Confirmation and initial Assessment of a cybersecurity incident

This article provides a comprehensive guide on how companies can structure an incident notification process, implement strategies for timely decision-making, and prevent the spread of the incident. Additionally, it details how to handle post-incident activities and prepare a report that includes lessons learned. Finally, it identifies all roles involved in incident management to ensure a coordinated and effective response.

Incident Notification Process

This section presents a guide on how to establish an effective incident notification process, including detection, initiation of the notification, and appropriate communication channels to ensure incidents are managed efficiently and promptly.

Incident Detection:

All employees should be trained to recognize potential security incidents and immediately report any suspected incidents to the information security team.

Indicators for Detecting a Security Incident

Category	Indicator Name	Indicator Description
Technical	Unusual Network Activity	Unexpected increase in network traffic, connections to suspicious IPs, spikes in activity during non-working hours.
	IDS Alerts	Notifications of unauthorized access attempts, port scans, detected malicious traffic patterns.
	System Logs	Records of multiple failed login attempts, accesses from unusual geographic locations, unauthorized configuration changes.
	Anomalous User Behavior	Activities that do not match normal usage patterns, such as access to sensitive data by employees without privileges.
	Suspicious Files and Applications	Presence of unrecognized files, unauthorized modifications to existing files, or installation of applications without approval.
Physical	Unauthorized Access	Attempts to physically access restricted areas, such as server rooms or sensitive equipment.
	Unknown Devices	Detection of unrecognized devices connected to the network, such as USB drives, laptops, or mobile devices.
Corporate	Employee Behavior	Reports from employees about suspicious behaviors or devices operating unusually.
	Performance Issues	Unexplained slow system performance or unexpected outages of critical services.
	Data Disappearance	Loss or corruption of data without apparent explanation.
External	Security Provider Alerts	Notifications from security service providers about emerging threats that could affect the organization.
	News and Reports	Media reports or public security alerts about new vulnerabilities or attacks that might be related to the company.

Notification Initiation:

Provide a standardized initial notification form that includes details such as:

• Date and time of discovery.
• Description of the incident.
• Affected systems.
• Potentially compromised data.

Communication Channels

• Email: A dedicated email for security incidents.
• Phone: Emergency hotline for critical incidents.
• Incident Management System (ITSM): Use of an ITSM platform to log and manage incidents.

Initial Confirmation and Assessment

An Incident Response Team (IRT) should be responsible for evaluating the validity and severity of the reported incident. They must also ensure that all details of the incident are properly recorded.

Confirmation and Initial Assessment of the Incident

Confirmation and initial assessment of an incident are crucial steps to determine the veracity and severity of a potential threat. This process ensures that the organization's resources are used effectively and that appropriate measures are taken immediately.

1. Incident Confirmation

Incident Response Team (IRT):

• Report Reception: The IRT receives the incident notification through designated channels (email, phone, ITSM system).
• Initial Verification: The team reviews the information provided in the notification to verify its validity and relevance. This may include checking system logs, IDS alerts, and interviewing the person who reported the incident.
• Source Analysis: Determine if the report source is reliable and if the provided data is consistent with the nature of the incident.

2. Initial Security Incident Assessment

Incident Severity: Determine the level of threat posed by the incident. This includes assessing the potential impact on critical systems, the confidentiality, integrity, and availability of data. Below is a list of possible severity levels:

• Low: Minor incidents with limited impact, such as unsuccessful phishing attempts.
• Medium: Incidents with moderate impact that require attention, such as malware detected on a user's machine.
• High: Severe incidents with the potential to cause significant harm, such as a data breach or ransomware attack.

Incident Scope: Identify which systems, networks, data, and users are affected. This may involve: Reviewing access and network activity logs, Inspecting compromised devices, Evaluating the potential spread of the incident to other systems, etc.

Priority Setting: Based on the severity and scope of the incident, allocate the necessary resources to effectively manage the situation. Inform and coordinate with other relevant departments, such as IT, legal, and communications, to ensure a unified response.

An effective initial assessment allows the organization to make informed decisions quickly and minimize the incident's impact on operations.