What is a Cloud Incident Response Plan?

Written by the Cloud Incident Response Working Group.

In today’s connected era, a comprehensive incident response strategy is an integral aspect of any organization aiming to manage and lower its risk profile. Many organizations and enterprises without a solid incident response plan have been rudely awakened after their first cloud incident.

4 Key Aspects of a CIR System

There are several key aspects of a Cloud Incident Response (CIR) system that differentiate it from a non-cloud incident response (IR) system, such as governance, shared responsibility, and visibility.

• Governance: Data in the cloud resides in multiple locations, perhaps with different CSPs. Getting the various organizations together to investigate an incident is a significant challenge.
• Shared Responsibility: It is essential to discuss that roles and governance are clear and in the contract or service-level agreement (SLA) with the cloud service provider (CSP). The cloud service customer (CSC) should not create or settle for any policy that cannot be enforced.
• Service Provider Diversity: A single CSP approach to the supply of cloud services may result in a situation where the organization’s business could suffer a sustained outage in case of any failures.
• Visibility: A lack of visibility in the cloud means that incidents that could have been remediated quickly are not addressed immediately and are at risk of further escalation.

The 4 Phases of the CIR Framework

CIR can be defined as the process designed to manage cyber attacks in a cloud environment and is comprised of four phases:

• Preparation: It is necessary to establish the incident response capability so the organization is ready to respond to incidents. In other words, it is vital to know the environment and the “enemy.”
• Detection and Analysis: Identifying data relevant to the investigation is vital in determining the root cause of the incident and identifying lessons learned to avoid repeated incidents.
• Containment, Eradication, and Recovery: After identifying an incident correctly, the policy should list the actions to be taken based on the incident type. Containment deals with isolating the infected system.
• Post-mortem: A strong incident response plan needs to involve evaluating how the incident was processed and managed by enterprise and CSP teams with the aim to improve future incident handling procedures.

Download the Cloud Incident Response (CIR) Framework publication to learn more.