Who takes charge of the situation when a cybersecurity incident unfolds, and what does that person need to do? The incident response coordinator plays a pivotal role by getting and tracking decisions, coordinating response steps, and briefing stakeholders. Set up these individuals for success by preparing the right docs in advance and conducting tabletop exercises.
Security incident response (IR) teams include people from diverse professions, such as IT staff, DevOps engineers, security analysts, forensic investigators, lawyers, and PR specialists. Amid the stress often associated with the IR process, the incident response coordinator serves as the linchpin, bringing the IR team’s efforts together.
The IR coordinator typically handles the following tasks when the organization responds to a security incident:
- Track the progress of the IR process during the security incident, including each decision, who made it, and why.
- Coordinate the actions of other IR team members, disseminating information as necessary, preventing people from stepping on each other’s toes.
- Get decisions from the people authorized to make them, such as whether to take a business-critical system offline to contain the attacker.
- Provide status updates to executives and other relevant parties who are not members of the IR team, so the responders can keep working without constant interruptions.
- Provide expertise where necessary by either offering guidance from personal knowledge and experience or by channeling such information from the subject matter expert.
The IR coordinator’s overall responsibility is to ensure the IR process moves forward.
Even if you do nothing else to prepare to respond to security incidents, consider who in your organization or group can serve as the IR coordinator. The perfect candidate for the role will have the following attributes:
- Has technical knowledge: The IR coordinator doesn’t have to have hands-on technical skills, but it helps. The person needs to be able to speak the language of the technologists “on the ground” who interact with the affected systems, cloud services, and applications.
- Has strong communication skills: The IR coordinator will often act as the communication hub, using chat, video calls, phone, and in-person interactions to share incident-related information and to coordinate other team members’ activities. As Ryan Chapman noted in his chapter of Dynamic Incident Response, the person should be comfortable telling leadership “we don’t know yet” or “the timeline has changed” without losing credibility.
- Understands the affected environment: The IR coordinator should know the key components of the infrastructure and applications involved in the incident. The person should also know the role that these components play in the organization’s business.
- Can learn quickly and improvise where necessary: The IR coordinator is unlikely to have the full knowledge of the affected environment, its technologies, people, or business processes. The person needs to be able to pick up relevant details quickly and, when necessary, think on their feet.
The IR coordinator should also be trained in incident response and have experience with at least some aspects of the IR process. Have candidates practice the role in tabletop exercises so they’ll be ready before a real incident demands it. Smaller organizations have a hard time maintaining trained IR specialists on staff; in such cases, they either contract with a third party to provide such personnel when needed or designate the best-fit person from internal staff when an incident occurs. The third party might be an IR retainer firm or a managed security service provider.
If you find yourself coordinating a security incident and don’t know where to start, use my Initial Security Incident Questionnaire for Responders and capture what you learn in the IR report template. Better yet, customize both documents for your organization before an incident. If you’re being proactive about IR, see my Tips for Starting a Security Incident Response Program.
For more on this role, read Joshua Wright’s free book Dynamic Incident Response.
