- [Instructor] Once the incident response team
returns the organization to a normal operating state,
all too often the response effort ends without completing
an important final step, conducting a
lessons learned session and writing up the results
in an incident report.
The lessons learned process is designed to provide
everyone involved in the incident response effort
an opportunity to reflect on their individual role
in the incident and the team's response overall.
It's an opportunity to improve the processes
and technologies used in incident response
to better respond to future security crises.
The most common way to conduct lessons learned
is to gather everyone in the same room or connect them
via teleconference or video conference and ask
a trained facilitator to lead a lessons learned session.
Ideally this facilitator should have played no role
in the incident response, leaving him or her
with no preconceived notions about the response.
The facilitator should be a neutral party
who simply helps guide the conversation.
Time is of the essence with the lessons learned session
because as time passes, details quickly become fuzzy
and memories are lost.
The more quickly you conduct a lessons learned session,
the more likely it is that you will receive
valuable feedback that can help guide future responses.
NIST offers a series of questions to use
in the lessons learned process.
They include exactly what happened and at what times?
How well did staff and management perform
in dealing with the incident?
Were documented procedures followed?
Were those procedures adequate?
Were any steps or actions taken
that might have inhibited the recovery?
What would the staff and management do differently
the next time a similar incident occurs?
How could information sharing with other
organizations have been improved?
What corrective actions can prevent
similar incidents in the future?
What precursors or indicators should be watched for
in the future to detect similar incidents
and what additional tools or resources are needed
to detect, analyze and mitigate future incidents?
The responses to these questions, if given honestly,
will provide valuable insight into the state
of the organization's incident response program.
They can help provide a road map of future improvements
designed to bolster security.
The lessons learned facilitator should work with the
team leader to document the lessons learned in a report
that includes suggested process improvement actions.