- [Instructor] Communication is an essential part
of cybersecurity incident response efforts.
Incident response teams must notify
key stakeholders about the incident, provide updates,
and maintain a permanent record of the incident.
There are three important components to incident reporting.
The first is notification,
ensuring that everyone who needs to know about an incident
is aware that an incident response effort is underway.
The second is real-time updates,
ensuring that those who need to be familiar
with the response efforts are kept informed along the way.
And the third is documentation,
ensuring that there is a permanent record kept
of the incident details and the response effort.
Notification is a key responsibility of incident responders.
As early as possible in an incident,
responders should trigger notification of key personnel,
both inside the organization,
and, if necessary, external responders.
Every organization should have a specific list
of individuals to contact in the event of an incident.
This list may vary depending upon the incident type.
As an example, you might include the following roles
in an incident notification checklist:
the chief information officer
or other senior-most IT official,
the director of information security,
other information security
and incident response teams within the organization,
owners of the systems
and business processes affected by the incident,
public relations staff, and attorneys.
All of those individuals may choose to involve
other members of their teams, as appropriate.
Many organizations use an automated notification process
to trigger alerts to these individuals
when a response effort kicks off.
Using an automated system allows
the leader of the incident response team
to send a single message
without worrying about the recipient list.
The system can then track down individuals,
confirm that they acknowledge receipt of the message,
and contact back-up responders, as needed.
In some cases, you may also need to notify
external parties of an incident response effort.
Law enforcement agencies, government regulators,
and other officials may need to know about an incident,
depending upon the circumstances and your industry.
Your organization's incident notification procedures
should describe any external notification requirements
and outline the timeline
and process for those notifications.
For example, federal government agencies
are required to report all computer security incidents
to the United States Computer Emergency Readiness Team,
US-CERT.
US-CERT acts as a central coordination point
for cybersecurity incidents
that take place within the federal government.
Organizations outside the federal government
may be reporting requirements as well.
For example, a large multinational corporation
may have a centralized cybersecurity
incident response team similar to US-CERT
and a policy that that team be notified
of any cybersecurity incidents anywhere within the company.
Organizations may also choose to involve
one of the government-sponsored
Information Sharing and Analysis Centers, or ISACs,
to share intelligence information
with others in their industry.
The National Council of ISACs coordinates these groups
and maintains a website providing links
to the many industry-specific
cybersecurity coordination centers.
The second type of incident reporting
that teams should perform
are regular updates on the incident status.
These regular updates may use the same automated system
used for initial notifications
and should provide key stakeholders
with updates on the incident response progress.
Alternatively, these updates may take place
via in-person meetings, teleconference,
or other appropriate means.
Finally, an incident response team
should create a formal report
at the conclusion of each incident response.
This report should provide details
on the nature of the incident,
walk through the incident response timeline,
describe containment eradication and recovery efforts,
and summarize the lessons learned
during the response process
with possible recommendations for improvements.
Reporting and documentation play a crucial role
in the incident response process,
ensuring that key stakeholders are aware
of the incident and the response progress
and documenting the details
surrounding the incident for historical purposes.