Incident Response
-
Incident ResponseIncident Reporting
-
Incident Response Use CasesLab Setup
-
Role Playing - Shift Manager
-
Demonstrating: Investigating and Escalating
-
Report from Malware Analyst
-
Exercise 1.1: Exploring Suspicious Executable Detected using SIEM
-
Exercise 1.2: Investigating Multiple Failed Logins using SIEM
-
Exercise 3: Mitigating Risk
-
Exercise 4.1: Asking the Right Questions
-
Scenario 4.1: Asking the Right Questions
-
Scenario 4.2: Suspicious or Malicious?
-
Exercise 4.2: Reviewing the Shift Log
-
Exercise 4.3: Investigating an Unauthorized Login Attempt
-
Exercise 4.4: Investigating Firewall Traffic
-
Exercise 4.5: Reviewing the Security Operations Mailbox
-
Exercise 5.1: Reviewing New Intelligence
-
Exercise 5.2: Assessing Threat Severity
-
Exercise 6: Recommending Remediation
-
Exercise 7: Conducting a Post-Incident Review
-
Exercise 8: Communicating with Operations and Senior Management
-
Business ContinuityBusiness Continuity Plan Development8 Topics
-
BCP Invocation Process2 Topics
-
Emergency Procedures7 Topics
-
Crisis Management Team10 Topics
-
BCP Seating Plan
-
Overview
-
Disaster RecoveryScope of Critical Services
-
Network Services
-
Application Hosting Service
-
File Hosting Services
-
Call Centre and Voice Recording Services
-
Regulatory Links
-
Thin Client Environment
-
Voice System (Non-Service Desk)
-
Printing Services
-
Recovery Time Objective (RTO) & Recovery Point Objective
-
Single Point of Failure
-
Redundancy Requirements
-
Alternate Locations
-
Contact Protocol4 Topics
Participants3
Communication
Efficient communication is very important, especially in a crisis situation, therefore, a contact process is established for exchange of information:
- Internal Communication
- External Communication
- Customer Inquiries
2.1 Internal Communication
Since employees are the most important resource during business disruption, a call tree method (attached) is implemented to keep them updated every step of the way.
The MD & CEO triggers the call tree by communication of BCP invocation decision to O&T Head and selective Senior Management members.
O&T Head handles further communication of notifications / announcements / Management instructions through Country BCP Coordinator.
According to available means of communication (e-mail/ mobile phone/ landline), business disruption notice and BCP invocation note will be announced to all staff members according to the sequence detailed in attached call tree (Appendix I).
Each staff member will be responsible for calling contacts listed on relative wallet card.
In absence of mobile coverage / e-mail access, communication will be via landlines or telephone bridges and for selective Senior Management Team members, Satellite phones.
Information communicated to employees should include:
- The nature and extent of the event
- The number of services affected and expected disruption duration – Any contact data changes due to the event
2.2 | External Communication |
The Head of Corporate Communication and the External Communication Manager are the sole contact points with media and have the right to release any official statements on behalf of the bank based on the bank’s strategy at the time of crisis after obtaining the MD & CEO approval on any course of action. Their role is to closely monitor the media scene and keep the MD & CEO updated with any article related to the crisis / about ADIB with the help of the PR agency and act accordingly.
It is strictly prohibited for other employees to release any statements to third party without the approval of the MD & CEO.
In case business is resumed from the alternative location, notification should be sent to customers and correspondents via any of the following means:
- Branch Manager / alternate advertise in original branch’s premises advising the temporary location, contact numbers, fax numbers of the temporary location and services available.
- Relationship Managers contact key customers.
- FI broadcast via SWIFT to all correspondents.
- Country BCP Coordinator broadcast to all ADIB staff members via e-mail advising the disruption situation and any updates related thereto.
- General Administration informs courier, delivery services and other key service providers of the temporary location.
2.3 | Customer Inquiries |
A general holding statement about the bank’s status should be distributed circulated by the Corporate Communication Department to all staff members in case of business disturbance to act as a general standard response to customers.
Any changes to the standard script should be prepared by the business owner and approved by Legal prior to circulation.