The document summarizes the key steps that occur in the first 24 hours after a data breach is detected: 1) Getting the call - The breach is detected either internally or externally, causing a state of panic as the organization tries to contain the attack. External emergency response assistance is required due to limited internal resources. 2) Arrival on scene - The emergency response team arrives to begin investigation and remediation. They assess compromised systems and secure digital evidence while involving key stakeholders. Damage assessment reveals the attacker's penetration depth. 3) Crisis management - The executive team follows a breach plan, preparing PR, legal, and regulatory responses while ensuring an coherent message that does not trigger further issues. A breach tests

2. The First 24 Hours After a Breach
By Ondrej KREHEL
Paul Kubler
2

3. 3
ONDREJ KREHEL
CISSP, CEH, CEI
FOUNDER & CEO
DIGITAL FORENSICS LEAD
LIFARS, LLC
Twitter: @LIFARSLLC
LIFARS is a NYC-based Digital
Forensics, Incident Response, and
Cybersecurity Intelligence firm.

4. 4
PAUL KUBLER
CISSP, EnCE, CCNA, Sec+, ACE
Digital Forensics Examiner
LIFARS, LLC
Twitter: @LIFARSLLC
LIFARS is a NYC-based Digital
Forensics, Incident Response, and
Cybersecurity Intelligence firm.

6. 6

7. Agenda
1 Getting the Call
2 Arrival on the Scene
3 Crisis Management
4 Evidence Collection & Remediation
5 Q&A

8. Ever Wonder What Happened Before
You Saw These in the News?

10. Getting the Call
» Detection of a Breach
• By the internal IT/security team
• By an outside organization
» State of Panic
• Unprepared to deal with a breach
• Try to contain the attack internally

12. Getting the Call (continued)
» Internal IT team is heavily utilized
• External assistance required
» Race against time
• High pressure to stop “cyberbleeding” and
minimize the impact
• Effectively engage a third party emergency
response team

14. Arrival on the Scene
» Emergency response team arrives
• Investigation and remediation begins
» Primary objectives
• Understand attacker profile and motives
• Assess compromised systems state
• Secure digital evidence
• Involve key decision tenants

15. IT’S ABOUT TIME FOR SOME…
“INVESTIGATION”

16. Arrival on the Scene
» Damage Assessment
• Of business and technological areas
• Reveals how deeply the attacker was able to
penetrate the network
• Examination of lateral movement of the attacker

18. Crisis Management
Executive table follows a data breach plan and
prepares:
» PR/Privacy/Legal actions needed to cover the
enterprise responses to:
• The public
• The regulators
• The partners
» Wrong message can trigger an avalanche

20. Crisis Management
» Data Breach:
• Is a C-Suite exercise that tests:
- Coherence and conciseness of the incident response
preparedness
- Ability of the enterprise to function in crisis mode
• Unfortunately is a live exercise (and comes at a
high price)

22. Evidence Collection & Remediation
» Forensic team collects available evidence
• Performs initial analysis
• Preserves additional evidence
» Informs the board of initial findings
• Actions need to be weighted carefully
• Aggressive moves can have negative effects (attackers
still inside the network)

24. Evidence Collection & Remediation
» With hackers in the system
• Each blocking action needs to be closely
monitored
• Remediation can detected by attacker and
evidence and data put at risk
» Securing the environment can take years
• Scheduling necessary changes with key internal
tenants is a difficult task

25. Q&A

26. THANK YOU