SlideShare a Scribd company logo
1 of 11
Copyright © 2012, Elsevier Inc. All Rights Reserved
Chapter 11
Response
Cyber Attacks
Protecting National Infrastructure, 1st ed.
‹#›
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
1
Incident response process is the most familiar component of any
cyber security program
A cyber security program will contain at least the following
Incident trigger
Expert gathering
Incident analysis
Response activities
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Introduction
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
2
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.1 – General incident response process schema
‹#›
There are two fundamental types of triggers
Tangible, visible effects of an attack
Early warning and indications information
Thus, two approaches to incident response processes
Front-loaded prevention
Back-loaded recovery
The two approaches should be combined for comprehensive
response picture
Protecting national assets is worth suffering a high number of
false positives
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Pre- Versus Post-Attack Response
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
4
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.2 – Comparison of front-loaded and back-loaded
response processes
‹#›
Front-loaded prevention critical to national infrastructure
protection
Taxonomy of early warning process triggers
Vulnerability information
Changes in profiled behavioral metrics
Match on attack metric pattern
Component anomalies
External attack information
Front-loaded prevention have a high sensitivity to triggers
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Indications and Warning
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
6
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.3 – Comparison of trigger intensity threshold for
response
‹#›
Optimal incident response team includes two components
A core set of individuals
A set of subject matter experts
In complex settings, with multiple incidents, important for team
to not work at cross-purposes
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Incident Response Teams
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
8
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.4 – Management of simultaneous response cases
‹#›
Response teams in a national setting must plan for multiple
concurrent attacks aimed at a company or agency
Considerations for proper planning include
Avoidance of a single point of contact individual
Case management automation
Organizational support for expert involvement
24/7 operational support
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Incident Response Teams
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
10
Questions addressed in the forensic analysis process include
Root cause
Exploits
State
Consequences
Action
Great care must be taken to protect and preserve evidence
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Forensic Analysis
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
11
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.5 – Generic high-level forensic process schema
‹#›
Internal expert most likely the best to lead a company
investigation
Root Cause
Exploits
State
Consequences
Action
Forensic analysts need the following
Culture of relative freedom
Access to interesting technology
Ability to interact externally
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Forensic Analysis
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
13
Should law enforcement be involved and called upon for
support?
Carefully review local, regional, and national laws regarding
when law enforcement must be contacted
Figure 11.6 outlines a decision process
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Law Enforcement Issues
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
14
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.6 – Decision process for law enforcement involvement
in forensics
‹#›
Three Components of a Disaster Recovery Program
Preparation
Planning
Practice
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Disaster Recovery
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
16
Fig. 11.7 – Disaster recovery exercise configurations
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
‹#›
National programs can provide centralized coordination
Intrasector coordination should be encouraged
Currently, coordination is not the main focus of most national
emergency response team programs
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
National Response Program
‹#›
The University of Adelaide, School of Computer Science
12 August 2019
Chapter 2 — Instructions: Language of the Computer
18
Copyright © 2012, Elsevier Inc. All rights Reserved
Chapter 11 – Response
Fig. 11.8 – National response program coordination interfaces
‹#›

More Related Content

Similar to Copyright © 2012, Elsevier Inc. All Rights ReservedChapter 11.docx

11Copyright © 2012, Elsevier Inc. All Rights Reserved
11Copyright © 2012, Elsevier Inc. All Rights Reserved11Copyright © 2012, Elsevier Inc. All Rights Reserved
11Copyright © 2012, Elsevier Inc. All Rights Reserved
MargenePurnell14
 
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
aulasnilda
 
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
RAJU852744
 
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docxWeek 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
helzerpatrina
 
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
aulasnilda
 
Lecture # 1 foundation
Lecture # 1 foundationLecture # 1 foundation
Lecture # 1 foundation
Bich Lien Pham
 
Lecture # 1 foundation
Lecture # 1 foundationLecture # 1 foundation
Lecture # 1 foundation
Bich Lien Pham
 
case analysis 2.1.docxby Urusha PandeySubmission date 2.docx
case analysis 2.1.docxby Urusha PandeySubmission date 2.docxcase analysis 2.1.docxby Urusha PandeySubmission date 2.docx
case analysis 2.1.docxby Urusha PandeySubmission date 2.docx
cowinhelen
 
Unit 3 DiscussionIdentification & Cost Estimation            T.docx
Unit 3 DiscussionIdentification & Cost Estimation            T.docxUnit 3 DiscussionIdentification & Cost Estimation            T.docx
Unit 3 DiscussionIdentification & Cost Estimation            T.docx
ouldparis
 

