In reply to Ramdas Murathasawarmathikkandan.

Hi Ramdas,

Sorry for the delay in response. Your questions are great and I wanted to make sure we did respond.

There is enough uniqueness in the scope of a SIRT and Data Protection Incident Response (DP IR) team that makes staffing separate functions advantageous. The goal and strategy followed is different enough so that asking one set of management and staff to accomplish both will be an insufficient approach.

A big difference in the SIRT and DP IR incident response reality is the duration of engagement. SIRT teams often focus on time to identify, triage and resolve an incident. The inability to close out a case for extended periods of time would drive a SIRT manager crazy. However a DP IR team is able to work the many long-term phases of a severe incident and accept the extended time it takes to accomplish something which is more politically sensitive than technically risky.

It is not unusual for a DP IR team to lead an incident for months while many time-consuming response steps are executed. Data incidents may also occur outside the organization and within a business partner. Situations like this often require patience as the victim performs their own investigation resulting in long periods of time without status change.

It is common for an incident to require analysis, initial response, investigation, communication, legal consultation, executive escalation, external communication for months due to an incident as simple as malware found in a partner infrastructure.

Combine this with the growing number of US and global data protection regulations, including GDPR which will dictate how immediate and ongoing communication to a Government regulatory body must be maintained and you have made the scope of a good SIRT team too broad.

Allow the SIRT team to focus their energy on the technical response to their constantly evolving threat actors and attacks. Provide for a structured response to data incidents that is equally professional but focused on what could be longer term objectives.

At Cisco, we have the skills of an industry leading SIRT organization that has a highly technical and knowledgeable staff able to bring a security incident to a rapid close. The new DP IR team is growing their skills to respond to data incidents requiring long term engagements, compliance with regulatory or contractual demands and executive level communications. Asking one team to do both, is risking failure everywhere.