Management of Information Security CYBR 3300 - Chapter 10 Planning for Contingencies
Predefining incident responses
What enables the organization to react to a detected incident quickly and effectively, without confusion or wasted time and effort
crisis management team
Who is responsible for managing the event from an enterprise perspective and performs the following roles: •Supporting personnel and their loved ones during the crisis •Keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise •Communicating with major customers, suppliers, partners, regulatory agencies, industry organizations, the media, and other interested parties
A senior IT or Infosec manager working closely with the CSIRT and DR team leads
Who makes the reclassification from incident to disaster?
contingency planning (CP)
*The overall process of preparing for unexpected adverse events.* The actions taken by senior management to specify the organization's efforts and actions if an adverse event becomes an incident or disaster. This planning includes incident response, disaster recovery, and business continuity efforts, as well as preparatory business impact analysis. *Business Impact Analysis *Incident Response Plan *Disaster Recovery Plan *Business Continuity Plan
The elements required to begin the CP process are
1. A planning methodology 2. A policy environment to enable the planning process 3. An understanding of the causes and effects of core precursor activities (the BIA) 4. Access to financial and other resources, as outlined in the planning budget
Five stages of CSF
1. Identify--relates to RM and governance 2. Protect--Relates to implementation of effective sec controls 3. Detect--Identification of adverse events 4. Respond--Reacting to an incident 5. Recover--Putting things as they were before
electronic vaulting
A backup method that uses bulk batch transfer of data to an off-site facility; this transfer is usually conducted via leased lines or secure Internet connections.
database shadowing
A backup strategy to store duplicate online transaction data along with duplicate databases at the remote site on a redundant server. This server combines electronic vaulting with remote journaling by writing multiple copies of the database simultaneously to two locations
service bureau
A continuity strategy in which an organization contracts with a service agency to provide a BC facility for a fee.
mutual agreement
A continuity strategy in which two organizations sign a contract to assist the other in a disaster by providing BC facilities, resources, and services until the organization in need can recover from the disaster.
rolling mobile site
A continuity strategy that involves contracting with an organization to provide specialized facilities configured in the payload area of a tractor-trailer
digital malfeasance
A crime against or using digital media, computer technology, or related components; in other words, a computer is the source of a crime or the object of a crime.
Alert Message
A description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process
after-action review
A detailed examination and discussion of the events that occurred during an incident or disaster, from first detection to final recovery.
Alert Roster
A document that contains contact information for people to be notified in the event of an incident
warm site
A facility that provides many of the same services and options as a hot site, but typically without installed and configured software applications Warm sites are used for BC operations
cold site
A facility that provides only rudimentary services, with no computer hardware or peripherals Used for BC operations
talk-through
A form of structured walk-through in which individuals meet in a conference room and discuss a CP plan rather than walking around the organization
continuous process improvement (CPI)
A formal implementation of the "iteration results in improvement" methodology is a process known as •Each time the plan is rehearsed it should be improved •Constant evaluation and improvement leads to an improved outcome
hot site
A fully configured facility that includes all services, communications links, and physical plant operations Used for BC operation
business process
A task performed by an organization or one of its units in support of the organization's overall mission AKA Mission/business process
evidentiary material (EM)
Also known as "items of potential evidentiary value," any information that could potentially support the organization's legal or policy-based case against a suspect.
computer security incident response team (CSIRT)
An IR team composed of technical IT, managerial IT, and InfoSec professionals who are prepared to detect, react to, and recover from an incident. The CSIRT may include members of the IRPT.
incident
An adverse event that could result in a loss of information assets, but does not threaten the viability of the entire organization When an adverse event begins to manifest as a real threat to information, it becomes
adverse event
An event with negative consequences that could threaten the organization's information assets or operations When those events represent the potential for loss, AKA incident candidate
business impact analysis (BIA)
An investigation and assessment of the various adverse events that can affect the organization conducted as a preliminary phase of the contingency planning process, which includes a determination of how critical a system or set of information is to the organization's core processes and recovery priorities. The first major component of the CP process Scope, Plan, Balance, Objective, Follow-Up Crucial foundation for the initial planning stages serves as an investigation and assessment of the impact that various adverse events can have on the organization
crisis management (CM)
An organization's set of planning and preparation efforts for dealing with potential human injury, emotional trauma, or loss of life as a result of a disaster
BC policy
BCP begins with the development of the Reflects the organization's philosophy on the conduct of BC operations Serves as the guiding document for the development of the BCP
Flexibility
CPMT should incorporate a degree of what into the plan?
incident response procedures (IR procedures)
Detailed, step-by-step methods of preparing,detecting, reacting to, and recovering from an incident
slow-onset disasters
Disasters that occur over time and gradually degrade the capacity of an organization to withstand their effects. Examples include droughts, famines, environmental degradation, desertification, deforestation, and pest infestation
possible probable definite
Donald Pipkin has identified three categories of incident indicators
Preservation of human life
During a disaster response, the first priority is always the what?