Similar to Copyright © 2012, Elsevier Inc. All Rights ReservedChapter 11.docx (20)

11Copyright © 2012, Elsevier Inc. All Rights Reserved
11Copyright © 2012, Elsevier Inc. All Rights Reserved11Copyright © 2012, Elsevier Inc. All Rights Reserved
11Copyright © 2012, Elsevier Inc. All Rights Reserved
 
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
 
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
11Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
 
2012 IBM Tech Trends Report: Fast track to the future
2012 IBM Tech Trends Report: Fast track to the future2012 IBM Tech Trends Report: Fast track to the future
2012 IBM Tech Trends Report: Fast track to the future
 
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docxWeek 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
Week 5Read Chapter 7- DiscretionListen to Week 5 LecturePa.docx
 
10. implementation (4) risk management
10. implementation (4)   risk management 10. implementation (4)   risk management
10. implementation (4) risk management
 
Schwalbe-11ProjectRisk.ppt
Schwalbe-11ProjectRisk.pptSchwalbe-11ProjectRisk.ppt
Schwalbe-11ProjectRisk.ppt
 
Getting Started with Android Programming
Getting Started with Android ProgrammingGetting Started with Android Programming
Getting Started with Android Programming
 
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
1Copyright © 2012, Elsevier Inc. All Rights Reserved.docx
 
Lecture # 1 foundation
Lecture # 1 foundationLecture # 1 foundation
Lecture # 1 foundation
 
Lecture # 1 foundation
Lecture # 1 foundationLecture # 1 foundation
Lecture # 1 foundation
 
Business Disaster Management PowerPoint Presentation Slides
Business Disaster Management  PowerPoint Presentation SlidesBusiness Disaster Management  PowerPoint Presentation Slides
Business Disaster Management PowerPoint Presentation Slides
 
(XIMB) Sustainability - Computer Software Industry
(XIMB) Sustainability - Computer Software Industry(XIMB) Sustainability - Computer Software Industry
(XIMB) Sustainability - Computer Software Industry
 
lecture24.ppt
lecture24.pptlecture24.ppt
lecture24.ppt
 
case analysis 2.1.docxby Urusha PandeySubmission date 2.docx
case analysis 2.1.docxby Urusha PandeySubmission date 2.docxcase analysis 2.1.docxby Urusha PandeySubmission date 2.docx
case analysis 2.1.docxby Urusha PandeySubmission date 2.docx
 
Application Security on Production Environment
Application Security on Production EnvironmentApplication Security on Production Environment
Application Security on Production Environment
 
DevOps Indonesia - DevSecOps - Application Security on Production Environment
DevOps Indonesia - DevSecOps - Application Security on Production EnvironmentDevOps Indonesia - DevSecOps - Application Security on Production Environment
DevOps Indonesia - DevSecOps - Application Security on Production Environment
 
Unit 3 DiscussionIdentification & Cost Estimation            T.docx
Unit 3 DiscussionIdentification & Cost Estimation            T.docxUnit 3 DiscussionIdentification & Cost Estimation            T.docx
Unit 3 DiscussionIdentification & Cost Estimation            T.docx
 
The Outlook is Cloudy
The Outlook is CloudyThe Outlook is Cloudy
The Outlook is Cloudy
 
Cs207 1
Cs207 1Cs207 1
Cs207 1
 

More from bobbywlane695641

Assignment 2 FederalismThe system of federalism was instituted wi.docx
Assignment 2 FederalismThe system of federalism was instituted wi.docxAssignment 2 FederalismThe system of federalism was instituted wi.docx
Assignment 2 FederalismThe system of federalism was instituted wi.docx
bobbywlane695641
 
Assignment 2 FederalismThe system of federalism was instituted .docx
Assignment 2 FederalismThe system of federalism was instituted .docxAssignment 2 FederalismThe system of federalism was instituted .docx
Assignment 2 FederalismThe system of federalism was instituted .docx
bobbywlane695641
 
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docxAssignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
bobbywlane695641
 
Assignment 2 Evidence Based PracticeAccording to the Council .docx
Assignment 2 Evidence Based PracticeAccording to the Council .docxAssignment 2 Evidence Based PracticeAccording to the Council .docx
Assignment 2 Evidence Based PracticeAccording to the Council .docx
bobbywlane695641
 
Assignment 2 Evidence Based PracticeAccording to the Council on.docx
Assignment 2 Evidence Based PracticeAccording to the Council on.docxAssignment 2 Evidence Based PracticeAccording to the Council on.docx
Assignment 2 Evidence Based PracticeAccording to the Council on.docx
bobbywlane695641
 
