COVID-19 Cyber Crime & Fraud: Incident Response

1. Develop policy: To outline the authority and responsibilities of the IR team. This might include; the revocation of access rights, taking systems offline, reconfiguring them, purchasing equipment and services, accessing sensitive information and conducting forensic investigations. Ultimately, any delays will hinder recovery so outline responsibilities and the means to settle disputes well in advance.

2. Communication Plan: Who should the IR team contact in the event of a problem? When is contact appropriate and how should it be made? How will messages be communicated vertically and horizontally across the organisation or to external agencies? How will you be contacted by customers and suppliers? A good communication plan facilitates a realistic appraisal of the ongoing situation and avoids unhelpful speculation during difficult times.

3. Define critical functions: Which systems have the highest impact if compromised and how quickly should they be restored? What data would be the most damaging to lose and where is it located? Once you know what the

4. Define roles: Helps maximise efficiency. Who can lead the IR team, or facilitate purchases? Who will liaise with HR when there’s an insider threat or an internal breach of policy? Who has the expertise to deal with applicable laws, regulations and contracts, or the skill and diplomacy to communicate across the organisation and to external entities?

5. Rate the incident: To understand the gravity of the situation and elicit the appropriate response across the organisation.

6. IT hygiene: Network diagrams, build documentation, recovery procedures, up-to-date inventories and change control documents should be in order to efficiently sanitise, recover or rebuild infected system and operations.

7. Ensure network visibility: Logs must be collated, synthesised and evaluated to identify and track problems across the network. Check – Windows event and security logs, anti-virus and firewall logs, as well as rogue accounts on the network. Alternatively, consider holistic solutions such as SIEM technologies.

8. Business continuity: Failing to prepare is preparing to fail. Develop work arounds for when there is a complete or partial loss of IT services. How will critical operations continue in the face of such difficulties?

9. Train: The identification and resolution of a problem needs an organised response. The IR team need to react to different situations calmly and with confidence which is why it is so important to practice IR by exercising or simulation.

An organisation can deploy many preventive controls as planning and finance permits, however, attackers will still slip through the net. It is the ability to detect and respond that determines how badly the business is impacted and why incident response (IR) preparation is so important.

Further advice on incident response, from the NCSC, can be found here.