DR Plan
Focuses on restoring operations at the primary site
IR plan
Focuses on the immediate response to an incident
•the organization is unable to contain or control the impact of an incident the level of damage or destruction from an incident is so severe the organization is unable to quickly recover
In general, an incident is a disaster when
set of policies, procedures, technologies, people, and data put in place to prevent, detect, react to, and recover from an incident that could potentially damage the organization's information
In other, more formal implementations, the CSIRT is a
•stopping the incident •recovering control of the affected systems
Incident containment strategies focus on two tasks
3-2-1 rule
Industry recommendation for data backup three copies of important data on at least two different media, with at least one copy stored off-site, and daily on-site backups
improvement
Iteration results in
•Clear delegation of roles and responsibilities •Execution of the alert roster and notification of key personnel •Clear establishment of priorities •Documentation of the disaster •Action steps to mitigate the impact •Alternative implementations for the various systems components
Key elements in the DR plan
•Purpose •Scope •Roles and responsibilities •Resource requirements •Training requirements •Exercise and testing schedules •Plan maintenance schedule •Special considerations
Key elements of the DR policy
Simple DR plan
Means of collecting the info needed to construct a functional DR plan Nine major sections
1.Form the BC Team 2.Develop the BC planning policy statement 3.Review the BIA 4.Identify preventive controls 5.Create relocation strategies 6.Develop the BC plan 7.Ensure BC plan testing, training and exercises 8.Ensure BC plan Maintenance
NIST SP 800-34, Rev. 1 methodology can also be adapted to BC
Recovery process
Once the extent of the damage has been determined, this begins
incident recovery phase
Once the incident has been contained, and system control regained, what can begin? the first task is to inform the appropriate human resources •Almost simultaneously, the CSIRT must assess the full extent of the damage so as to determine what must be done to restore the systems
•After the incident
One of the sets of incident-handling procedures After drafting the procedures, planners develop and document the procedures that must be performed after the incident has ceased
•Before the incident
One of the sets of incident-handling procedures Planners draft third set of procedures; those tasks to be performed to prepare for the incident - data backup schedules - DR prep - training schedules - testing plans - copies of service agreements - BC plans, if any -- just additional material on a service bureau
•During the incident
One of the sets of incident-handling procedures The planners develop and document the procedures that must be performed during the incident Procedures are grouped and assigned to individuals
detailed understanding of the information systems and the threats they face
Planning for an incident and the responses to it requires a
BIA
Preparatory activity common to both CP and risk management Helps orgs determine which business functions and info systems are the most critical to the success of the organization Provides the data used to develop the IR plan
incident candidate
See adverse event
affidavit
Sworn testimony that certain facts are in the possession of the investigating officer and that they warrant the examination of specific items located at a specific place. The facts, the items, and the place must be specified in this document
structured walk-through
The CP testing strategy in which all involved individuals walk through and discuss the steps they would take during an actual CP event, either as an actual on- site walk- through or as more of a conference room talk- through
full-interruption testing
The CP testing strategy in which the all team members follow each and every IR/DR/BC procedure, including the interruption of service, restoration of data from backups, and notification of appropriate individuals.
simulation
The CP testing strategy in which the organization conducts a role-playing exercise as if an actual incident or disaster had occurred. The CP team is presented with a scenario in which all members must specify how they would react and communicate their efforts
the participation and cooperation of individuals throughout the organization
The CSIRT's success depends on
disaster recovery planning (DRP)
The actions taken by senior management to develop and implement the DR policy, plan, and recovery teams
business resumption planning (BRP)
The actions taken by senior management to develop and implement a combined DR and BC policy, plan, and set of recovery teams.
business continuity planning (BCP)
The actions taken by senior management to develop and implement the BC policy, plan, and continuity teams
crisis management planning (CMP)
The actions taken by senior management to develop and implement the CM policy, plan, and response teams.
