Does your organization have an incident
response policy (IRP)? You may not think you need one. You’ve
locked down your organization’s network, and your disaster recovery
plan effectively details how to respond to a security incident–so
you feel relatively secure.

But even the most secure networks need an IRP.
Regardless of the severity of the incident, it’s essential that
your company has a policy in place that outlines steps to take
during potentially disastrous times.

Every organization should include an IRP as
part of its overall business continuity plan (BCP). Knowing how to
minimize security vulnerabilities and respond to security incidents
in a well-organized and thorough manner should be a critical
component of any company’s BCP.

A security incident is any adverse event or
threat that affects your organization’s information systems or
network. Incidents can include unauthorized access, malicious code
(such as viruses), network probes, and denial-of-service
attacks.

Get the TR Blog Roundup

Find out who’s offering the best advice, the quirkiest comments, and the most compelling life stories every week with TechRepublic’s Blog Roundup. Click here to automatically sign up to receive it every Wednesday.

Use tags to find blog posts about Windows and security.

An effective IRP should address eight key
areas. Let’s take a closer look.

Demonstrate management
support

First and foremost, your policy should clearly outline management’s
support of the policy. A member of senior management–or anyone
with the same authority to address the included provisions–should
sign the policy. These provisions might include any financial
resources, personnel, equipment, and training dedicated to
implementing the policy as well as internal consequences of
violation.

Decide
an organizational approach

There are two common methods of dealing with an incident: Contain,
clean, and deny, or monitor and record. The method your
organization chooses should depend on whether the goal is to seek
prosecution and/or compensation or to quickly restore services.

Determine outside notification
procedures

Allowing your network to participate in a distributed attack and
remaining silent is a legal landmine waiting to explode. In our
collaborative world, it’s important to determine procedures for
notifying third parties if you’re involved in a distributed event.
Decide whom you’ll inform as well as when and how.

Discuss
remote connections

Your policy must address remote connections. This should encompass
all remote employees or contractors, and it needs to outline your
rights to disconnect and remove access during a security
incident.

Define
partner agreements

Describe downstream and upstream agreements with your service
providers and customers that define your right to monitor and
disconnect the network as required.

Develop
an incident team

Identify by position (not name) the members of the team that will
enforce the policy, and describe their roles, responsibilities, and
functions. The team should encompass a variety of skills and areas
of expertise, including security, administrators, human resources,
and legal.

Design
an internal communications plan

Develop an internal communications plan that identifies who you
will notify and how you will contact them. In addition, decide on
the person who’s responsible for initiating this contact.

Demand a
follow-up report

Define a method for reporting and historically archiving the
incident. Use that information to tune your operations to prevent a
similar incident from reoccurring.

Every network is unique, and the type of
business your organization conducts on the Internet will influence
the level of your response to a security incident. As your network
changes, make sure you adjust your IRP accordingly and address
newly discovered vulnerabilities as they occur.

Final thoughts

If your organization has no established,
coherent plan of action, it can easily make the wrong decisions
both during and after a security incident. An IRP policy can’t
solve your problems, but it can offer a cool-headed method for
dealing with a hot issue.

For more in-depth information on incident
response, check out SANS’
Information Security Reading Room, which offers a wealth of
available information that can help you create a comprehensive
incident response policy.

Worried about security issues? Who isn’t? Automatically sign up for our free Security Solutions newsletter, delivered each Friday, and get hands-on advice for locking down your systems.