The document discusses building an incident response program and timeline. It recommends having the right people, management support, a documented incident response process, supporting technology like logging and network segmentation, and ongoing training and testing. It also identifies different roles involved in incident response, such as IT personnel, management, law enforcement and press. The overall message is that organizations need to prepare and plan their incident response capabilities in advance through people, processes, technology and training in order to effectively respond when an incident occurs.

1. BYO-IR
Build your own ‘incident response’
Wim Remes - (ISC)2 - IOActive

2. --------RISK---------
COMPANY

3. IF
VS.
WHEN

4. Wim Remes - wim.remes@ioactive.co.uk
A B C D E F G
compromise detected
attack occured
window of compromise
THE IR TIMELINE(reality)
PANIC!!!

5. Wim Remes - wim.remes@ioactive.co.uk
A B C D E F G
compromise detected
attack occured
window of compromise response
THE IR TIMELINE(for the pathological optimist)

6. Wim Remes - wim.remes@ioactive.co.uk
A B C D E F G
compromise detected
attack occured
window of compromise
response
THE IR TIMELINE(how it should be)

7. Wim Remes - wim.remes@ioactive.co.uk
A B C D E F G
compromise detected
attack occured
window of compromise response
THE IR TIMELINE(for the pathological liar)

8. WHO’S WHO?
Executive Management
IT Management
IT Personnel
Wim Remes - wim.remes@ioactive.co.uk

9. WHO’S WHO?
Customers/Clients
Law Enforcement Press/Media
“The Angry Mob”
(Y U USE MD5?)
Wim Remes - wim.remes@ioactive.co.uk

10. IT Personnel
Customers/Clients
WHO’S WHO?
Wim Remes - wim.remes@ioactive.co.uk

11. Wim Remes - wim.remes@ioactive.co.uk

12. IR SHOPPING LIST
a. Awesome people!
b. Management Support (no kidding)
c. IR Process + RACI
d. Supporting Technology
e. Training & Test Drives
Wim Remes - wim.remes@ioactive.co.uk

13. AWESOME PEOPLE
(Without me, you are just aweso)
Wim Remes - wim.remes@ioactive.co.uk

14. AWESOME PEOPLE
(you already have them)
Wim Remes - wim.remes@ioactive.co.uk

15. MANAGEMENT
SUPPORT
Wim Remes - wim.remes@ioactive.co.uk

16. IR PROCESS
PREPARE DETECT ANALYZE CONTAIN RECOVER
POST MORTEM

17. Wim Remes - wim.remes@ioactive.co.uk
C,I A R
C,I R,A C,I
R C,I A
External Communications
Initiate IR Process
Collect Evidence
IR RACI

18. TECHNOLOGY
because you don’t go to war in a speedo ...

19. TECHNOLOGY
(it’s pretty basic really ...)
a. Segment your network !!
b. Use PGP (and train your people to use it)
c. Log everything you could possibly need
d. Full network captures are helpful!
e. How far can you take FOSS?
f. Complement with commercial products.
g. Train, train, train, train, train, train,...
(some demos)
Wim Remes - wim.remes@ioactive.co.uk

20. TRAINING & TEST
Wim Remes - wim.remes@ioactive.co.uk

21. In a real war you don’t fight soldiers with
cleaning ladies, you fight with soldiers. In a
cyberwar, you fight hackers with hackers.“
”Thank you
Wim Remes - wim.remes@ioactive.co.uk