What is Cyber Incident Response?

Incident response defines an organized approach to what actions should be taken during and after a security breach.

The aim of incident response is to minimize potential damage and reduce the time and cost required to return to normal conditions. Which steps should be followed when a possible incident occurs in order to provide these conditions in the incident response plan.

Considerations in Cyber Incident Response

When responding to a cyber incident, paying attention to the five critical topics listed below will ensure that the incident is overcome with minimal damage.

1- An Experienced and Knowledgeable Cyber Incident Response Team

The most basic condition for responding quickly and effectively to cyber attacks is that the team that will respond to the cyber attack should have prior successful experience. This team may consist of cyber security experts within the company or external experts who have intervened in cyber incidents across different organizations, possess extensive knowledge of attacker behavior, and can take rapid and accurate steps to respond.

When you are exposed to  a cyber attack, the most important asset is having a skilled and experienced incident response team. Having both internal experts and experienced external experts on the team significantly increases the possibility of successfully responding to the incident.

The team of internal experts who have a deep understanding of the cyber-attacked system and infrastructure, including the position of components, processes and flowcombined with the expertise of external experts who have successfully responded to similar attacks and are familiar with the tactics and techniques of attackers can respond to cyber incidents faster, more accurately and successfully. It is worth emphasizing again that if you have only one chance to act, doing it with the right team is the smartest approach.

2- Proven Toolkit

No matter how perfect a team you create, if the tools used during cyber incident response are insufficient, you cannot expect a successful outcome. Based on our experience, we can say that many organizations or companies have made very serious cyber security investments but have been insensitive about the toolkits to be used in cyber incident response and almost no investment has been made in this area.

In a world where the cyber security paradigm has shifted from protection to detection, organizations/companies should quickly review their investment plans to align with this paradigm. The necessary toolkits should consist of tools that provide full visibility at the endpoint and on the network that can be quickly searched by incident response teamsthat are fed with external cyber threat intelligence information and that are capable of meeting the team's requests during the response phase.

Having a suitable toolkit is crucial in cyber incident response to ensure efficiency and success. ADEO uses a proven toolkit that allows for the monitoring and searching of tens of thousands of computers before responding to an incident. Without a proper toolkit, the incident response may be unsuccessful from the outset.

3- Threat Intelligence Feeds

Another important topic that can ensure the success of your cyber incident response is the sources of cyber threat intelligence that can be used in these tool sets. From experience, it is known that threat intelligence feeds, known as TTPs, which address the tactics, techniques, and procedures of attackers rather than just IP or hash-based intelligence, play a critical role here.

At this point, it should be emphasized that YARA rules are used very effectively and the more extensive and advanced YARA rules you have, the greater the likelihood of success. Similarly, our software that provides endpoint visibility in cyber incident response is supported by robust cyber threat intelligence. These two sources enable us to provide fast and accurate cyber incident response.

We would like to emphasize that not having appropriate YARA rules and cyber threat intelligence feeds for cyber incident response can result in an unnecessarily prolonged response process and the records provided to you for creating visibility may become overcrowded and cluttered over time.

4- Team Leader

One of the most important things during a cyber attack and its response is having an experienced team leader who has dealt with many cyber incidents. The team leader is responsible for deciding on the best course of action, designing and implementing infrastructure to provide visibility without affecting the system's operations, determining how to respond in case the attackers infiltrate the system again during the incident response, making critical decisions, controlling the team's functioning, changing tactics when necessary and most importantly, having the experience of doing all of these many times beforewhich is crucial for the success of the cyber incident response.

Most of the time, cyber incident response brings a chaotic environment. You will have to explain the situation to senior executives of the company or organization, related individuals from other business units, your customers and companies that have suffered service interruptions, the people assigned by the cyber insurance company you have purchased and many other related/unrelated people and involve some of them in the process. The most important thing you need at this stage is an experienced team leader to manage all the processes.

As ADEO, one of the critical roles we undertake in cyber incident response is team leadership. The institutions and companies we work with in this regard benefit significantly from the mentored service we provide, both in terms of the processes we operate during the incident response and in terms of addressing the deficiencies we have identified within the institution or company during the incident response. Remember that failure to manage the incident response process can cause damage to your organization, at least as much as the damage caused by the cyber attack.

5- Previously Successful ResponsePlan

One of the most critical stages in ensuring the success of a cyber incident response is the timely and fast removal of the identified attackers and their tools from the system. If this process is executed too early, it may result in the inability to determine which systems were affected by the cyber attack and may result in the attackers not being completely removed from the systems. 

We know that those who claim to perform incident response by simply blocking the first attacker IP they detect in order to act quickly, will have to perform incident response on many more systems later. Therefore, taking the right action at the right time is extremely important for the success of cyber incident response. 

Remember that if attackers realize that you are blocking them or that the tools and addresses they use are exposed, they may adapt by activating new tactics and tools, destroying the traces they have left, or even causing more damage to the system. This can create a vicious circle where the intervention is not fully successful.

ADEO Cyber Security Incident Response Service Phases

The Cyber Security Incident Response Service offered by ADEO consists of two phases: The Response and Monitoring phase, which includes the detection of traces of a possible cyber attack and determining whether this attack is still ongoing, as well as identifying which systems, applications, and users are affected by the attack.

The second phase consists of the Blocking and Cleaning phase, which includes removing the attack traces obtained in the previous phase from the systems, sharing IoCs related to malicious codes, backdoors, and command and control servers used by attackers and performing blocking operations both through the EDR platform used and other security technologies used in the environment.

Many organizations and companies experience serious problems due to their inability to respond correctly to the cyber attacks they face and fail to remove the attackers from the system. Especially in large infrastructures with thousands of clients and servers and hundreds of applications running on these systems, the main reasons for this failure are the absence of guaranteed successful steps in the cyber attack response plan, not using the right monitoring and response platforms and technologies and the failure to examine and respond to all system components to fully determine the scope of the cyber incident.