The typical cybersecurity incident response process is carried out in several stages, and mitigation activities are a significant part of that process, as they are meant to help eradicate an incident and prevent it from expanding. The Cybersecurity Framework, published by the National Institute of Standard and Technology (NIST) back in 2014, offers a separate section on mitigation as part of the broader incident response effort, advising companies on the immediate steps they are supposed to take following a cybersecurity event.
The NIST Framework section dedicated on mitigation includes the following steps: contain, reduce impact, eradicate, document. Going through all these steps can be time-consuming and can waste a significant amount of a company’s resources, which is why companies need to consider implementing a software solution that can help their cybersecurity teams save valuable time while performing these tasks. Incident response platforms with automation-and-orchestration capabilities are the ideal solution for every organization that wants to be able to mitigate cybersecurity incidents fast and effectively.
Automated Playbooks for Specific Types of Incidents
By using a cyber incident response platform, companies can take advantage of its numerous features relating to mitigation, such as automated playbooks, workflows, evidence tracking for forensic analysis, and reporting, to name a few.
These platforms provides a set of workflows that apply to all kinds of different scenarios involving various types of cybersecurity events, including malware attacks, phishing incidents, or data breaches. The workflows help a company’s cybersecurity team figure out exactly what action to take depending on the type of attack. For instance, if your company faces a phishing attack, a workflow will guide your CSIRT through the containment process, with actions like checking the source-code of the phishing website and spreading the URL of the attack on all accessible web browsers.
When it comes to reducing the impact of an incident - related to a malware attack, for example - you can use an incident response platform’s playbooks to figure out how to configure servers and email clients to block emails providing suspicious files, after having identified them, or to block malicious code, and how to identify and isolate the host that has been recognized as a source of the infection.
Eradicate and Document In Few Simple Steps
As far as eradication is concerned, it is also mostly associated with malware attacks, and an automated incident response platform can be very useful in this respect, too. It can help you identify all vulnerabilities and remove the malware fast from all affected hosts, while also allowing you to proceed to the final stage of the mitigation procedure - documentation of an incident. These types of platforms have the ability to preserve, secure and document digital evidence, to allow a proper forensic analysis that would help determine where the attack came from, how it was conducted, and how similar attacks can be prevented in the future.