What is your input to the following?

A computer security incident response team (CSIRT) has become essential to deal with the growing number and increasing sophistication of cyber threats. Unlike a security operations center (SOC) a dedicated group with the tools to defend networks, servers, and other IT infrastructurea CSIRT is a cross-functional team that bands together to respond to security incidents. Some members may be full-time, while others are only called in as needed.

Creating an effective incident response team involves different processes and talent compared to establishing a SOC. In this blog, we will review ten effective best practices, leveraging the latest techniques and technologies.

Build a friendly team:

Part of building an effective CSIRT is educating your entire organization about its critical, cross-functional nature. Every team member needs to understand the value of complementary skills and roles. This helps eliminate friction between, for example, technical members in the SOC and nontechnical CSIRT members.

Recruit an effective advocate or executive sponsor:

This should be a staff member at the level of a CISO or executive staff member who can effectively communicate the impact of an incident to other executives, as well as to board members. This person is also responsible for ensuring that the incident response team receives appropriate attention, a workable budget, and retains the authority to act swiftly during a crisis.

Define key roles and recruit from across the organization:

The cross-functional team members should include:

An Incident Manager who can work across the organization, call meetings, and hold team members accountable for their action items. This person rolls up findings before communicating incidents to the company.

A Lead Investigator, such as a security analyst or dedicated SOC incident responder who takes charge of investigating a security incident.

A Communication and Public Relations specialist who handles everything from fielding press enquiries to communicating to employees and monitoring social media.

A Lead Legal/Privacy expert such as your general council or a deputy legal team member, who advises on issues. An example is the need to disclose a breach or deal with potential legal impacts of a security incident.

Create a deep bench based on realistic IT budgets:

Since security incidents can occur at any time, you will need to have CSIRT staff geographically dispersed to ensure someone will be available 24/7. If you can't "follow the sun," then the next-best option is to implement shifts comprised of those who are trained and qualified to lead an incident. You should also have redundancy through cross-training for each CSIRT member and their role.

However, few IT organizations have the budget to staff to this ideal level. So, as part of this best practice, plan for real-world staffing limitations before an incident occurs. Job shadowing and cross-training also help.

Insulate team members from distractions:

Security incidents can be intense; the effort required for breach response could take years. CSIRT members may experience burnout from responding to an ongoing deluge of audits, legal needs, HR requests, various daily fires to put out, and so on. So, while your incident response team needs to be "friendly," they should also practice distraction avoidance. This requires isolation from unplanned external requests as well as establishing a process for work intake.

Using these capabilities gives your CSIRT repeatability. It enables you to define a preapproved set of actions or playbooks to deal with an attack or other incident. And since CSIRT actions are cross-functional, they should include all aspects of negative event responsefrom locking down an impacted system, to inbox cleanup, and rapid communication to impacted stakeholders. This makes the response much friendlieror eliminating the "scary" aspect of automated responses.

Answer rating: 100% (QA)

The input provided outlines key best practices for building and maintaining an effective Computer Se... View the full answer