Assignment 2 Examining DifferencesIn this module, we examined cri.docx
Assignment 2 Examining DifferencesIn this module, we examined cri.docxAssignment 2 Examining DifferencesIn this module, we examined cri.docx
Assignment 2 Examining DifferencesIn this module, we examined cri.docx
bobbywlane695641
 
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docxAssignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
bobbywlane695641
 
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docxAssignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
bobbywlane695641
 
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docxAssignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
bobbywlane695641
 
Assignment 2 E taxonomy· Information TechnologyInformatio.docx
Assignment 2 E taxonomy· Information TechnologyInformatio.docxAssignment 2 E taxonomy· Information TechnologyInformatio.docx
Assignment 2 E taxonomy· Information TechnologyInformatio.docx
bobbywlane695641
 
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docxAssignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
bobbywlane695641
 
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docxAssignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
bobbywlane695641
 
Assignment 2 Discussion—Technology and GlobalizationYour Module.docx
Assignment 2 Discussion—Technology and GlobalizationYour Module.docxAssignment 2 Discussion—Technology and GlobalizationYour Module.docx
Assignment 2 Discussion—Technology and GlobalizationYour Module.docx
bobbywlane695641
 
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docxAssignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
bobbywlane695641
 

More from bobbywlane695641 (20)

Assignment 2 FederalismThe system of federalism was instituted wi.docx
Assignment 2 FederalismThe system of federalism was instituted wi.docxAssignment 2 FederalismThe system of federalism was instituted wi.docx
Assignment 2 FederalismThe system of federalism was instituted wi.docx
 
Assignment 2 FederalismThe system of federalism was instituted .docx
Assignment 2 FederalismThe system of federalism was instituted .docxAssignment 2 FederalismThe system of federalism was instituted .docx
Assignment 2 FederalismThe system of federalism was instituted .docx
 
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docxAssignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
Assignment 2 Evidence Based Practice at Good Seed Drop-InAcco.docx
 
Assignment 2 Evidence Based PracticeAccording to the Council .docx
Assignment 2 Evidence Based PracticeAccording to the Council .docxAssignment 2 Evidence Based PracticeAccording to the Council .docx
Assignment 2 Evidence Based PracticeAccording to the Council .docx
 
Assignment 2 Evidence Based PracticeAccording to the Council on.docx
Assignment 2 Evidence Based PracticeAccording to the Council on.docxAssignment 2 Evidence Based PracticeAccording to the Council on.docx
Assignment 2 Evidence Based PracticeAccording to the Council on.docx
 
Assignment 2 Examining DifferencesIn this module, we examined cri.docx
Assignment 2 Examining DifferencesIn this module, we examined cri.docxAssignment 2 Examining DifferencesIn this module, we examined cri.docx
Assignment 2 Examining DifferencesIn this module, we examined cri.docx
 
Assignment 2 Ethics and Emerging TechnologiesRead the following.docx
Assignment 2 Ethics and Emerging TechnologiesRead the following.docxAssignment 2 Ethics and Emerging TechnologiesRead the following.docx
Assignment 2 Ethics and Emerging TechnologiesRead the following.docx
 
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docxAssignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
Assignment 2 Ethical Issues and Foreign InvestmentsBy Friday, A.docx
 
Assignment 2 Ethical BehaviorIdentify a case in the news that y.docx
Assignment 2 Ethical BehaviorIdentify a case in the news that y.docxAssignment 2 Ethical BehaviorIdentify a case in the news that y.docx
Assignment 2 Ethical BehaviorIdentify a case in the news that y.docx
 
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docxAssignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
Assignment 2 Ethical (Moral) RelativismIn America, many are comfo.docx
 
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docxAssignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
Assignment 2 Essay Power in Swift and Moliere Both Moliere and S.docx
 
Assignment 2 E taxonomy· Information TechnologyInformatio.docx
Assignment 2 E taxonomy· Information TechnologyInformatio.docxAssignment 2 E taxonomy· Information TechnologyInformatio.docx
Assignment 2 E taxonomy· Information TechnologyInformatio.docx
 
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docxAssignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
Assignment 2 Dropbox AssignmentCurrent Trends and Issues in Manag.docx
 
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docxAssignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
Assignment 2 Discussion—The Impact of CommunicationRemember a tim.docx
 
Assignment 2 Discussion—Technology and GlobalizationYour Module.docx
Assignment 2 Discussion—Technology and GlobalizationYour Module.docxAssignment 2 Discussion—Technology and GlobalizationYour Module.docx
Assignment 2 Discussion—Technology and GlobalizationYour Module.docx
 