work recovery time (WRT)
The amount of effort (expressed as elapsed time) that is necessary to get the business function operational after the technology element is recovered as identified with RTO typically involves the addition of nontechnical tasks required for the organization to make the info asset usable again for its intended function can be added to the RTO to determine the realistic amount of time elapsed required before a business function is back in useful service
remote journaling
The backup of data to an off-site facility in close to real time based on transactions as they occur.
forensics
The coherent application of methodical investigatory techniques to present evidence of crimes in a court or court-like setting. Forensics allows investigators to determine what happened by examining the results of an event—criminal, natural, intentional, or accidental
cost
The determining factor in choosing from several strategies in CP and BC planning is
policy; planning
The first step in all contingency efforts is the development of ______ The next step is ________
contingency planning management team (CPMT)
The group of senior managers and project members organized to conduct and lead all CP efforts.
incident detection
The identification and classification of an adverse event as an incident, accompanied by the CSIRT's notification and the implementation of the IR reaction phase.
e-discovery
The identification and preservation of evidentiary material related to a specific legal action.
incident damage assessment
The immediate determination of the scope of the breach of confidentiality, integrity, and availability of information and information assets Can take weeks or days Search system logs, intrusion detection logs, configuration logs, and other documents Using this info, the CSIRT can assess the curent state of the information and systems and compares it to a known state Those who document the damage must be trained to collect and preserve evidence
•Identify the vulnerabilities that allowed the incident to occur and spread and resolve them •Address the safeguards that failed to stop or limit the incident, or were missing from the system in the first place and install, replace or upgrade them •Evaluate monitoring capabilities (if present) •Restore the data from backups as needed •Restore the services and processes in use •Continuously monitor the system •Restore the confidence of the communities of interest
The incident recovery process includes
crisis management planning team (CMPT)
The individuals from various functional areas of the organization assigned to develop and implement the CM plan
CPMT
The initial assignments to the FR team, including the team lead, will likely be performed by which team?
recovery time objective (RTO)
The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported business processes, and the MTD. important for selecting appropriate techs that are best suited for meeting the MTD reducing this requires mechanisms to shorten the startup time or provisiont o make data available online at a failover site
Traditional data backups
The organization can use a combo of on-site and off-site tape-dirve and backup methods Recent data is potentially lost Most common: random array of independent disks (RAID) or disk-to-disk-to-tape methods
apprehend and prosecute
The organizational CP philosophy that focuses on an attacker's identification and prosecution, the defense of information assets, and preventing reoccurrence. Also known as "pursue and prosecute."
protect and forget
The organizational CP philosophy that focuses on the defense of information assets and preventing reoccurrence rather than the attacker's identification and prosecution. Also known as "patch and proceed."
the CIO Head of InfoSec Local infosec officer other IR teams system owners
The parties most commonly notified for an incident report are
disaster classification
The process of examining an adverse event or incident and determining whether it constitutes an actual disaster.
business continuity planning team (BCPT)
The team responsible for designing and managing the BC plan of relocating the organization and establishing primary operations at an alternate site until the disaster recovery planning team can recover the primary site or establish a new location
Scenario development and impact analysis
To plan for disasters, the CPMT engages in What two things are used to categorize the level of threat of each potential disaster?
•Natural disasters •Man-made disasters (most incidents)
Two classifications of disasters
weighted analysis table
can be useful in evaluating business functions and resolving the issue of what business functions are most critical CPMT can use this by first identifying crucial characteristics of each business function--the criteria The team then allocates relative weights to each criteria
The identification of critical business functions and the resources to support them
cornerstone of the BC plan
BIA questionnaire
instrument used to collect relevant business impact information for the required analysis
Shorter RTO means what kind of solutions?
