BD308 – Cyber Security – Fariid Alam Saputra – 2581485755

1. What are the four main phases of the PICERL incident response lifecycle? (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity).
2. Why is it critical to have a communication plan ready before a data breach occurs? Who should be notified?
3. What is the purpose of a Business Continuity Plan (BCP)?

Status: 100% sudah tercapai

Keterangan: Saya sudah mengerjakkan essay ini dengan baik dan benar

Bukti:

1. The PICERL incident response lifecycle is a framework for handling cybersecurity incidents systematically. It consists of five main phases, often remembered as Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity:

   1. Preparation – Establish policies, tools, and training so the organization is ready to respond effectively to incidents. This includes defining roles, access controls, and communication plans.
   2. Detection & Analysis – Identify and investigate potential security events to determine whether they are actual incidents, their scope, and their impact.
   3. Containment, Eradication & Recovery – Contain the incident to prevent further damage, remove the root cause, and restore affected systems to normal operation.
   4. Post-Incident Activity – Review the incident, document lessons learned, update security measures, and improve response plans to prevent future incidents.

   This lifecycle helps organizations respond efficiently, minimize damage, and strengthen overall security posture.

2. Having a communication plan ready before a data breach is critical because a breach is often chaotic, and delays or mistakes in communication can worsen the damage. A prepared plan ensures that the organization responds quickly, transparently, and consistently, protecting both the company’s reputation and legal compliance. It also helps employees know exactly what to say and do, reducing confusion and misinformation.

   Key parties who should be notified include:

   • Internal stakeholders: Executives, IT/security teams, and relevant department heads.
   • Affected customers or users: To inform them about the breach and provide guidance (e.g., changing passwords, monitoring accounts).
   • Regulatory authorities: Many laws require reporting breaches within a specific timeframe (e.g., data protection authorities).
   • Partners and vendors: If the breach affects third-party systems or shared data.
   • Law enforcement: In cases of serious fraud, theft, or criminal activity.

3. The purpose of a Business Continuity Plan (BCP) is to ensure that a business can continue operating during and after a disruptive event, such as natural disasters, cyberattacks, power outages, or other emergencies. A BCP identifies critical functions, resources, and processes, and outlines how to maintain or quickly restore them to minimize downtime and financial loss.

   It also helps organizations protect employees, maintain customer trust, comply with regulations, and make informed decisions under pressure. In essence, a BCP is about preparing for the unexpected, so the business can survive and recover as smoothly as possible.