Assignment 2 Discussion—Providing GuidanceThe Genesis team has re.docx
Assignment 2 Discussion—Providing GuidanceThe Genesis team has re.docxAssignment 2 Discussion—Providing GuidanceThe Genesis team has re.docx
Assignment 2 Discussion—Providing GuidanceThe Genesis team has re.docx
 
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docxAssignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
Assignment 2 Discussion—Munger’s Mental ModelsIn his article A L.docx
 
Assignment 2 DiscussionDuring the first year or two of its exis.docx
Assignment 2 DiscussionDuring the first year or two of its exis.docxAssignment 2 DiscussionDuring the first year or two of its exis.docx
Assignment 2 DiscussionDuring the first year or two of its exis.docx
 
Assignment 2 Discussion QuestionWorking in teams leads to complex.docx
Assignment 2 Discussion QuestionWorking in teams leads to complex.docxAssignment 2 Discussion QuestionWorking in teams leads to complex.docx
Assignment 2 Discussion QuestionWorking in teams leads to complex.docx
 
Assignment 2 Discussion Question Strong corporate cultures have.docx
Assignment 2 Discussion Question Strong corporate cultures have.docxAssignment 2 Discussion Question Strong corporate cultures have.docx
Assignment 2 Discussion Question Strong corporate cultures have.docx
 

Recently uploaded

會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
中 央社
 
Neurulation and the formation of the neural tube
Neurulation and the formation of the neural tubeNeurulation and the formation of the neural tube
Neurulation and the formation of the neural tube
SaadHumayun7
 
ppt your views.ppt your views of your college in your eyes
ppt your views.ppt your views of your college in your eyesppt your views.ppt your views of your college in your eyes
ppt your views.ppt your views of your college in your eyes
ashishpaul799
 
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
中 央社
 

Recently uploaded (20)

Morse OER Some Benefits and Challenges.pptx
Morse OER Some Benefits and Challenges.pptxMorse OER Some Benefits and Challenges.pptx
Morse OER Some Benefits and Challenges.pptx
 
Essential Safety precautions during monsoon season
Essential Safety precautions during monsoon seasonEssential Safety precautions during monsoon season
Essential Safety precautions during monsoon season
 
會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽會考英聽
 
Championnat de France de Tennis de table/
Championnat de France de Tennis de table/Championnat de France de Tennis de table/
Championnat de France de Tennis de table/
 
Neurulation and the formation of the neural tube
Neurulation and the formation of the neural tubeNeurulation and the formation of the neural tube
Neurulation and the formation of the neural tube
 
Features of Video Calls in the Discuss Module in Odoo 17
Features of Video Calls in the Discuss Module in Odoo 17Features of Video Calls in the Discuss Module in Odoo 17
Features of Video Calls in the Discuss Module in Odoo 17
 
Post Exam Fun(da) Intra UEM General Quiz - Finals.pdf
Post Exam Fun(da) Intra UEM General Quiz - Finals.pdfPost Exam Fun(da) Intra UEM General Quiz - Finals.pdf
Post Exam Fun(da) Intra UEM General Quiz - Finals.pdf
 
Navigating the Misinformation Minefield: The Role of Higher Education in the ...
Navigating the Misinformation Minefield: The Role of Higher Education in the ...Navigating the Misinformation Minefield: The Role of Higher Education in the ...
Navigating the Misinformation Minefield: The Role of Higher Education in the ...
 
2024_Student Session 2_ Set Plan Preparation.pptx
2024_Student Session 2_ Set Plan Preparation.pptx2024_Student Session 2_ Set Plan Preparation.pptx
2024_Student Session 2_ Set Plan Preparation.pptx
 
size separation d pharm 1st year pharmaceutics
size separation d pharm 1st year pharmaceuticssize separation d pharm 1st year pharmaceutics
size separation d pharm 1st year pharmaceutics
 
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdfINU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
 
Telling Your Story_ Simple Steps to Build Your Nonprofit's Brand Webinar.pdf
Telling Your Story_ Simple Steps to Build Your Nonprofit's Brand Webinar.pdfTelling Your Story_ Simple Steps to Build Your Nonprofit's Brand Webinar.pdf
Telling Your Story_ Simple Steps to Build Your Nonprofit's Brand Webinar.pdf
 
Matatag-Curriculum and the 21st Century Skills Presentation.pptx
Matatag-Curriculum and the 21st Century Skills Presentation.pptxMatatag-Curriculum and the 21st Century Skills Presentation.pptx
Matatag-Curriculum and the 21st Century Skills Presentation.pptx
 
