Recommended
More Related Content
Similar to We Don't Always Go Lights and Sirens - Circle City Con 2017
Similar to We Don't Always Go Lights and Sirens - Circle City Con 2017 (20)
Recently uploaded
Recently uploaded (20)
We Don't Always Go Lights and Sirens - Circle City Con 2017
- 1. Kendra Cooley Circle City Con June 11, 2017 We Don’t Always Go Lights & Sirens
- 2. Who Am I TECHNICAL • B.S. Digital Forensics • CISSP • InfoSec Analyst – Duo Security • Incident Response • Security Awareness Training NON-TECHNICAL • Family • Mom of three… fur babies • Memorizing movie lines • Searching for new music • DIY projects • Taking naps Kendra Cooley - @4n6Kendra
- 3. objective Make Incident Response (IR) more relatable
- 4. What to expect • High-level overview of IR • Focus on triage • A new perspective • Awesome pictures… some blood • Corny jokes
- 6. Detection Reporting Triage Analysis Containment Mitigation Follow-up Tell somebody Something happened Set the pace What happened Stop the thing Fix the problem Learn from it
- 7. Detection Reporting Triage Analysis Containment Mitigation Follow-up Tell somebody Something happened Set the pace What happened Stop the thing Fix the problem Learn from it
- 8. The goals are the same 1. Identify the problem 2. Prevent further damage 3. Fix what is broken
- 9. WE ARE FIRST RESPONDERS TOO!
- 10. NO TWO INCIDENTS ARE THE SAME
- 11. Stop Relying on the Category INFOSEC Phish Malware SQL Injection Cross-Site Scripting Denial of Service Lost/Stolen Device EMS Car Accident Shooting Broken Bones Labor Heart attack Hangnail
- 12. Triage is critical • Focus on severity, not category • Identify the functional and informational impact • Properly assign resources
- 13. Why? • Category only tells us so much • Avoid ‘Too many hands in the pot’ • IR needs structure and organization
- 14. TRIAGE SETS THE pace
- 19. Detection & Reporting InfoSec EMS Tools People
- 23. Consider the following: InfoSec EMS False Alarm Panic/Fear Human LifeLivelihood
- 24. ASSESSING THE IMPACT INFOSEC FUNCTIONAL ARE CRITICAL FUNCTIONS DISRUPTED? INFORMATIONAL HAS DATA BEEN COMPROMISED? EMS SITUATION WHAT WAS REPORTED? SEVERITY IS IT LIFE THREATENING?
- 26. LET THE FUN BEGIN
- 27. Category: car accident Scenario 1 Caller witnessed a single car accident One passenger: male, 26 years of age Driver status: Out of the vehicle, fully coherent with a visibly broken wrist
- 28. LOW PRIORITY Additional resources not needed Urgency is low Non-life threatening
- 29. Category: car accident Scenario 2 Caller witnessed a car accident One passenger: male, 26 years of age Driver status: Out of the vehicle. Complaining of dizziness. Laceration to left side of his head
- 30. Medium PRIORITY Additional resources may be needed Urgency is increased Condition of patient could rapidly change
- 31. Category: car accident Scenario 3 Caller witnessed a single car accident One passenger: male, mid-twenties Driver status: Unconscious
- 32. High PRIORITY Additional resources are likely needed Urgency is high Patient’s life is at stake
- 34. Category: Phishing campaign Scenario 1 Employee reports a suspicious email They did not click any links or open attachments
- 35. LOW PRIORITY Additional resources not needed Urgency is low No risk to business functions or data
- 36. Category: Phishing campaign Scenario 2 Employee reports a suspicious email immediately after: • Clicking the link • Entering their credentials on a fake Google site
- 37. Medium PRIORITY Additional resources possibly needed Urgency is increased Credentials are compromised Without action, the situation could get worse
- 38. Category: Phishing campaign Scenario 3 Employee reports odd email activity What they know: • Hundreds of emails have been sent from their account containing an attachment
- 39. High PRIORITY Account is compromised Additional resources are necessary for damage control Urgency is high
- 40. Spotting the similarities Priority Level Car Accident Phishing Campaign High LIGHTS AND SIRENS Additional resources needed ‘Worst case’ scenario Medium LIGHTS AND SIRENS Additional resources may be needed Scenario could potentially get worse Low Additional resources not needed Unlikely to cause further damage Something else could take priority over this
- 41. Why does this matter? A new perspective Seemingly similar categories resulted in extremely responses
- 42. WE CAN’T WORK EVERY INCIDENT AT 100 MPH.
- 43. But wait, there’s more
- 44. Priority can change at any time
- 46. How can we improve? MANAGERS • Support your Analysts • Implement a strong IR process • Organize your resources • Put more emphasis on triage • Be flexible ANALYSTS • Trust your gut • Focus less on the category • Understand the information in front of you • Be flexible
- 47. Key Takeaways • Triage is more than categorization • Triage sets the tone for the rest of the process • Treat each situation as unique • Not every incident requires ‘lights and sirens’
- 48. Thank you!! Kendra Cooley @4n6Kendra Ken4n6dra@gmail.com We Don’t Always Go Lights & Sirens