- Email: info@cyblu.com
- 7600 Chevy Chase Dr, Suite 300, Austin, TX 78752
- (210) 460-0004
The escalation process goes by various names and assessments during the incident response. We aimed to understand these differences to better focus on objectives and achieve results, which led us to explore this topic.
An escalation policy is a documented guideline instructs team members on the appropriate procedures for escalating the incident management process. This policy delineates the hierarchy of alert escalation and the distribution of responsibilities within your organization. When the issue is more complex and impossible, the staff at Level-1 transfers the incident to a higher-level expert team.
During the incident phase, especially after a data breach, Level 1 escalates the issue to the more expert Level 2 and beyond.
All Members of CIRC (Cyber Incident Response Center) are very excited about the issue that could not be solved in Level-1 and the greater risk; sometimes, excitement makes people make mistakes. Therefore, what needs to be done at this point of the problem should be written in detail and taught to the members.
Now, let’s explore the idea of an escalation policy and delve into creating an efficient policy that bolsters our organization’s incident response plan.
At the time of the incident:
It should provide clear criteria for when an incident should be escalated to the next level. Whether the incident occurs during or outside business hours should be kept separate, and rules should be set for both situations.
It needs to be determined who will report the incident and to whom the report should be made. Confidentiality of the case is paramount. For this reason, the person to whom the incident will be conveyed and the transmitters must be determined well in advance. Reporting the incident to an influential and authorized person plays a vital role in resolving the incident. Sometimes, if there is an important issue such as ransomware, it is necessary to act more thoughtfully.
The entire workflow should be done with tools that provide secure and fast communication, for example, ChatOps, Slack, Microsoft Teams,
DevOps.
The escalation process needs to be clearly defined: The team working on this issue should summarize and explain all aspects of the incident. If the organization uses “automated incident response management tools,” the team must know their workflow and that the reported incident is an incident. If the institution has yet to have the opportunity to reach a higher level, it should inform in advance what it will do.
Here are the things to do after the incident is delivered to the relevant person safely and safely.
Organizations commonly classify incidents using a three or five-tier severity scale, where each level dictates a unique response. For instance, a three-tier system might rank incidents from SEV 3 to SEV 1, with increasing importance.
Severity levels in organizations usually vary, falling within a range of one to three, four, or five, where SEV 1 represents the most critical incidents, and the most significant number (3, 4, or 5) indicates the least severe cases.
Severity levels are not standardized; they are defined based on what matters most to your organization and its users. While three levels suffice for some companies, others might find dividing incidents into five groups more suitable. Severity levels are not standardized; they are defined based on what matters most to your organization and its users. While three levels suffice for some companies, others might find dividing incidents into five groups more suitable. Below are the definitions for a five-level system:
Let’s divide this accident into five or three, but the first level is the most severe. The accident in the first level should be tried to be solved in the five stages shown above.
In this regard, SEV-1 is a critical issue affecting many users in a production environment. The problem affects essential services or inaccessible services, negatively impacting the customer experience. For Sev 1 incidents, it’s vital for staff to intervene thoughtfully at an early stage to decide the appropriate time to notify stakeholders.
Some organizations use two different words to express the degree of severity of the incident, but they mean the same thing. One of these is priority, and the other is severity.
Priority and severity frequently align perfectly; for example, an outage stopping all users from accessing a service is classified as high priority and SEV 1.
But very few times, something that is a priority may be minimal in severity.
It is necessary to write a separate topic to determine incident severity levels. We won’t get into that issue now.
Each organization assigns different names to levels of violence and priorities and establishes designated response times at various intervals.
Accordingly, some organizations have explained the solution with the reporting period as follows:
P1 (priority 1) must be reported to the upper level within 15 minutes and resolved within 4 hours.
P2 (priority 2) must be reported to the upper level within 1 hour and resolved within 9 hours.
P3 (priority 3) must be reported to the upper level within 4 hours and resolved within 18 hours.
P4 (priority 4) must be reported to the upper level within 9 hours and resolved within 45 hours. Etc.
Conclusion
Different solutions and naming can be done to escalate to the upper level. No matter what method we apply, we must make a rule.
An escalation policy is essential for guaranteeing that critical incidents receive proper attention from support staff and that the right teams and management are informed in the event of an incident. It offers a straightforward process for staff to respond to incidents and simplifies the documentation and auditing of your incident response.
References
https://www.xmatters.com/blog/how-to-build-an-escalation-policy-for-effective-incident-management#:~:text=An%20escalation%20policy%20is%20a,time%20in%20an%20incident’s%20lifecycle.
https://www.splunk.com/en_us/blog/learn/incident-severity-levels.html
https://ut.service-now.com/sp?id=kb_article&number=KB0011708