Preparation: The expression “forewarned is forearmed” originated as a Latin proverb and is perhaps the most succinct way of explaining why planning is crucial. The odds are good that a security incident will happen at a customer’s site. Thinking about the various threats and risks and preparing for the most likely significantly reduces the chances of a poor response. Anticipating a lost or stolen device, a ransomware attack, a data-breach notification or a significant Internet outage – physical or DDOS – will set the stage for a professional response from front-line staff.

Detection/Identification: Not all security incidents are straightforward situations; some might not even require an immediate response. When a call comes in to the help desk, the handler should ask a number of questions to determine if an actual security incident is unfolding. Some incidents are clear cut: Ransomware is a classic example. A lost or stolen device, however, might turn up at some point in the near future. It’s important to gather all the information available into the service ticket. Engaging a manager or supervisor is usually advisable when the call handler is reasonably certain a security incident is occurring — declare the security incident and raise the priority of the ticket appropriately.

Analysis/Communication: Gaining a clear picture of what is going on from a phone call or email, from panicky and perhaps non-technical customers, might be difficult. Consulting the remote monitoring and management system, customer documentation, network details and security tools could yield valuable details. Perhaps an invoice was unpaid, and a customer was cut off from a vital service, or the internet-facing IP address of the customer has had its reputation lowered due to a misconfiguration. Any number of non-malicious options need to be explored because all too frequently, a “security incident” turns out to be a human mistake.

Containment/Fix: Whether malicious or error, resolving the incident successfully should be the focus of all involved. If ransomware has broken out, taking systems offline or segmenting the infected systems from spreading might be immediate actions to take. A customer concerned they clicked on a malicious link might need a deep antivirus scan and/or network layer analysis to see if there are indications of compromise on the workstation. The steps taken to contain or resolve the incident should be put in the service ticket in detail, along with clear and accurate time recording from the start to the end of the security incident.

Lessons Learned: This is perhaps the most critical part of your response. Security incidents are bad for customers and bad for IT service providers and MSPs — they can put your firm’s reputation at stake. Customer experience matters. Analysis of the security incident might identify proactive steps that you can take to prevent future problems. Steps from end-user security training to adding new technology, such as application whitelisting in the case of ransomware attack, might reduce the likelihood of a future security incident. There might even be a project opportunity for your company in the fast-growing security services market.