A guide to incident response

Types of security incidents

The National Institute of Standards and Technology describes eight types of security incidents potentially necessitating a security incident response:

1. Unauthorized access attempts: Perpetrators or groups attempt to breach an organization's systems or data by using various methods such as hacking, brute force attacks, or social engineering.
   Example: A hacker tries multiple password combinations to gain unauthorized entry into a company's database.
2. Privilege escalation: Attackers take advantage of system vulnerabilities or stolen credentials to elevate their access rights.
   Example: Exploiting a software bug to gain administrator-level privileges on a network.
3. Insider threat: Current or former insiders misuse their authorized access to the organization's systems for malicious purposes, such as stealing sensitive data or disrupting operations.
   Example: An employee with access to critical systems intentionally leaks sensitive customer information.
4. Phishing: Deceptive emails or messages trick recipients into disclosing confidential information or downloading malware.
   Example: Employees receive fake emails disguised as official communication, leading them to unknowingly reveal login credentials.
5. Malware intrusion: Viruses or Trojan horses infiltrate systems, allowing malicious activities like data theft or encryption of files for ransom.
   Example: Opening an email attachment that contains a virus, leading to the encryption of company files.
6. Denial-of-service (DoS): A system or network is flooded with excessive traffic to disrupt legitimate users' access to resources or services.
   Example: Overloading a website with a flood of automated requests, making it inaccessible to legitimate users.
7. Man-in-the-middle (MitM): Attackers intercept and alter communications between two parties to steal data or inject malicious content.
   Example: Intercepting unencrypted Wi-Fi signals to eavesdrop on data transmissions between a user and a website.
8. Advanced persistent threat (APT): Bad actors conduct coordinated and stealthy attacks with long-term objectives to persistently breach systems, steal data, or maintain unauthorized access.
   Example: Infiltrating a company's network with custom malware to continuously extract sensitive information over an extended period.

Incident response lifecycle

The incident response lifecycle is a vital framework for incident management. While each incident is unique, they are all learning opportunities for better handling future occurrences.

Companies should create an incident response playbook during the preparation phase and ensure key team members are familiar. Atlassian’s incident response best practices provide tips and best-in-class incident response processes. 

The lifecycle comprises six sequential phases:

1. Preparation: Creating the plan
2. Identification: Spotting and confirming the incident
3. Containment: Limiting the problem
4. Eradication: Removing the threat
5. Recovery: Fixing affected systems
6. Lessons learned: Documenting insights

Preparation

Preparation is the core of an incident response plan and determines a company’s responsiveness to an attack. A well-documented pre-incident process facilitates smooth navigation through intense, high-stress scenarios.

Any company will be more resilient with a robust incident response process based on the Atlassian Incident Handbook.

Identification

This phase involves detecting and verifying incidents through error messages, log files, and monitoring tools. Incidents might be identified through social media or customer support tickets, requiring the response team to manually record the incident in an incident-tracking tool.

Tools like Jira Service Management centralize all alerts and incoming signals from your monitoring, service desk, and logging applications, making it easy to categorize and prioritize issues.

Containment

Once you detect an incident, containment helps prevent further damage. During containment, the response team aims to minimize the scope and effects of an incident.

Eradication

Following containment, the primary focus shifts to removing threats from the company’s network or system. This phase involves a meticulous cleansing of all systems, removing any lingering malicious content to minimize the risk of potential reinfection.

Companies start restoring normal operations by conducting a comprehensive investigation and successfully eliminating threats.

Recovery

After eradicating the threats, the team focuses on restoring the affected systems to their pre-incident state. Data recovery and system restoration are vital for minimizing further losses and ensuring smooth operations.

Lessons learned

Incident debriefings are crucial to refining incident response strategies. The team reviews documentation, evaluates performance, and implements change to enhance incident handling efficiency. Every incident is a learning opportunity for the incident response team.

Tools for effective incident response

Teams need specialized tools, such as security information & event management (SIEM) systems, intrusion detection systems (IDS), forensic tools, and communication platforms, for streamlined incident response processes. 

Tools like Jira Service Management play a critical role in reducing resolution time and negative impacts. They automatically limit noise and surface the most crucial issues to the right team using powerful routing rules and multiple communication channels. 

Efficient incident response with Jira Service Management

Jira Service Management simplifies incident response. It bridges the gap between development and operations, enhancing team collaboration, breaking down organizational silos, increasing visibility, and ensuring prompt issue resolution.

Jira Service Management, integrated with Jira Software, provides industry-leading ITSM software tailored to help IT support, operations, and business teams deliver exceptional service experiences to employees and customers. Jira Service Management’s automation templates automate repetitive tasks, helping scale IT service management.

Learn more about incident management in Jira Service Management.

Why is incident response important?

A well-structured incident response plan minimizes incident impacts, enabling businesses to act swiftly and efficiently against threats. It reduces recovery time, financial loss, and reputational damage.

Who should be on an incident response team?

The incident response team should be diverse and include various roles and responsibilities. The team should include the incident commander, technical leads, communications managers, customer support leads, subject matter experts, social media leads, and problem managers. Executives and leaders across multiple domains within the company should coordinate the team.

What are some challenges of incident response?

Incident response teams often face an array of challenges, from resource constraints to issues with context, prioritization, communication, collaboration, stakeholder visibility, and the occasional human error. Preparedness is crucial to anticipate and tackle these challenges effectively. For example, involving the legal team in the preparation stage can mitigate potential legal or regulatory hurdles.