13- Describing the Incident Response Plan
2 tasks typically done during Incident Response Life Cycle
1. Document network topologies 2. Monitor security intelligence sources for latest threat info
Review
The organization should review the incident response plan at least annually to ensure that the organization is maturing the incident response capability, and fulfilling the goals for incident response.
CAT 6
Unconfirmed incidents that are potentially malicious or anomalous activity that is deemed by the reporting entity to warrant further review. Reporting not necessary.
Eradication and recovery possible tasks
-all traces of potentially malicious code are removed -changing passwords for accounts -user account changes -patching software -hardening systems -Data and software are restored from clean backup files
Incident response plan is used to
-prevent or minimize disruption of critical computing services -minimize loss of proprietary & confidential info -facilitate info exchange among groups responsible for security incidents
Preparation may include
1. Educating users to respond to security incidents quickly & correctly. 2. Developing & maintaining documentation, e.g., network diagrams, configuration standards. 3. Planning for data retention period, who does what during an incident, and setting up proper roles & responsibilities (RACI)
Incident Response Life Cycle [PIA CERLR]
1. Preparation 2. Identification 3. Analysis 4. Containment 5. Eradication & Recovery 6. Lessons Learned 7. Reporting
Analysis may include
1. Which networks, systems, or applications are affected? 2. Who or what originated the incident? 3. What tools or attack methods are being used? 4. Which vulnerabilities are being exploited?
Decision points for containment may include:
1. scope of incident? 2. type of device? 3. network reachability of device affected by the incident? 4. How quickly can the IR team can get containment in place? 5. How quickly is containment needed?
CAT 4
A person violates acceptable computing use policies. Timeframe to report is weekly.
FMEA- Failure Mode and Effects Analysis
A tool created in a spreadsheet to help anticipate what might go wrong with a product/process. This includes documenting how incident was handled, recommendations for better future response, & how to prevent a recurrence.
US-CERT 7 incident categories
CAT 0 Exercise/Network Defense Testing CAT 1 Unauthorized Access CAT 2 Denial of Service (DoS) CAT 3 Malicious Code CAT 4 Improper Usage CAT 5 Scans/Probes/Attempted Access CAT 6 Investigation
Lessons learned task
FMEA [Failure Mode and Effects Analysis]
Metrics
Metrics measure the incident response capability and its effectiveness. Time-to-detection, which is known as dwell time, is one of the most critical metrics in the organization. Dwell time is the concept that a host is compromised at a point in time and the compromise is not detected until some further point in time. Organizations should aim to continually decrease dwell time.
Communication
Representing the reporting phase of the incident response life cycle, the incident response team will continuously communicate with the rest of the organization and with other organizations.
During identification
SOC analyst or IR team may contact CERT/CC or other security intelligence sources, which track Internet security activity & have most current threat info.
CAT 3
Successful installation of malicious software (for example, virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are not required to report malicious logic that has been successfully quarantined by antivirus software. Timeframe to report is daily or within 1 hour of discovery/detection if widespread across agency
CAT 5
This category includes any activity that seeks to access or identify a federal agency computer, open ports, protocols, service, or any combination for later exploit. This activity does not directly result in a compromise or denial of service. Timeframe to report is monthly, except if system is classified, report within one (1) hour of discovery
Organization missions
This element describes how the incident response policy supports the overall missions of the organization.
Reporting
To CIO, the head of information security, the system owner, HR, public affairs, the legal department, and law enforcement
AAR- After Action Report
another term for "Lessons Learned"
CAT 2
attack that successfully prevents or impairs the normal authorized functionality of networks, systems, or applications by exhausting resources. This activity includes being the victim or participating in the DoS. Timeframe to report is Within 2 hours of discovery/detection, if the successful attack is still ongoing and the agency is unable to successfully mitigate activity.
The hardest and most important decision that is made during an incident=
containment
Benefit of a good incident response plan
faster recovery from security incidents
Incident classifications are typically based on
incident severity.
CAT 1
individual will gain logical or physical access without permission to a federal agency network, system, application, data, or other resource. Timeframe is Within 1 hour of discovery/detection
What should be the long term result after incident response plan matures and becomes more effective?
lower dwell time
HIPAA
protects PHI- protected health info
SOX- Sarbannes-Oxley
protects company's financial data and ensures its integrity
PCI DSS
protects credit card holder account data
The incident response plan
provides info to enable efficient recovery from security incidents
RACI=
responsible, accountable, consulted, and informed
CAT 0
used during state, federal, national, international exercises and approved activity testing of internal/external network defenses or responses. No timeframe because it's confidential.
What is needed in regard to incident response policy
•Buy-in from senior management before implementation •Communication •Metrics •Regular Review •Organization missions
Attack vectors
•External/removable media •Attrition: brute-force methods •Web: e.g., XSS •Email •Impersonation: e.g., spoofing, MITM •Improper usage: violation of acceptable usage policies by an authorized user. •Loss or theft of equipment •Other: attack that doesn't fit into another category.
Incident Response Policy Elements
•Mission, strategies, goals: determine the structure of the IR capability. •Incident response approach: need a team committed to IR role without a myriad of other IT or security responsibilities.
4 basic questions that each organization must answer when determining their incident response plan
•What are the assets that are being protected? •What are the threats to the assets? •How are threats detected? •How will the organization respond to threats?