97 Things Every Information Security Professional Should Know

Chapter 72. Incident Management

Quiessence Phillips

I’ve spent most of my career in incident response and the larger threat management discipline—forming, merging, and maturing programs. Threat management can be considered the hub of the cybersecurity organization, because whether you’re preparing for, understanding, or responding to threats, the vantage point of the group allows for it to inform and be informed by all other areas of cybersecurity. As we all know, threats will always exist, but how we manage them is crucial to effectively de-risking the business. The standards for an incident response capability are widely known—see the NIST Computer Security Incident Handling Guide; however, the way in which these standards are developed, executed, and evolved vary by organization. Incident response is a discipline that is largely qualifiable and not always quantifiable. Using the known phases of incident response—preparation, detection, analysis, containment, eradication, recovery, and post-incident activity—incident responders should ask themselves, can I quantify the end of each phase?

When you are waist deep in an incident response engagement, the last thing you want to hear is, “When will this incident be contained?” But the question is inevitable, as a host of parties (communications/media relations, general counsel, human resources, impacted business executives, etc.) ...