Blog

Informative, up-to-date and exciting – the Oneconsult Cybersecurity Blog.

The 360 Degree Checklist to Manage Cyber Incidents
Nadia Meichtry
Nadia Meichtry
|
16.08.2023
(updated on: 09.09.2024)

Preparation with a comprehensive checklist is central to managing a cyber incident. To ensure that nothing is forgotten during the stressful situation, all departments of a company must be informed about their tasks and duties in advance.

Contrary to what many believe, a cyber attack is not just a problem for the IT department. It affects and requires collaboration from many different areas of a company, including but not restricted to the management, communications, and the legal department.

The goal of this 360-degree checklist is to provide an overview of what needs to be considered during a cyber attack and the responsibilities and tasks of all individuals involved. It is based on the six phases of the SANS Institute’s Incident Response (IR) process: preparation, identification, containment, eradication, recovery, and learned lessons.

The six phases of the incident response process.

The Oneconsult International Computer Security Incident Response Team (OCINT-CSIRT) uses the checklist in collaboration with IT departments during incidents. The checklist includes not only technical but also organizational tasks and provides a foundation. However, in order for it to be suitable for your own company, it needs to be adapted. The tasks are listed in a rough order. This is because the incident response process is a cycle with many feedback loops, which is why it is not possible to list the various tasks in a linear fashion.

The 360 Degree Checklist

Phase 1: Preparation

The first phase of the incident response process consists of defining and implementing technical and organizational processes and measures for the event of a cyber incident. The aim is to prevent an attack from happening in the first place and to be able to recover as quickly as possible if an attack does occur.

Technical

On a technical level, it is necessary to create a network plan and an inventory of assets, as well as to prioritize them. Such an inventory can be very useful for both forensic analysis and reconstruction. To be best protected and have a good overview, a protection solution (e.g., antivirus, Endpoint Detection and Response (EDR)) should be deployed, and regular vulnerability scans should be performed. The Active Directory should also be checked on an ongoing basis. The free tool “PingCastle” is recommended for this purpose. It should also be ensured that all necessary tools and resources are available. In addition, it is recommended to implement a patch/vulnerability management. A backup concept is also recommended to determine which data should be backed up where, how and how often.

Organizational

At the organizational level, it is necessary to start by defining a contact list and communication channels and tools. For the event of a crisis, it should also be defined who (employees, management, customers, suppliers, authorities, the public, etc.) must be informed when (daily, weekly, in the event of an incident, etc.) and in what form (verbally, in writing, by email, etc.). This can for example be written down in a communication plan. It is also highly recommended to create an incident response plan. In this plan, roles and responsibilities are defined and it is also determined how to respond depending on the criticality of the security event (incident vs. crisis). If you need such an incident response plan, we are happy to create it for you. In addition, a strategy in case of extortion (e.g., ransomware after encryption, threat of data disclosure) can be developed in advance. It should also be ensured that the necessary contacts are available in case of need (IR/forensics partner, etc.) and that these are contractually regulated if necessary. Possible obligations to notify (e.g., DSGVO) and inform (insurance, customers, suppliers, etc.) should also already be known.

first phase of the incident response process: preparation

Phase 2: Identification

Technical

As of this phase, the company is a victim of a cyber attack. The goal of this phase is to identify the incident and obtain as much information as possible to determine the extent and impact. The current state of the crisis and all information already available should be discussed with all parties involved during status meetings. The objectives for the day, priorities and strategies, and the distribution of tasks should be determined during these meetings. Worst and best case scenarios can also be defined in order to derive measures from them.

