Benchmark - Developing Contingency Strategies For Information System

3 something super confidential, then the losses will be heavy, we would lose an enormous amount of money, and reputation. However, the losses wouldn't be as severe if the assets were of less importance. the way of recovering everything. Next is to find where the system misconfigurations are, and patch them. Correctly configure each system configuration to ensure that the threat can no longer affect the company, and the crisis can be averted. Out-of-Date Software High The best way to recover out-of-date software is to update the software. The whole issue arose from software being out-of- date. The next thing to do is to configure each device to auto-update at a certain time of day. This way, the software is more likely to be up-to-date in the future. Of course, the employees will need to trained of this, and know what to do when the system needs to update. Weak Authorization Methods High The best way to recover from weak authorization credentials is to set up a multi-step process, and make it required to authenticate with more than just user credentials, like a username or password. The other authentication methods could be biometrics, smart-card, one time passwords via phone number or email, etc. Incident Response Plan (IRP) In this plan, we will describe the steps to take when a cyber incident occurs (due to one of our threats being exploited, such as weak credentials, or system misconfigurations). This plan will outline the roles and responsibilities of the security organization, going from users to CISO and our reporting guidelines. More so, this plan will articulate activities to mitigate possible or real time threats (key examples are system monitoring and incidence response). Alongside that, this plan will display workflow diagrams and event to resolution, explanation of the six stages of incident handling related to the company, escalation procedures, with an associated chart, a

6 In the section, we will pose a real sample incident response plan with escalation matrices and contact grids. Company name: Canyon Aeronautics Effective date: October 31 st , 2025 Purpose: This plan will describe the steps to cover all related cyber incidents at Canyon Aeronautics. This plan will provide a list of employees and their roles in the case of an incident, as well as any policies and procedures to follw to ensure normal business operations. We will list all the employees to inform during an incident and their roles or responsibilities during an incident. Ron Stewart – cybersecurity analyst Lana Rhoades – information officer Bart Simpson – Chief Security Officer Nippy Turner – Help Desk Specialist Example Escalation Matrix S1 S2 S3 S4 P1 Critical Critical Urgent Important P2 Critical Urgent Important Normal P3 Urgent Important Normal Normal P4 Important Normal Normal Normal In this section, we will outline possible incident response strategies while incorporating real-time monitoring tools. a. Containment, Eradication, and Recovery b. Post-incident Activity c. Recover d. Plan things out ahead of time e. Use IDS and IPS Disaster Recovery Plan (DRP) The purpose of this DRP plan is to better prepare our employees for a disaster, should one occur. In this plan, we will go over a wide variety of topics, such as roles and responsibilities, resource and training requirements, an explanation of an exercise to test the DRP in a predetermined scenario, and maintenance schedules. In this section, we will outline our employees and their respective responsibilities during the event of a disaster. Gregory Simpson – Chief Executive Officer Homer Mathews – Office Cook Ana Tores – Secretary