more expensive to design and use require fully redundant alternative processing sites
BC plan
occurs concurrently with the DR plan if operations at the primary site cannot be quickly restored Enables the business to continue at an alternate site, until the org is able to resume operations at its primary site or select a new primary location
The essential task of IR
stop the incident and contain its scope or impact
The BIA begins with
the prioritized list of threats and vulnerabilities identified in the risk management process enhances the list by adding the information needed to respond to the adversity
•Mission •Strategies and goals •Senior management approval •Organizational approach to incident response •How the incident response team will communicate •Metrics for measuring incident response capability and effectiveness •Roadmap for maturing incident response capability •How the program fits into the overall organization
•According to NIST SP 800-61, Rev. 2, the IR plan includes:
•Probable Indicators
•Activities at unexpected times •Presence of new accounts •Reported attacks •Notification from IDS
a loose or informal association of IT and InfoSec staffers who would be called up if an attack was detected on the organization's information assets
•In some organizations, the CSIRT may simply be
1.Detection 2.Reaction 3.Recovery
•Incident response actions can be organized into three basic phases:
reactive
•It is important to understand that IR is a _____ measure, not a preventative one, although most IR plans include preventative recommendations
Definite Indicators
•Use of dormant accounts •Changes to logs •Presence of hacker tools •Notifications by partner or peer •Notification by hacker
Protect and forget Apprehend and prosecute
•one of two philosophies that will affect its approach to IR and DR as well as subsequent involvement of digital forensics and law enforcement
rapid-onset disasters
Disasters that occur suddenly, with little warning, taking people's lives and destroying the means of production. Examples include earthquakes, floods, storm winds, tornadoes, and mud flows.
1. Personal emergency info - who to notify - medical conditions - form of ID 2. Instruction on what to do in case of an emergency - snapshot of DR plan - hotline number - emergency services number - evacuation locations - name and number of DR coordinator - any other needed info
Each employee should have what two types of emergency info cards in his or her possession at all times?
Digital Forensics
Investigations involving the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis. Like traditional forensics, digital forensics follows clear, well-defined methodologies but still tends to be as much art as science
Reaction phase
Once an actual incident has been confirmed and properly classified, the IR plan moves from the detection phase to the in this phase, a number of action steps taken by the CSIRT and others must occur quickly and may occur concurrently Other key personnel must be notified of the incident (general mgt) - members of legal, comms, and HR
cross-training
One often-neglected aspect of training is this In some cass, alternate people must perform the duties of personnel who have been incapacitated The testing process should train people to take over in the event that a team leader of integral member is unavailable
search warrant
Permission to search for evidentiary material at a specified location and/or to seize items to return to the investigator's lab for examination. An affidavit becomes a search warrant when signed by an approving authority
general business management IT community InfoSec community
Planning for an unexpected adverse event usually involves managers from They collectively analyze and assess the entire technological infrastructure of the organization using the mission statement and currently organization objs to drive their planning activities
NIST SP 800-34, Rev. 1: Contingency Planning Guide for Federal Information Systems
Professional practice in the area of contingency planning continues to revolve as reflected in the "It is critical that identified services provided by these systems are able to operate effectively without excessive interruption. Contingency Planning supports this requirement by establishing thorough plans, procedures, and technical measures that can enable a system to be recovered as quickly and effectively as possible following a service disruption"
desk check
The CP testing strategy in which copies of the appropriate plans are distributed to all individuals who will be assigned roles during an actual incident or disaster, with each individual reviewing the plan and creating a list of correct and incorrect components.
incident response planning (IRP)
The actions taken by senior management to specify the organization's processes and procedures to anticipate, detect, and mitigate the effects of an incident is the preparation IR is performed by the IRP team (IRPT)
crisis management plan (CM plan)
The document product of crisis management planning; a plan that shows an organization's intended efforts to protect its personnel and respond to safety threats
business continuity plan (BC plan):
The documented product of business continuity planning; a plan that shows the organization's intended efforts to continue critical functions when operations at the primary site are not feasible.
disaster recovery plan (DR plan)
The documented product of disaster recovery planning; a plan that shows the organization's intended efforts in the event of a disaster.
incident response plan (IR plan)
The documented product of incident response planning; a plan that shows the organization's intended efforts in the event of an incident. usually activated when the organization detects an incident that affects it, regardless of how minor the effect is
recovery point objective (RPO)
The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data. Not considered part of MTD Factor of how much data loss the process can tolerate Reducing this requires mechanisms to increase the syncing of data replication
incident response policy (IR policy)
The policy document that guides the development and implementation of IR plans and the formulation and performance of IR teams. NIST 800-61 Rev 2
business continuity policy (BC policy)
The policy document that guides the development and implementation of BC plans and the formulation and performance of BC teams
crisis management policy (CM policy)
The policy document that guides the development and implementation of CM plans and the formulation and performance of CM teams.
disaster recovery policy (DR policy)
The policy document that guides the development and implementation of DR plans and the formulation and performance of DR teams.
evidentiary material policy (EM policy)
The policy document that guides the development and implementation of EM procedures regarding the collection, handling, and storage of items of potential evidentiary value, as well as the organization and conduct of EM collection teams.
incident classification
The process of examining an incident candidate and determining whether it constitutes an actual incident.
