Download: Definitive ‘IR Management and Reporting’ Presentation Template

The realistic approach to security is that incidents occur.
While ideally, the CISO would want to prevent all of them, in
practice, some will succeed to a certain degree—making the ability
to efficiently manage an incident response process a mandatory
skill for any CISO.

Moreover, apart from the management of the actual response
process, the CISO must also be able to efficiently communicate the
ongoing activities and status to the executive level.

While the IR process is mostly technical, reporting to the
organization’s management should take place on a much higher level
in order for the non-security -savvy executives to understand.

To assist CISOs with these tasks, Cynet created the IR
Management and Reporting PowerPoint template (download
here^[1]), which apart from
providing an actionable response framework, is also clear and
intuitive for the executive level.

Let’s drill down on the two aspects of the template:

IR Management

The template was built on the SANS\NIST framework that includes the
following stages:

• Identification — This stage includes all activities
  that relate to the initial discovery of malicious presence and
  activity. It covers a wide range of potential scenarios – discovery
  carried out by the internal security team or by an external entity,
  was it in the context of the standard security protocols or a mere
  coincidence. This stage also includes an initial risk estimation
  for onward steps.

Containment — Following the initial identification,
there is a critical need for immediate action to confront and
mitigate the discovered threat—before any further investigation of
root cause and scope. Once this mitigation is carried out, onward
steps can be calculated.

Eradication — This stage refers to the full scope
of the investigation to determine where did the attack originate
from and to what extent it was successful. This investigation
should be concluded by ensuring that any malicious activity,
presence, and infrastructure are totally removed.
Recovery — After the eradication stage, outline all
activities that entail restoring operations back to routine,
relating to IT entities (servers, laptops, desktops, user accounts,
apps, and cloud workloads) and data resources backup. Lessons
Learned — This is the slide where you draw actionable
conclusions from the attack in terms of enhancing the environment
resilience, reducing attack surfaces, and potentially making
additional security investments.

IR Reporting

To turn the security process more digestible for management, the
template focuses on two key themes – actions taken to control the
incident and continuous insights into its root cause and scope.
Both are required to clear the risk perception of the event.

The control aspect gained through striving for as much
transparency as possible regarding what in the attack is already
known and what is yet to be discovered, as well as mapping out the
knowledge gains and gaps, creates the assurance that the incident
is indeed managed.

At the end of the day, the company’s executives operate in the
context of operational space – downtime, monetary loss, resources
saved, or consumed. The template addresses this need by providing a
high-level overview of the technical details of the compromise,
lateral movement, and fileless techniques to deliver a translation
of the incident into the actual and potential damage.

While there are many common denominators to cyberattacks, there
are unique qualities for each one. Similarly, there is a high
degree of variance between organizations and management types. The
template is purpose-built to be broken down and used in a modular
manner, customizing it to the specific needs of each
organization.

Communication to management is not a nice-to-have part but a
critical part of the IR process. The definitive IR Reporting to
Management PPT template enables all who work hard to conduct
professional and efficient IR processes in their organizations to
make their efforts and results crystal clear to their
management.

Both management and reporting are essential building blocks in
an efficient IR process. The IR Management and Reporting Template
attempt to assist the CISO with these tasks – not only perform a
top edge response to cyberattacks but also ensure that this
professional and critical work is understood and acknowledged.

Download the IR Management and
Reporting PPT^[2]
template here.