Chapter 2: Preparation and Planning

Introduction

Preparation is the most critical phase of incident response—it is the foundation upon which all other phases depend. Organizations that invest in comprehensive preparation activities respond faster, contain threats more effectively, and recover with less business impact than those caught unprepared. This chapter explores the policies, teams, tools, communication strategies, and exercises that constitute world-class incident response preparedness.

The ancient military strategist Sun Tzu wrote, "Every battle is won before it is fought." This principle applies directly to cybersecurity incident response. The decisions made, resources allocated, and capabilities built during calm periods determine success during crisis.

Incident Response Policy Development

An incident response policy is the formal document that defines an organization's approach to managing security incidents. It establishes authority, assigns responsibilities, and sets expectations for incident handling.

Core Policy Components

Effective IR policies address the following elements:

Statement of Purpose - Why the organization maintains incident response capability - Alignment with business objectives and risk management strategy - Commitment to protecting information assets and stakeholder interests

Scope and Applicability - Which systems, networks, and data are covered - Geographic boundaries (especially for multinational organizations) - Included organizational units and third-party service providers

Roles and Responsibilities - Who leads incident response efforts - Escalation paths to executive management - Responsibilities of IT staff, business units, and external parties

Incident Categories and Severity Levels - Classification scheme for different incident types - Severity ratings (critical, high, medium, low) - Response time objectives for each severity level

Response Procedures - High-level overview of the NIST four-phase process - Decision authority for containment and recovery actions - Evidence preservation requirements

Communication Requirements - Internal notification procedures - External communication protocols (customers, partners, regulators, media) - Confidentiality and legal privilege considerations

Compliance and Legal Obligations - Regulatory reporting timeframes - Law enforcement coordination - Data breach notification laws

Policy vs. Procedure

The policy defines what must be done and why. Procedures (documented separately) define how to do it step-by-step. Policies should remain relatively stable while procedures evolve with tools and techniques.

Policy Development Process

1. Stakeholder Engagement: Involve legal, compliance, HR, public relations, IT, and business leaders
2. Risk Assessment: Align policy with organizational risk tolerance and threat profile
3. Regulatory Review: Ensure compliance with applicable laws and industry standards
4. Executive Approval: Obtain formal authorization from appropriate governance bodies
5. Communication and Training: Distribute policy and train affected personnel
6. Annual Review: Update policy to reflect organizational changes and lessons learned

Start Simple, Iterate

Organizations new to incident response should start with a concise policy covering essential elements. Complexity can be added over time as maturity increases.

Building an Incident Response Team

The incident response team (IRT), sometimes called a Computer Security Incident Response Team (CSIRT) or Security Operations Center (SOC), is the group responsible for executing incident response activities.

Team Structure Models

Organizations adopt different structural approaches based on size, resources, and operational needs:

graph TD
    A[IR Team Models] --> B[Centralized]
    A --> C[Distributed]
    A --> D[Hybrid]
    A --> E[Outsourced/Managed]

    B --> B1[Single team serves entire org]
    B --> B2[Consistent processes]
    B --> B3[Efficient resource use]

    C --> C1[Teams in each business unit]
    C --> C2[Local expertise]
    C --> C3[Faster response]

    D --> D1[Central coordination]
    D --> D2[Distributed responders]
    D --> D3[Balance of benefits]

    E --> E1[External MSSP/MDR]
    E --> E2[24/7 coverage]
    E --> E3[Access to expertise]

    style A fill:#ff9999
    style B fill:#99ccff
    style C fill:#99ff99
    style D fill:#ffcc99
    style E fill:#cc99ff

Centralized Model - Single team supports the entire organization - Advantages: Consistent practices, efficient staffing, deep expertise - Challenges: Potential bottlenecks, less business context

Distributed Model - IR teams within each business unit or geographic region - Advantages: Local knowledge, faster initial response, business alignment - Challenges: Inconsistent practices, duplicated resources, coordination complexity

Hybrid Model - Central coordination team with distributed responders - Advantages: Balances consistency with local expertise - Challenges: Requires strong communication and defined interfaces

Outsourced/Managed Services - Third-party security operations center (SOC) or managed detection and response (MDR) provider - Advantages: 24/7 coverage, access to specialized expertise, predictable costs - Challenges: Less organizational context, potential response delays, vendor dependency

Staffing the IR Team

Essential roles include:

Role	Responsibilities	Skills Required
IR Manager	Strategy, metrics, executive reporting, vendor management	Leadership, communication, risk management
Incident Handler	Triage, analysis, coordination, documentation	Technical analysis, multitasking, decision-making
Forensic Analyst	Evidence collection, deep-dive analysis, root cause determination	Digital forensics, legal procedures, attention to detail
Malware Analyst	Reverse engineering, behavioral analysis, indicator extraction	Assembly language, debugging, virtualization
Threat Intelligence Analyst	Adversary research, IOC correlation, strategic analysis	Research skills, pattern recognition, writing
Network Analyst	Traffic analysis, network forensics, containment execution	Packet analysis, network protocols, firewall/IDS
System Administrator	System recovery, patching, configuration hardening	OS internals, automation, change management