Provide direction and guidance for all DR operation
The purpose of the DR program is to what?
the CISO, or an IT manager with security responsibilities
The responsibility for creating an organization's IR plan usually falls to Should select members from each CoI to form an independent IR team which executes the IR plan
disaster recovery planning team (DRPT)
The team responsible for designing and managing the DR plan by specifying the organization's preparation, response, and recover from disaster, including reestablishment of business operations at the primary site after the disaster
incident response planning team (IRPT)
The team responsible for designing and managing the IR plan by specifying the organization's preparation, reaction, and recovery from incidents
maximum tolerable downtime (MTD)
The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption includes all impact considerations.
•Remote journaling
Transfer live transactions to an offsite facility Transfer takes place online and is much closer to real time Only transactions are transferred, not archived data Involves online activities on a systems level where data is written to two locations simultaneously
Analyze the incident data Determine the impact of the incident Act appropriately to limit the damage to the organization Restore normal services
What do the incident handlers do?
people
When generating a DR scenario, start with the most important asset
defining how to reestablish operations at the location where the organization is usually located (primary site) Prepare to reestablish operations at the organization's primary location after a disaster or to establish operations at a new location if the primary site is no longer viable
key role of a DR Plan
Contingency Planning Policies
provide guidance on the structure of the subordinate teams and the philosophy of the organization,
•During the incident •After the incident •Before the incident
•For every incident scenario, the CP team creates three sets of incident-handling procedures:
•When undertaking the BIA, the organization should consider:
•Scope - which business units to cover - which systems to include - nature of risk being evaluated •Plan - assure proper data is collected •Balance - weigh the info available - facts vs. opinions •Objective - identify decision-making requirements - structure BIA to bring needed info •Follow-up - communicate to ensure support
•It is directed against information assets •It has a realistic chance of success •It threatens the confidentiality, integrity, or availability of information resources and assets
•When a threat becomes a valid adverse event, it is classified as an InfoSec incident if what three things are true?
timeshare
A continuity strategy in which an organization co-leases facilities with a business partner or sister organization A timeshare allows the organization to have a BC option while reducing its overall costs
•Appoint a clear chain of command with a specified individual in charge •Establish a central operations center •"Know their enemy" •Develop a comprehensive IR plan with containment strategies •Record IR activities at all phases •Document the events as they occur in a timeline •Distinguish incident containment from incident remediation (as part of reaction) •Secure and monitor networks and network devices •Establish and manage system and network logging •Establish and support effective anti-virus and antimalware solutions"
According to McAfee, CSIRTS commonly fail to
business continuity
An organization's set of efforts to ensure its long-term viability when a disaster precludes normal operations at the primary site. The organization temporarily establishes critical operations at an alternate site until it can resume operations at the primary site or select and occupy a new primary site.
disaster recovery (DR)
An organization's set of planning and preparation efforts for detecting, reacting to, and recovering from a disaster
incident response (IR)
An organization's set of planning and preparation efforts for detecting, reacting to, and recovering from an incident Most organizations have experience detecting, reacting to, and recovering from attacks, employee errors, service outages, and small-scale natural disasters, and are thus performing this What must be carefully planned and coordinated because organizations heavily depend on the quick and efficient containment and resolution of incidents?
•Verifying personnel status •Activating the alert roster Coordinating with emergency services
CMPT three primary responsibilities
•Business impact analysis (BIA) •Incident response plan (IR plan) •Disaster recovery plan (DR plan) •Business continuity plan (BC plan)
CP consists of four major components
CP policy
CPMT must receive guidance from executive management through this Defines the scope of the CP operations and establishes managerial intent Stipulates the responsibility for the development and operations of the CPMT in general May provide specifics on the constituencies of all CP-related teams
•Recover information assets that are salvageable from the primary facility after the disaster •Purchase or otherwise acquire replacement information assets from appropriate sources •Reestablish functional information assets at the primary site if possible or at a new primary site, if necessary
DRPT and DRRT responsibilities
effective backup strategies flexible hardware configurations
Data recovery requires what two things?