Basic Civil Engineering notes on Transportation Engineering, Modes of Transpo...
Basic Civil Engineering notes on Transportation Engineering, Modes of Transpo...Basic Civil Engineering notes on Transportation Engineering, Modes of Transpo...
Basic Civil Engineering notes on Transportation Engineering, Modes of Transpo...
 
ppt your views.ppt your views of your college in your eyes
ppt your views.ppt your views of your college in your eyesppt your views.ppt your views of your college in your eyes
ppt your views.ppt your views of your college in your eyes
 
Word Stress rules esl .pptx
Word Stress rules esl               .pptxWord Stress rules esl               .pptx
Word Stress rules esl .pptx
 
An Overview of the Odoo 17 Discuss App.pptx
An Overview of the Odoo 17 Discuss App.pptxAn Overview of the Odoo 17 Discuss App.pptx
An Overview of the Odoo 17 Discuss App.pptx
 
Basic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & EngineeringBasic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
Basic Civil Engg Notes_Chapter-6_Environment Pollution & Engineering
 
Dementia (Alzheimer & vasular dementia).
Dementia (Alzheimer & vasular dementia).Dementia (Alzheimer & vasular dementia).
Dementia (Alzheimer & vasular dementia).
 
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文會考英文
 

Copyright © 2012, Elsevier Inc. All Rights ReservedChapter 11.docx

  • 1. Copyright © 2012, Elsevier Inc. All Rights Reserved Chapter 11 Response Cyber Attacks Protecting National Infrastructure, 1st ed. ‹#› ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 1 Incident response process is the most familiar component of any cyber security program A cyber security program will contain at least the following Incident trigger Expert gathering Incident analysis Response activities
  • 2. Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Introduction ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 2 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.1 – General incident response process schema ‹#› There are two fundamental types of triggers Tangible, visible effects of an attack Early warning and indications information Thus, two approaches to incident response processes Front-loaded prevention Back-loaded recovery The two approaches should be combined for comprehensive
  • 3. response picture Protecting national assets is worth suffering a high number of false positives Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Pre- Versus Post-Attack Response ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 4 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.2 – Comparison of front-loaded and back-loaded response processes ‹#› Front-loaded prevention critical to national infrastructure protection Taxonomy of early warning process triggers
  • 4. Vulnerability information Changes in profiled behavioral metrics Match on attack metric pattern Component anomalies External attack information Front-loaded prevention have a high sensitivity to triggers Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Indications and Warning ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 6 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.3 – Comparison of trigger intensity threshold for response ‹#›
  • 5. Optimal incident response team includes two components A core set of individuals A set of subject matter experts In complex settings, with multiple incidents, important for team to not work at cross-purposes Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Incident Response Teams ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 8 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.4 – Management of simultaneous response cases ‹#› Response teams in a national setting must plan for multiple
  • 6. concurrent attacks aimed at a company or agency Considerations for proper planning include Avoidance of a single point of contact individual Case management automation Organizational support for expert involvement 24/7 operational support Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Incident Response Teams ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 10 Questions addressed in the forensic analysis process include Root cause Exploits State Consequences Action Great care must be taken to protect and preserve evidence Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Forensic Analysis
  • 7. ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 11 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.5 – Generic high-level forensic process schema ‹#› Internal expert most likely the best to lead a company investigation Root Cause Exploits State Consequences Action Forensic analysts need the following Culture of relative freedom Access to interesting technology Ability to interact externally
  • 8. Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Forensic Analysis ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 13 Should law enforcement be involved and called upon for support? Carefully review local, regional, and national laws regarding when law enforcement must be contacted Figure 11.6 outlines a decision process Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Law Enforcement Issues ‹#› The University of Adelaide, School of Computer Science
  • 9. 12 August 2019 Chapter 2 — Instructions: Language of the Computer 14 Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.6 – Decision process for law enforcement involvement in forensics ‹#› Three Components of a Disaster Recovery Program Preparation Planning Practice Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Disaster Recovery ‹#› The University of Adelaide, School of Computer Science
  • 10. 12 August 2019 Chapter 2 — Instructions: Language of the Computer 16 Fig. 11.7 – Disaster recovery exercise configurations Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response ‹#› National programs can provide centralized coordination Intrasector coordination should be encouraged Currently, coordination is not the main focus of most national emergency response team programs Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response National Response Program ‹#› The University of Adelaide, School of Computer Science 12 August 2019 Chapter 2 — Instructions: Language of the Computer 18
  • 11. Copyright © 2012, Elsevier Inc. All rights Reserved Chapter 11 – Response Fig. 11.8 – National response program coordination interfaces ‹#›