24/7 Coverage Considerations

Organizations must decide whether to maintain round-the-clock incident response capability. Options include:

• Internal rotating on-call schedule
• Follow-the-sun model across global offices
• Managed security service provider (MSSP) for after-hours monitoring
• Tiered response (automated detection 24/7, human analysis during business hours for lower-severity incidents)

Training and Development

IR team effectiveness depends on continuous skill development:

Technical Training - Vendor-specific product training (SIEM, EDR, forensic tools) - Industry certifications (GCIH, GCFA, GCFE, CISSP) - Conference attendance (SANS, Black Hat, DEF CON)

Scenario-Based Exercises - Capture-the-flag (CTF) competitions - Purple team exercises pairing IR with penetration testers - Malware analysis labs

Cross-Training - Job shadowing across IR roles - Participation in threat hunting activities - Exposure to different incident types

Training Budget Rule of Thumb

Industry best practice suggests allocating 5-10% of cybersecurity personnel budget to training and professional development.

Tools and Resources

Effective incident response requires a curated toolkit spanning detection, analysis, containment, and documentation.

Detection and Monitoring Tools

Security Information and Event Management (SIEM) - Aggregates logs from diverse sources - Correlates events to identify suspicious patterns - Examples: Splunk, IBM QRadar, Microsoft Sentinel, Elastic Security

Endpoint Detection and Response (EDR) - Monitors endpoint behavior for malicious activity - Provides detailed telemetry for investigation - Examples: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint

Network Detection and Response (NDR) - Analyzes network traffic for threats - Detects lateral movement and data exfiltration - Examples: Darktrace, ExtraHop, Vectra AI

Intrusion Detection/Prevention Systems (IDS/IPS) - Signature and anomaly-based threat detection - Examples: Snort, Suricata, Palo Alto Networks

Analysis and Investigation Tools

Network Forensics - Wireshark: Packet capture and protocol analysis - NetworkMiner: Network forensic analysis tool - tcpdump: Command-line packet analyzer

Host Forensics - FTK Imager: Disk imaging and evidence acquisition - Volatility: Memory forensics framework - Autopsy: Digital forensics platform

Malware Analysis - REMnux: Linux distribution for malware analysis - Cuckoo Sandbox: Automated malware analysis system - IDA Pro / Ghidra: Disassemblers for reverse engineering

Log Analysis - Grep, awk, sed: Text processing utilities - Timeline creation tools - Custom Python/PowerShell scripts

Containment and Response Tools

Network Isolation - Firewall rule management - Network access control (NAC) systems - VLAN segmentation capabilities

Endpoint Containment - EDR network isolation features - Group policy modifications - Remote access tools for system analysis

Threat Intelligence Platforms - MISP (Malware Information Sharing Platform) - ThreatConnect - Anomali

Documentation and Collaboration Tools

Incident Tracking - Ticketing systems (Jira, ServiceNow) - Dedicated IR platforms (Resilient, Demisto/Cortex XSOAR)

Communication - Secure messaging (Slack, Microsoft Teams with encryption) - Conference bridges for virtual coordination - Out-of-band communication channels (separate from potentially compromised networks)

Documentation - Centralized wiki or knowledge base - Evidence management systems - Secure file sharing for sensitive data

Tool Selection Criteria

When evaluating IR tools, consider:

• Integration capabilities with existing security stack
• Scalability to organizational size and data volumes
• Ease of use and learning curve
• Vendor support and community resources
• Cost (licensing, infrastructure, personnel)

Communication Plans

Communication during incident response requires careful orchestration to ensure accurate, timely information reaches appropriate audiences while protecting sensitive details and legal interests.

Internal Communication

IR Team Communication - Dedicated secure channel (Slack channel, Teams room) - Regular status updates during active incidents - Documentation of decisions and actions taken

Management Escalation - Predefined severity thresholds triggering executive notification - Concise status reports focused on business impact - Decision points requiring leadership approval

Business Unit Notification - Affected departments informed promptly - Guidance on operational workarounds - Timeline expectations for service restoration

External Communication

Customer Notification - Legal and regulatory requirements for breach notification - Coordinated messaging through designated spokespersons - Support resources (call centers, FAQs, credit monitoring)

Regulatory Reporting - Compliance with mandated timeframes - Accurate incident characterization - Documentation of response and remediation

Law Enforcement Coordination - FBI, Secret Service, or local authorities as appropriate - Evidence preservation for potential prosecution - Understanding investigative constraints

Media Relations - Public relations team involvement - Consistent, accurate messaging - Proactive disclosure versus reactive damage control

Loose Lips Sink Ships

During active incidents, implement strict communication controls:

• Information shared on a need-to-know basis only
• No social media posting about incidents
• All external statements approved by legal and PR
• Assumption that adversaries monitor public communications

Communication Templates

Prepare templates in advance for common scenarios:

• Internal incident notification email
• Executive status report format
• Customer breach notification letter
• Regulatory filing template
• Employee guidance during incidents

Exercises and Tabletop Drills

Regular exercises validate incident response plans, identify gaps, and build team proficiency. Organizations should conduct multiple exercise types throughout the year.

