An IT company has already most of the standard procedures / precautions in place to do day-to-day business in a secure way e.g. policies for users what to do and what not to do, technical solutions like antivirus / spam protection / log management / .... There are also plans to restore systems and what service has which dependencies etc. for when something really goes south (either because of an attack or simple system errors) and plans how to deal with “normal” incidents like fire in the datacenter, virus infection of server / clients, total fail of service X. Now I want to prepare for a big fallout like the compromise of multiple systems and services with no clear understanding where the breach is and how the attacker could gain access and likely no clue what systems are compromised.

Question(s): How would somebody prepare for an incident that is not predictable? Are there templates someone could create to help guide through the (unknown) situation? How to take care of the (naturally) occurring panic that such an incident would cause? Should management get guidelines what to do or have a say in this situation at all (in my experience they don’t really understand what’s going on, are not helpful and are only concerned with identifying who to blame)? Is all hope lost in such a situation and should an external service provider be called to deal with the situation? The main problem here is that I can’t produce a step-by-step manual for a situation that is not predictable. Also a problem is that one team can’t check what systems are possibly compromised due to separation of power and restricted rights and I don't know which teams to call when nobody can tell which systems are affected.

Note: There is no incident response team or dedicated security analysis team in place. The only ones who really know the infrastructure and how their systems work are the people who do the standard workload e.g. windows team, linux team, vmware team, storage team, network team, … and for most of the teams there is 24/7 standby.


1 Answer 1


This is a difficult question. To write proper incident response procedures you will probably want to consult with someone who does this as their full time job. They will be able to guide you through the creation of procedures for your business, by taking into account your level of tolerable risk, assets (company name, etc.), legal/regulatory exposure, and many other factors.

At the moment I wouldn't say that you should hire someone in case of a breach, rather hire someone before it happens to put together your plan. And yes, while it may be expensive, think of it like an insurance plan. This is what you're going to do when the company is in deep crisis.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .