{"id":20465,"date":"2023-10-12T04:32:14","date_gmt":"2023-10-12T08:32:14","guid":{"rendered":"https:\/\/www.sage.com\/en-us\/blog\/?p=20465"},"modified":"2023-10-12T05:04:31","modified_gmt":"2023-10-12T09:04:31","slug":"how-to-respond-to-cyber-security-incidents","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-us\/blog\/how-to-respond-to-cyber-security-incidents\/","title":{"rendered":"How to respond to cyber security incidents\u00a0"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tTechnology & Innovation<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tHow to respond to cyber security incidents \t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\tPublished
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"ben-aung\"\t\t\t\tBen Aung<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

Preparing for a cyber incident <\/strong> <\/h2>\n\n\n\n

Although nobody likes planning for the worst, it really does help when it comes to cyber security. As cyber attacks are becoming more widespread and frequent, it is helpful to have a \u201cwhen\u201d, not \u201cif\u201d approach.  <\/p>\n\n\n\n

If you assume an incident will happen, you can focus on what to do to minimize the impact to your organization. In this blog, you will learn about what a cyber security incident is, how you can prepare for one and what to do if you are the victim of an attack.\u202f <\/p>\n\n\n\n

What is a cyber security incident? <\/strong> <\/h2>\n\n\n\n

A cyber security incident is when someone gains unauthorized access to your systems or data, usually over the internet. That\u2019s what people generally mean when they say that your systems have been \u201chacked\u201d.  <\/p>\n\n\n\n

An incident is a broad term and includes lots of different types <\/em>of incidents. A cyber security breach<\/em>, is any incident that results in the loss, publication, or lack of access to systems or data. This is often what happens when an organization is a victim of a ransomware attack. The incident becomes a breach when the data is encrypted and cannot be accessed and then also when or if it is stolen by the attacker. <\/p>\n\n\n\n

Being prepared and responding quickly is important as what you do in the minutes, hours, and days after an incident, can dictate how serious it ultimately is. There could be penalties to pay, or you may need to report any breach to the authorities<\/a>. <\/p>\n\n\n\n

The secret ingredient is to plan thoroughly<\/strong> <\/h2>\n\n\n\n

The most critical thing about managing anything unexpected is planning. Whether your organization is 10 people or 10,000, investing time into how to handle incidents will help you make better decisions under the pressure of a real scenario.  <\/p>\n\n\n\n

Creating an effective plan will also help you identify any gaps in your incident-handling capabilities, such as who to call for help or identifying who in the organization is authorized to make big decisions.  <\/p>\n\n\n\n

Here are 3 important things to consider when planning for an incident: <\/p>\n\n\n\n

1. Record everything you need to keep your business running<\/strong>  <\/h3>\n\n\n\n

This could be specific IT systems or services, databases, or people in certain roles. This can be done through a workshop with colleagues or even just running through a typical day and making a list of everything you would need to be operational. Once you have worked out what your minimum viable business is, you can look at those things and ask yourself \u201cwhat if I couldn\u2019t access this for some time, for example, 2 weeks? Do I have alternatives? How long can my business survive without it?\u201d and make plans on that basis. <\/p>\n\n\n\n

The main difference between a cyber security incident and other types of operational failure, is that a cyber security incident involves an attacker who may still be inside your systems when you are trying to respond and recover.  <\/p>\n\n\n\n

There are numerous examples of organizations who have restored data and services, only for an attacker to just encrypt them again because they still have access. Recovering systems to \u201cclean\u201d versions might not be straightforward and needs to be part of your planning. <\/p>\n\n\n\n

2. Create an emergency list<\/strong> <\/h3>\n\n\n\n

This should consist of critical roles, individuals, and supporting companies to help in important domains such as customer services, legal, communications and IT, or cyber security support.  <\/p>\n\n\n\n

Ask yourself, who would be the first person to contact in the event of a cyber security incident? Who else needs to be contacted after this to provide support? This could be employees, service providers, specialist technical or legal advice, or even regulators or law enforcement.  <\/p>\n\n\n\n

Remember, you might not have access to your systems so your most important contacts should be made available separately from your usual systems. Many organizations struggle to contact customers when incidents occur\u2014how would you do this? What would you say to them?  <\/p>\n\n\n\n

You also need to consider your legal obligations, such as data privacy regulations. In many parts of the world, regulators must be notified within a few days of an incident occurring.   <\/p>\n\n\n\n

If you don\u2019t have the right cyber security or legal skills within your organization then it\u2019s worth identifying external support in advance, so you have someone to call who can guide you through the situation. It is also important that any incident-management plan, is easily understandable by non-technical people. <\/p>\n\n\n\n

3. Plan for incident roles and responsibilities and be clear on the priorities<\/strong> <\/h3>\n\n\n\n

In the event of an incident, it is very common for emotions to take over and send people on a tangent. Clear roles are important to stay focused. This will tell you who will make decisions during an incident and in what areas.  <\/p>\n\n\n\n

This sounds simple but decisions you make during an incident are often under pressure and can have a big impact, so you need the right people making them at the right time. For example, how do you decide when and if customers need to be notified? Or whether to report an incident to the authorities? Having all of this written down and well communicated will reduce stress in the event of an attack.  <\/p>\n\n\n\n

Finally, it is always a good idea to bring people together and simulate a situation like this. This can be done as part of a tabletop exercise where you gather key people in your organization and work through these points together. You\u2019ll be surprised how many different ideas and points of view will be shared.  <\/p>\n\n\n\n

Many organizations create an \u201cincident playbook\u201d which can be as simple as a list of things they need to think about when an incident occurs.  <\/p>\n\n\n\n

Final thoughts<\/strong> <\/h2>\n\n\n\n

Understand what you have and what could be impacted in the event of a cyber incident. Creating your plan before anything happens and preparing your organization will pay off in the long run.  <\/p>\n\n\n\n

Most of all, the key factors in managing an incident are: Staying calm, knowing what to do, and communicating clearly and in a timely way with customers and stakeholders.  <\/p>\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to our Sage Advice Newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Get our latest business advice delivered directly to your inbox.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Working\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t