Organizational

In terms of organization, physical and personnel resources should also be available. Therefore, the availability of people and the provision of a room, equipment and catering should be clarified.

second phase of the incident response process: Identification

Phase 3: Containment

In the containment phase, the goal is to prevent the attacker from moving through the network and thus minimize the damage. Therefore, at this stage it should be clear which systems are already infected. The affected systems should immediately be isolated, i.e., pulled from the network, and the data (logs, etc.) backed up for analysis. It is important to protect the clean systems as well, especially the backups. In addition, connections to and from external partners or sites should be disconnected. Any Indicators of Compromise (IOCs) already found by the forensic analysis, such as IP addresses and domains, should also be blocked, and compromised accounts should be deactivated. Emergency operations can be set up so that employees can continue to work, albeit on a reduced basis.

third phase of the incident response process: containment

Phase 4: Eradication

During the eradication phase, the attacker is removed from the network and everything they have done is cleaned up. In some cases, it is an option to change the password to lock out the attacker. Resetting all passwords (including admin, services and Kerberos) is recommended especially in incidents like ransomware, where the Active Directory has been compromised. The legitimacy of user accounts also needs to be verified, as attackers can also create new accounts. A recovery strategy is implemented within a clean and isolated environment which was prepared for this purpose. In addition, backups should be checked for infections. The externally accessible services that were previously shut down are patched and put back into operation.

fourth phase of the incident response process: elimination

Phase 5: Recovery

At this point, the goal is to return to normal operations with as little damage as possible. Here, the systems and data are restored from the backups if these are clean, otherwise they are rebuilt. The network will also be restored. It is therefore important to increase security during this phase, which can be done by hardening systems and Group Policy Objects (GPOs), creating log policies and managing the firewall. The new environment should also be heavily monitored in case a remnant has lingered so that immediate action can be taken.

fifth phase of the incident response process: recovery

Phase 6: Learned Lessons

After the case is closed, it is important to prepare a report documenting, among other things, the results of the analysis and the measures taken. This is then distributed to the necessary people (management, etc.). Afterwards, a debriefing should take place with all parties involved to draw the lessons from the incident. It should be discussed what went well and what could have gone better, what further measures should be taken and where processes need to be adjusted and improved. Minutes of the meeting should also be taken and deadlines should be set for the implementation of the measures.

Sixth phase of the incident response process: findings

Structure of the 360 Degree Checklist

The checklist is presented in the form of a RACI matrix :

  • R: Responsible – Who (which person, role, organizational department) performs the task?
  • A: Accountable – Who decides and has overall responsibility or will report to performing the task correctly?
  • C: Consulted – Who can advise and support with expertise?
  • I: Informed – Who must be informed, who can request information?

The checklist includes the following five topics:

  • Technical: relevant for the technical departments (e.g., IT)
  • Organization: taskforce
  • Personnel: mainly HR
  • Legal topics: lawyers, attorneys
  • Experts/external parties: IT partners, IR/forensics partners (e.g., Oneconsult)

The table is read in the following way, e.g. for the first row (network plan):

  • – The IT department (technical) creates a network plan during the preparation phase to achieve an overview.
  • – The network plan is made available to the task force (organization) and the experts/external parties during the assignment.

Conclusion

In order to be optimally prepared for a cyber incident and to ensure that nothing is forgotten in an emergency, the creation of such a checklist is highly recommended. Therefore, we are happy to provide you with the Oneconsult 360 Degree Checklist for dealing with a cyber incident:

Download 360 Degree List Overview PDF

Download 360 Degree List Overview PDF

Download 360 degree list as Excel

Download 360 degree list as Excel

This checklist serves as a basis. It should be adapted to your own company. Our Incident Response Team will be happy to support you and clarify any questions.

Nadia Meichtry

Author

Nadia Meichtry studied Forensics in Lausanne, is certified in GCFA, GREM, GDAT and OPST, and has been working as a specialist in the Digital Forensics & Incident Response team at Oneconsult since 2020.

LinkedIn

Don’t miss anything! Subscribe to our free newsletter.

Your security is our top priority – our specialists provide you with professional support.

Availability Monday to Friday 8:00 a.m. – 6:00 p.m (exception: customers with SLA – please call the 24/7 IRR emergency number).

Private individuals please contact your trusted IT service provider or the local police station.

For more information about our DFIR services here:

QR_CSIRT_2022_EN@2x
Add CSIRT to contacts