday. Here are 5 things the Grinch can teach us about information security:

1. Beware of Social Engineering

“With this coat and this hat I look just like St. Nick!” These infamous words led the Grinch straight through Whoville, sneaking into homes, successfully impersonating someone they trusted, and stealing Christmas. This popular form of hacking, known as social engineering, can be avoided by training your employees to never give out sensitive information (e.g., username and password combinations or unauthorized access to an area) without fully identifying the other person.

2. Ensure Network Security

Don’t let the Grinch slide down your chimney unannounced. Ensure Network Security by implementing and maintaining a firewall configuration. As auditors, a common gap we see when performing audits is a poorly maintained firewall. Maintaining a secure firewall is important in order to monitor incoming and outgoing packet requests and blocking unauthorized requests. Ensure network security by having effective and fully documented policies and procedures.

3. Secure your Last Line of Defense

Train the little Cindy Lou Who’s to recognize security incidents when they happen. Regularly training your employees on security awareness and policies and procedures is a critical component of your organization’s security. You’re only as strong as your weakest link, so continually train employees on logical and physical security responsibilities to ensure your employees will know how to respond in the event of a security incident.

4. Perform Annual Risk Assessments

Don’t let the Grinch rob you blind – Protect your assets from theft and breach. The first step in safeguarding your business from theft or a data breach is by performing an annual risk assessment. Risk assessments are a way to identify assets and prioritize risks to those assets, allowing organizations to ensure the proper controls are put in place to protect those assets from vulnerabilities and threats.

5. Test your Incident Response Plan

The Whos didn’t let the Grinch ruin their holiday. They were prepared to move forward in light of a security incident. Have a plan in place that you have tested and train employees on your incident response plan policies and procedures. Your Incident Response Plan should include policies and procedures that dictate to your organization the immediate actions that are to be taken following the detection of an incident.

Stay safe over the holidays, and don’t forget these 5 important tips to ensure the Grinch doesn’t ruin your holiday.