Downloaded 34 times
Uploaded byBrian Honan
Preparing for Failure - Best Practise for Incident Response
This document discusses the importance of establishing an incident response team (IRT) to prepare for and respond to security breaches. It recommends setting up alerting mechanisms, identifying necessary tools, establishing standard operating procedures, agreeing on the IRT's authority, and forming external relationships. The document also stresses the importance of practicing incident response, reviewing processes, and continuously improving the IRT through lessons learned. Resources for setting up computer security incident response teams are provided.
More Related Content
Similar to Preparing for Failure - Best Practise for Incident Response
Preparing for Failure - Best Practise for Incident Response
- 1. Preparing for Failure- What to do When Your Security is Breached
- 2.
- 3. Why Care AboutInformation Security?
- 4.
- 5.
- 6. Controls Will beBypassed
- 7.
- 8. You In LineOf Fire
- 9. Why Improve IncidentResponse?
- 10.
- 11. Set up AlertingMechanisms
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22. More informationCSIRT Handbookhttp://www.cert.org/archive/pdf/csirt-handbook.pdfFormingan Incident Response Teamhttp://www.auscert.org.au/render.html?it=2252Incident Response White Paper – BH Consultinghttp://www.bhconsulting.ie/Incident%20Response%20White%20Paper.pdfRFC2350: Expectations for Computer Security Incident Responsehttp://www.rfc-archive.org/getrfc.php?rfc=2350Organisational Models for Computer Security Incident Response Teamshttp://www.cert.org/archive/pdf/03hb001.pdfThe SANS Institute’s Reading Roomhttp://www.sans.org/reading_room
- 23. More ResourcesGuidelines forEvidence Collection and Archiving (RFC 3227)http://www.ietf.org/rfc/rfc3227.txtResources for Computer Security IncidentResponse Teams (CSIRTs)http://www.cert.org/csirts/resources.htmlRFC 2196: Site Security Handbookhttp://www.faqs.org/rfcs/rfc2196.html ENISA Step by Step Guide for setting up CERTShttp://enisa.europa.eu/doc/pdf/deliverables/enisa_csirt_setting_up_guide.pdfCSIRT Case Classification (Example for enterprise CSIRT)http://www.first.org/resources/guides/csirt_case_classification.html
- 24.
Editor's Notes
- #3 The three certainties with regards to information securityDeath and TaxesYou will have an incident.How you respond to an incident will have a direct influence on the impact that incident may have to your costs, reputation and ability to conduct business.
- #5 Traditional focus on PreventionPoliciesFirewallsAnti-Virus SoftwareIntrusion Detection SystemsIf turned on !!Little Attention Paid to RespondingResponse Focus Primarily onVirusesMinor Policy Breaches
- #6 More solutions do not necessarily guarantee you are secure.Neither does more standards such as ISO 27001 or PCI DSS. Yes they will make your security more efficient and better, but you still will at some stage suffer a breach.
- #8 Traditional ResponseAdhocUnplannedDeal with it as it happensResults inProlonged incidentsIf You Know You Have Been AttackedLack of metrics and measurementsBad Guys & Gals getting awayInappropriate Response Can Result;Disclosure of confidential information.Prolonged recovery times.Lack of evidence for a criminal or civil case.Negative impact to the organisation’s image.Potential legal and/or compliance Issues.Potential Legal Cases from Third Party Organisations.Exposure to Legal/Libel Cases From Employees/Individuals.IT Manager Updating Their CV
- #9 IT Manager Updating Their CVInvariably IT get blamed for either letting the incident happen in the first place or for not responding appropriately
- #10 Structured and Formalised Response provides;Positive Security PostureIncidents Dealt with Quickly, Efficiently and EffectivelyRapid and Accurate Assessment of IncidentsChoosing Most Appropriate Response.Shortened Recovery Times.Minimised Business Disruption.Confidence to Proceed with a Court Case.Regulatory and Legal Compliance.Potential Reduction in Incidents.Accurate Reporting and Metrics
- #11 ComposedInformation SecurityOperationsHuman ResourcesLegalPublic RelationsFacilities ManagementUnder Control of Information Security
- #12 Log filesNetwork DevicesPeopleNot just via the support deskBaseliningWhat is the norm for your network?ExternalVulernability ListsPartnersThird Parties
- #13 Forensics SoftwareCommercial vs. Open SourceIncident Tracking & RecordingDigital SignaturesSpare MediaBackupsEvidence bagsEvidence formsPhysical EvidenceCCTV, Swipe Card accessNetwork Sniffers Centralised Time SourceTraining CoursesNotebooksDigital CameraOut of Band CommunicationsEmail may be compromisedSupport System may be compromisedWar RoomSecure StorageCoffee!!
- #15 How are Incidents Reported?Incident ClassificationProcedures in Place for Expected IncidentsProcedures in Place for Unexpected IncidentsWho declares an Incident?Who to involve and when?Team available 24x7?Escalation TreeTypical ProceduresMalware/Computer Virus infectionExternal Unauthorised Access to SystemsInternal Unauthorised Access to SystemsTheft of Computer Equipment and Related Data.Discovery of Illegal Content on Company’s ResourcesSerious Breach of the AUPMinor Breach of the AUPWebsite Defacement.Denial of Service Attack.Email Flood Attack.Third Party Compromise.Disclosure of Confidential Information.
- #16 Incidents Can Occur 24x7What takes Priority?Mitigate the impact of IncidentGather as Much Evidence As PossibleRestore SystemsWhat Authority has IRT teamE.g. Take systems offlineIntegrate with Business ContinuityCan IRT invoke Business Continuity Plan?Integrate With Other ProcessesChange Control etc.Security vs Service !!
- #17 Some Skills not available In-houseLegalForensicsPublic RelationsAgree Terms & Conditions before an IncidentSuppliersISPs, Telecomms, HostingPartnersCustomersAn Garda SiochanaGarda Computer Crime UnitPart of Garda Bureau of Fraud InvestigationHow do you Report a Computer Crime?Contact Local Garda StationRefer to Garda Computer Crime UnitWhen Should You Contact Garda Computer Crime UnitToday !!Do the above before you have an incident as it is not something you want to negotiate in the middle of responding to an incident or breach.
- #18 Run Practise Drills.Identify Weaknesses in IR.Review Effectiveness of Incident Response.Ensure Everyone Aware of Roles & Responsibilities.Regularly Test Network for Vulnerabilities.Regularly Normalise Network & Systems.Test Staff Awareness.Test Management Awareness.Can you contact everyone when you need to?For example will the network engineer in their twenties who is single be available to respond at 10 p.m. on a Friday night? How about the manager who has to do the school run in the morning?
- #19 Formal Post Incident ReviewDocument OutcomesImplement RecommendationsMeasure IncidentsNumber of Incidents by ClassificationCosts of IncidentsTiming of IncidentsCorrelate with Real World EventsAnnual Report, Press Releases etc.Integrate With Other ProcessesRisk AssessmentTrainingBusiness Continuity Planning
- #21 Data Breach Code of Practise – NOT MANDATORY !!!Despite the Data Protection Act, many companies are still not adhering to best practises.Recent headlines highlight that many organisations are still not taking adequate steps to protect the personal information of their staff and/or customers. HSE – stolen laptops Bank of Ireland – stolen laptopsJobs.ie – website hacked Online Irish Retailer – website hacked exposing credit card detailsIn the main consumers are not made aware that breaches occur. This leaves them at greater risk of fraud as they do not know if they should be taking precautionary steps to protect themselves.
- #22 Balance needs to be achieved