Tabletop Exercises

Description: Discussion-based scenarios where participants talk through their response to a hypothetical incident

Benefits: - Low cost and easy to organize - Reveals gaps in procedures and communication - Builds cross-functional relationships - Familiarizes participants with their roles

Typical Duration: 2-4 hours

Frequency: Quarterly

Example Scenario: "Your monitoring systems detect unusual outbound traffic from a server containing customer payment information. The traffic is going to an IP address in Eastern Europe. Walk through your response."

Tabletop Exercise Best Practices

• Invite cross-functional participants (IT, legal, PR, HR, executives)
• Use realistic scenarios relevant to your organization
• Introduce unexpected twists to test adaptability
• Document lessons learned and assign action items
• Keep atmosphere collaborative, not punitive

Functional Exercises

Description: Hands-on simulation where participants execute specific response functions in a controlled environment

Benefits: - Tests actual tools and procedures - Identifies technical gaps and misconfigurations - Builds muscle memory for technical actions - Validates detection and containment capabilities

Typical Duration: 4-8 hours

Frequency: Semi-annually

Example: Technical team responds to simulated malware infection in lab environment, practicing triage, analysis, and containment

Full-Scale Exercises

Description: Comprehensive simulation involving all IR functions and participants, often including external parties

Benefits: - Most realistic test of overall capability - Validates coordination across all functions - Tests business continuity integration - May involve regulatory observers

Typical Duration: 1-2 days

Frequency: Annually

Example: Organization-wide response to simulated ransomware attack including technical response, executive decision-making, customer communication, and regulatory reporting

Purple Team Exercises

Description: Collaborative exercise where offensive security team (red team) simulates realistic attacks while defenders (blue team) practice detection and response

Benefits: - Realistic adversary tactics - Identifies blind spots in detection - Improves threat hunting skills - Builds relationships between offensive and defensive teams

Frequency: Quarterly

Exercise Objectives

Every exercise should have clearly defined objectives such as:

• Test specific plan components
• Validate new tools or procedures
• Train new team members
• Meet regulatory requirements
• Build cross-functional coordination

Metrics for Preparedness

Organizations need metrics to measure incident response readiness and demonstrate program value to leadership.

Readiness Metrics

Metric	Description	Target
IR Plan Currency	Days since last plan review/update	< 365 days
Team Training	Percentage of IR team completing annual training requirements	> 90%
Exercise Participation	Percentage of required personnel participating in exercises	> 85%
Tool Coverage	Percentage of critical assets with EDR/monitoring deployed	> 95%
Playbook Coverage	Number of incident types with documented playbooks	Major threat scenarios
Detection Testing	Percentage of detection rules tested in past quarter	> 75%

Response Capability Metrics

Metric	Description	Target
Detection Time	Mean time to detect (MTTD) incidents from initial compromise	< 24 hours
Response Time	Mean time to respond (MTTR) - initial triage to containment	< 4 hours for critical
False Positive Rate	Percentage of alerts that are false positives	< 20%
Containment Success	Percentage of incidents contained before spreading	> 90%
Recovery Time	Mean time to recovery (MTTR) from incident declaration	Business-specific SLAs

Metric Reporting

Present metrics in formats meaningful to different audiences:

• Technical Leadership: Detailed metrics with trends and root causes
• Executive Management: High-level dashboard with red/yellow/green indicators
• Board of Directors: Annual summary focusing on risk reduction and program maturity

Continuous Improvement

Preparedness metrics should drive improvement initiatives:

1. Baseline Measurement: Establish current state
2. Target Setting: Define realistic improvement goals
3. Gap Analysis: Identify specific deficiencies
4. Remediation Planning: Allocate resources to address gaps
5. Progress Tracking: Monitor improvement over time
6. Validation: Test improvements through exercises

Conclusion

Preparation is not a checklist to complete but an ongoing commitment to building organizational resilience. The policies, teams, tools, communication frameworks, exercises, and metrics described in this chapter transform incident response from reactive crisis management to proactive capability.

Organizations that treat preparation as continuous investment rather than one-time project reap measurable benefits: faster detection, more effective containment, reduced business impact, and stronger stakeholder confidence. As the saying goes, "Failing to prepare is preparing to fail."

The next chapter explores how prepared organizations leverage their investments during the critical detection and analysis phase, where security events are identified, validated, and prioritized for response.

Key Takeaways

• Incident response policy establishes organizational authority and expectations
• IR team structure should align with organizational size, resources, and risk profile
• Comprehensive toolsets enable detection, analysis, containment, and documentation
• Communication plans prevent chaos and protect legal interests during incidents
• Regular exercises validate plans and build proficiency
• Metrics demonstrate preparedness and drive continuous improvement