Insider Abuse Incident Response Playbook

This download includes the 6clicks Incident Response playbook for Insider Abuse.

The purpose of a Cyber Security Playbook, or Security Playbook, is to provide all members of an organisation with a clear understanding of their roles and responsibilities regarding cybersecurity: before, during, and after a security incident.

Insider threats in cybersecurity are threats posed to organisations by current or former employees, contractors, business associates, or other partners. These individuals have inside information on the organisation in question and may misuse access to networks, applications and databases to wittingly or unwittingly cause damage and disruption and/or erase, modify or steal sensitive data.

Remember: If you face an incident, follow IRM, take notes, and do not panic. Contact your CERT immediately if needed.

6 steps are defined to handle security Incidents:

• Preparation: get ready to handle the incident
• Identification: detect the incident
• Containment: limit the impact of the incident
• Remediation: remove the threat
• Recovery: recover to a normal stage
• Aftermath: draw up and improve the process