Incident Response During Crisis: Adapting Playbooks for the Unexpected

May, 2020 • 8 min read

The Pandemic Stress Test

The first half of 2020 throws incident response teams into uncharted territory. The global COVID-19 pandemic disrupts nearly every IT process—exposing untested assumptions in business continuity, security playbooks, and human coordination. IT and security professionals must respond to threats under stress, often from home networks, using hastily expanded infrastructure. Traditional IR (incident response) plans suddenly feel outdated.

Legacy Playbooks Struggle

Many existing incident response playbooks revolve around perimeter breaches, on-premises assets, and in-office collaboration. During crisis, none of those conditions hold true. The rise in phishing, endpoint compromise, insider threats, and VPN abuse strains both IR tools and responders. Response teams lack direct access to affected endpoints, cannot meet in person, and must coordinate across tools that were never stress-tested at scale.

Spikes in Threat Activity

Threat actors exploit the chaos. Between February and April 2020, attacks using COVID-19 lures spike. Credential phishing campaigns increase, capitalizing on remote work tools. Ransomware groups escalate operations, knowing backups may be delayed or mismanaged. Attackers understand that uncertainty gives them an advantage.

Visibility Becomes a Priority

Remote work diminishes traditional network visibility. Endpoint Detection and Response (EDR), centralized logging, and secure cloud access become top priorities. Organizations that previously invested in telemetry, asset management, and automation react faster. Those without unified logging or EDR struggle to even confirm if an incident is real, let alone contain it.

Updating the IR Lifecycle

Each phase of the IR lifecycle requires rethinking:

• Preparation: Training now includes remote communication tools, crisis-specific playbooks, and remote triage techniques.
• Detection: Alert fatigue from a surge in log noise needs tuning. Behavioral baselines must adapt to remote patterns.
• Containment: Quarantining remote endpoints relies on cloud-based or agent-based tools, not physical disconnection.
• Eradication: Endpoint remediation needs remote execution scripts, patch management, and cloud-native orchestration.
• Recovery: Response metrics shift from SLA-focused to continuity-focused. RTOs (Recovery Time Objectives) get renegotiated.
• Lessons Learned: Virtual debriefs replace war rooms. Documentation includes constraints caused by crisis conditions.

Lessons from Crisis Response

Organizations that fare better often:

• Use cloud-managed security stacks that allow remote control and monitoring of endpoints.
• Integrate their IR process with identity platforms (SSO, MFA, conditional access).
• Empower responders to make decisions rapidly without waiting for slow approvals.
• Prioritize collaboration across teams: IT, security, communications, and legal.

The Human Factor

Security fatigue, personal stress, and resource constraints affect responders. Managers must actively support mental health, reasonable work hours, and post-incident recovery. The best IR teams balance rigor with empathy. Psychological safety becomes just as important as technical competence.

Rethinking Metrics

Traditional KPIs—mean time to detect, mean time to respond—need context. In crisis, these metrics shift. Focus shifts to resilience: how quickly can a business resume operations? How effectively can systems continue under degraded conditions? The IR process becomes part of business continuity, not just security operations.

Playbooks for the Future

Organizations begin rewriting their incident response plans with broader input. Legal, PR, HR, and compliance all have roles. Exercises simulate remote response, not just in-person war games. Documentation now includes dependency mapping and crisis communication templates.

Conclusion

May 2020 becomes a turning point for IR maturity. The crisis reveals gaps but also accelerates evolution. The incident response of the future is agile, distributed, human-aware, and cloud-integrated. Playbooks evolve from static documents to living frameworks tested by reality.

Eduardo Wnorowski is a network infrastructure consultant and Director.
With over 25 years of experience in IT and consulting, he helps organizations maintain stable and secure environments through proactive auditing, optimization, and strategic guidance.
LinkedIn Profile