Security.com

incident response team

By Wesley Chai

What is an incident response team?

An incident response team is a group of IT professionals in charge of preparing for and reacting to any type of organizational emergency. Responsibilities of an incident response team include developing a proactive incident response plan, testing for and resolving system vulnerabilities, maintaining strong security best practices and providing support for all incident handling measures. Incident response team members typically cover various technical skills, backgrounds and roles to be prepared for a wide range of unforeseen security incidents.

In incident response, types of emergencies are usually categorized in two ways:

1. Public incidents. These incidents affect an entire community. This could include natural disasters, terrorist attacks and widespread epidemics.
2. Corporate/organizational incidents. These incidents are typically organization-specific and happen on a smaller scale. This could include data breaches, cybersecurity attacks and physical location threats.

Incident response teams are trained to be prepared for both types.

Examples of incident response teams

Incident response teams are common in government organizations and businesses with valuable intellectual property. A few examples of the forms an incident response team could take are as follows.

Computer Security Incident Response Team (CSIRT). This is a team of professionals responsible for preventing and responding to security incidents. A CSIRT may also handle aspects of incident response in other departments, such as dealing with legal issues or communicating with the press.

Computer Emergency Response Team (CERT). This is a team of professionals in charge of handling cyberthreats and vulnerabilities within an organization. In addition, CERTs tend to release their findings to the public to help others strengthen their security infrastructure.

Security Operations Center (SOC). This is a type of command center facility that is dedicated to monitoring, analyzing and protecting an organization from cyber attacks. A SOC typically includes threat hunters and analysts that focus only on system security incident response.

Incident response team functions and responsibilities

As companies will have different individual risk profiles and business processes to be mindful of, specific skillsets within the incident response team may vary. Generally speaking, the core functions of an incident response team include leadership, investigation, communications, documentation and legal representation.

• Leadership. Coordinates the overall direction and strategy of response activities and ensures the team stays focused on minimizing damage, recovering quickly and operating efficiently.
• Investigation. Coordinates efforts to determine an incident's root cause. It's important to gather as much relevant information as possible. Specifically, information that can provide value to correct the acute issue as well as prevent future issues.
• Communications. Manages relevant internal and external communications necessary for the incident response. Communications may be required across an organization's teams and departments, or with external stakeholders.
• Documentation. Keeps records of incident response measures and activities.
• Legal representation. Ensures that the incident response activities taken line up with laws and regulations to protect the organization.

Incident response team location

Locations of incident response teams can vary. Unless a company has a single location, it may not be feasible to keep a full incident response team at each location. Therefore, it's likely that incident response teams will not be based out of one physical location. Even if a full team cannot be staffed at each location, companies should aim to keep a trusted representative for each incident response function at each office. This is because the nature of many technical incidents may demand an in-person investigation and analysis; therefore, access to company equipment and assets is often needed.

Choosing incident response team members

Incident response team members will include a mix of technical staff, cross-functional team members and, potentially, external contractors. When choosing specific team members, organizations should look to include:

• Technical team. IT, security team members and other employees with technical expertise across company systems. The technical team will be the core of the overall incident response team, and should include security analysts and threat intelligence
• Executive sponsor. A senior executive should be present to provide oversight for information security and business risk management.
• Incident responders. Responsible for keeping track of incident response timelines and following up with ongoing management of incidents. May be charged with assessing the scope and urgency of incidents, reporting on trends, educating employees and internal stakeholders, and potentially liaising with law enforcement.
• Communications coordinators. Responsible for managing internal communications relating to incident response efforts, as well as public relations representatives to manage relationships with media outlets, affiliated business entities and external stakeholders.
• Forensic analyst. An expert in forensics. May be an in-house employee or an outside advising contractor.
• External consultant. A third-party expert in incident response, information security or technical systems that can advise on cases.
• Legal representatives. May be an in-house corporate attorney or an outside law firm hired to represent the company if legal action is necessary.