An IT company has already most of the standard procedures / precautions in place to do day-to-day business in a secure way e.g. policies for users what to do and what not to do, technical solutions like antivirus / spam protection / log management / .... There are also plans to restore systems and what service has which dependencies etc. for when something really goes south (either because of an attack or simple system errors) and plans how to deal with “normal” incidents like fire in the datacenter, virus infection of server / clients, total fail of service X. Now I want to prepare for a big fallout like the compromise of multiple systems and services with no clear understanding where the breach is and how the attacker could gain access and likely no clue what systems are compromised.
Question(s): How would somebody prepare for an incident that is not predictable? Are there templates someone could create to help guide through the (unknown) situation? How to take care of the (naturally) occurring panic that such an incident would cause? Should management get guidelines what to do or have a say in this situation at all (in my experience they don’t really understand what’s going on, are not helpful and are only concerned with identifying who to blame)? Is all hope lost in such a situation and should an external service provider be called to deal with the situation? The main problem here is that I can’t produce a step-by-step manual for a situation that is not predictable. Also a problem is that one team can’t check what systems are possibly compromised due to separation of power and restricted rights and I don't know which teams to call when nobody can tell which systems are affected.
Note: There is no incident response team or dedicated security analysis team in place. The only ones who really know the infrastructure and how their systems work are the people who do the standard workload e.g. windows team, linux team, vmware team, storage team, network team, … and for most of the teams there is 24/7 standby.
