Identifying the key areas for improvement in a CSIRT

A Namibian bank’s incident response team ran its first simulation with Aphotic, to find out exactly where its process could improve.

The Problem

A Namibian bank needed to run a CSIRT simulation to uncover the strengths and weaknesses behind their incident response process in a more measured, qualitative manner that actually showed them what they needed to improve.

The Finding

The CSIRT proved extremely capable in tackling the simulated incident and practising their incident response process. While they were able to get a rein on the incident quickly, Aphotic identified several key areas for improvement.

The first concerned the triage process. During an audit of the team’s response framework before the simulation, Aphotic identified a discrepancy in how the organisation classified incident severity. This came through in the simulation, where the team initially debated how to classify the incident. Although the team recognised its severity and classified it correctly after this discussion, it highlighted a key avenue for improvement.

Aphotic also observed some discontinuity when the incident was split into separate workstreams. While high-level communication was sufficient, observations made by team members did not always make it back to the primary incident stream.

The Fix

Aphotic recommended that the CSIRT take part in a workshop on triage and team communication, and identified the areas in the response plan and playbooks that could be improved.

While this was one of the strongest CSIRTs Aphotic has worked with, and the team performed exceptionally well for a first simulation, identifying areas for improvement is always worthwhile for an incident response team.

Through the simulation, Aphotic identified the crucial areas for improvement and gave the team a detailed, qualitative breakdown of their performance, with actionable feedback.