Establishing a security incident response process is a must for not only very large enterprises but also small businesses. Cybersecurity laws or GDPR require not only a security incident process, but they also require a security incident notification to be sent to the supervisory authority and key stakeholders. A complete security incident process involves the security incident handling team, human resources, the legal department, and also external supervisory groups. Although there are many security technologies and tools that can help to identify, protect, detect, respond, and recover from threats, PR and public communication play critical roles in non-technical parts. We will mainly focus on the security activities during the preparation, detection, containment, and post-incident handling stages based on NIST SP 800-62.
Here are some of the...