An incident response plan contains the plans and procedures implemented by your information security program. It ensures that you have adequate and repeatable processes in place to respond to any information security incident that could affect your organizational network or information systems.

This is very apparent from the following news stories:

• Pizza Hut PCI data breach:
  • First reported on October 14, 2017
  • For more information: https://www.bleepingcomputer.com/news/security/users-report-fraudulent-transactions-after-pizza-hut-admits-card-breach/
• Deloitte data breach affecting customers across governments and businesses:
  • First reported on September 25, 2017
  • For more information: https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails

In this chapter, you will learn:

• Why you need an incident response plan
• What components make up the incident response plan
• Tools and techniques related to incident response
• The incident response process
• The OODA loop