Cybersecurity Risk Management

CHAPTER 4Developing a Continuity of Operations Plan

Overview of Chapter and Objective

This chapter will provide the reader with fundamental concepts and practical steps to respond to and recover from a cybersecurity incident. By the end of this chapter, the reader will grasp the concepts necessary to develop an incident response plan (IRP), maintaining communications within the response team and the broader organization throughout an incident. The chapter will introduce the reader to the basic concepts of how to contain and mitigate an incident. Finally, the chapter will introduce the reader to the basic principles and elements of developing a recovery plan and the importance of lessons learned in the aftermath of a cybersecurity incident.

Melinda just got home from an awards dinner and checked her e-mail for the first time that night. As CEO, Melinda always faced a full inbox no matter how many times she checked her messages. Mixed in with regular e-mails was a very odd one from an address unfamiliar to Melinda.

“We have hacked your computer systems. Prepare to suffer, fools!” was the subject line of the strange message.

Although she was afraid to open the e-mail, she did.

In the body of the e-mail, the sender wrote, “Your network is hacked! We have six terabytes of data.” Embedded in the e-mail and attached to it was proof that whoever sent the e-mail had internal code development files and so much more.

Melinda immediately called her general counsel John, who was napping ...