INCIDENT RESPONSE (IR)
What is IR?
Incident response (IR) is the systematic approach taken by an organization to prepare for, detect, contain, and recover from a suspected cybersecurity breach. An incident response plan helps ensure an orderly, effective response to cybersecurity incidents, which in turn can help protect an organization’s data, reputation, and revenue.
How an organization responds to an incident can have tremendous bearing on the ultimate impact of the incident. Becoming the victim of a cyber attack is bad enough, but organizations that fail to take appropriate steps may find themselves vulnerable to employee or shareholder lawsuits or penalties from regulators. They may also find that their insurance company will not accept their claim if they did not take certain predetermined steps.
Why RSA?
The RSA global Incident Response Practice provides a portfolio of services for organizations that need rapid access to technical security expertise to assist with identifying and remediating cybersecurity attacks. Incident response retainers, proactive incident discovery/compromise assessment and knowledge transfer services are also provided. These services enable organizations to conduct proactive hunting and get ahead of the threat before a breach occurs.
Early detection and rapid response are the most critical capabilities for targeted attack defense. Many reports indicate that well-resourced adversaries consistently bypass traditional security defenses. The issue is less about being able to keep the bad guys out, which is increasingly hard to do on an ongoing basis. It’s more about detecting and responding to them as soon as they are in. Once detected, a rapid response is needed to mitigate broader compromise and prevent the attackers from achieving their objectives. The RSA Incident Response Practice enables organizations to respond to security incidents without having to accept the inevitability of loss.
