Incidents can take many forms, including worms and viruses, DOS attacks, unauthorized access, natural disasters and employee behavior that violates policies. Different incidents can have different levels of severity. The most severe attacks can disrupt critical communications or business continuity, result in data theft, or have a long-term effect on the institution's reputation. Low-level attacks, including viruses that are detected and quarantined on a single computer, have little or no effect on normal operations. Regardless of the type and severity of an attack, credit unions and other financial institutions must have a workable plan to respond to incidents. The longer it takes to resolve an incident, the greater the damage may be.

The first step is to form an incident response team. Typically, the team consists of an information security expert or IT staff member who has received adequate cybersecurity training. The team may also include someone from the help desk, a telecommunications professional, an individual with public relations experience, a representative from the legal department, a member of the human resources department, someone with physical security responsibilities and a member of senior management.

Preparation is critical. Assemble current server and network documentation, ensure that there are always quality backups available, and establish baseline data for the network and system.

Create automated playbooks or checklists for employees to follow. This helps ensure that important steps are not overlooked during the response efforts.

Create a written incident response plan. Details that should be covered include contact information for key personnel, the levels of authority for each team member and the individual who will lead the response efforts.

Practice, train, evaluate and repeat. Frequent drills help employees learn what they need to do, but drills can also reveal gaps in the plan or procedures that need to be modified. Establish a goal for each drill as well as the metrics that will be measured. Conduct a postmortem after each drill to determine what worked well and what was a dismal failure. If necessary, modify the plan to incorporate the lessons learned.

Educate all employees on ways they can detect potentially suspicious incidents and how to report these incidents. Incidents that warrant reporting include website defacement, harassing or threatening emails, unexpected changes to user rights, emails containing unknown links and removable storage devices that "just appear" on their desks from an unknown source. Employees who have confidential information stored on their laptops must make sure that all data is encrypted.

Automate every aspect of incident response that can be automated. By allowing machines to filter out duplicates and false positives, for example, staff members will have more time to concentrate on serious incidents. In addition, automating response tasks via playbooks can provide consistency and accuracy in response.

Incidents will continue increasing in the coming years, and credit unions and financial institutions must continue finding effective ways to respond to them. Organization size is not an automatic limit on the effectiveness of incident response. By embracing automation and sound procedures, it is possible for credit unions and small financial institutions to respond to incidents quickly and effectively.

Instant Insights /

How Credit Unions Can Improve Incident Response

Related Stories

Recommended For You