Institute Resilience Through Detection, Response, and Recovery

Abstract

Cyber-resilience provides the ability to withstand and mitigate the impacts of information risks. Businesses can start to become more resilient by identifying their critical assets, top risk scenarios, and basic contingency plans. Then, by aligning technical security capabilities with IT operations and other business functions, security leaders can enable the business to detect suspicious or anomalous events earlier, and respond and recover faster from incidents such as breaches or system outages. Incident response (IR) is closely linked to security monitoring and detection. It should be managed by a dedicated group (or person) that coordinates closely with security operations, legal, HR, and other functions. Businesses should develop response plans for common types of incidents and for potential incidents from top risk scenarios. Enact response in a structured manner wherein each business function has a script for its part; for example, after a data breach, IT restores affected systems to normal operation, public relations communicates with the media, and the legal team notifies customers or partners of lost personal information. Businesses can lay the groundwork to enable recovery from serious incidents by performing business impact assessments that identify critical assets and developing business continuity plans to restore or recover the assets. Recovery plans may overlap response plans in the case of cyber-incidents, requiring that business continuity teams and IR teams coordinate. Strictly operational incidents such as hardware failures fall purely in the purview of the business continuity function.

Agile incident response (AIR): Improving the incident response process in healthcare

“…Typical IR frameworks are those proposed by NIST (Cichonski et al, 2012), CREST (Creasy, 2013), ISO (British Standards Institution, 2016) and Mitropoulos et al (2006), where each of these contains the following phases: preparation; detection and analysis; containment; eradication and recovery (which can constitute separate phases); and post incident review (or follow up). As such, while there are different IR models, which exhibit some minor differences, the archetypical IR Framework (Figure 1) entails that IR starts with the preparation phase, where the organisation considers the potential types, the impact, and the likelihood of breaches for their assets, and develops the relevant policies for each of these breaches (Blum, 2020). During detection and analysis, the organisation will assess the incident, and whether it constitutes an actual threat.…”

SOC Critical Path: A Defensive Kill Chain Model

“…Although this model is conceptually correct, the authors did not specify the different tactics or the mandatory steps to accomplish this goal. More specific academic works, such as [41], have used this conceptual model, but also without deepening its tactics. Although this is a valid high-level approach, it does not specify what a SOC has to execute to achieve it.…”

Modeling of Advanced Threat Actors: Characterization, Categorization and Detection

“…Although this model is conceptually correct, the authors did not specify the different tactics or the mandatory steps to accomplish this goal. More specific academic works, such as [75], have used this conceptual model, but also without deepening its tactics. Although this is a valid high-level approach, it does not specify what a SOC has to execute to achieve it.…”