All right, let's take a look at Module
19, which deals with incident response.
An extension of an incident response will
be our forensics discussion, which will be pretty involved.
So incident response, in a nutshell,
incident response and incident response policies are a determination of what bad
could happen, how bad would it be, and what do we do about it?
So we're going to sit around and say, Hey,
what type of security issues are we going to run into?
Well, we're going to have port scans, network reconnaissance, we're going to
have denial of service attacks, intrusions on critical servers.
So those are all an incident.
They have a negative effect on security,
but they dramatically vary in level of severity or impact.
So port scans, for example, those happen all day, every day from external sources.
Denial of service attacks and network
intrusions are a lot more severe happen on a lot less regular basis.
So you're going to prioritize your response times and lay all of this out in
a policy based on high, medium, and low threat and risk analysis.
The incident response is the process of
taking organized and careful steps when we react to a security incident.
So it's a procedure. We plan it out as best we can.
And the whole purpose of having a planner procedure is we can follow a repeatable
series of steps to get a consistent and repeatable result.
Now, this is also an ongoing process, so we're going to learn from our mistakes.
There's a review period.
We may update the response policy, but it involves a sequence of steps that begin
with first identifying and reporting an incident.
Who identifies and who reports, pretty important.
What is the indicator of an incident?
First off, let's define incident for just a second and contrast that with event.
An event is just an occurrence, Bob logged in.
An incident is an event that has a negative
impact on confidentiality, integrity or availability.
Bob logged in, but it wasn't Bob.
It was somebody impersonating Bob from a remote IP at a weird time of day from
Thailand or Russia or China or some other nation.
Bob doesn't live there.
That looks suspicious, we should respond to it.
But what happens if it actually was Bob?
On investigation, we figure out, you know what?
It was Bob. He's on vacation.
He's logging in because he just can't
stand to be awayfrom the office remotely, and maybe he's got jet lag, can't sleep.
You verify it and respond accordingly.
Our IR processes differ from organization
to organization according to their business and operating environment.
You have an incident response team.
Okay, computer emergency readiness team, computer emergency response team, computer
security incident response team, computer incident response team.
You'll see different acronyms, different definitions, Certs, C Certs, and so forth.
They're all referring to the same concept.
A team whose responsibility it is to be
notified, respond to, and address incidents.
The incident handling response team,
specialized people, collectively respond, mitigate, recover, and communicate the
impact of incidents involving computer security breaches.
The incident handling response team works again with the plan.
We're dealing with a security incident.
Humans don't do well under pressure.
We get affected by emotion and stress and urgency, and we may not think clearly.
The whole purpose of any response procedure or plan is we know specifically
what we're going to do ahead of time and we follow the steps.
Are we always going to be totally adequately prepared?
Probably not. Weird situations are going to come up, but
it's better to have a game plan going in to anything than have to decide as the
damage is occurring what you're going to do.
This helps to minimize the impact.
Forensics investigation will be part of this.
We're going to talk again, like I said,
more about forensics in a dedicated module.
Roles and responsibilities of the incident handling and response team.
Management. Senior management drives everything.
We've talked about this before.
They're ultimately responsible.
They sign off on, they approve decisions and policies.
The information security team, individual from the security team who has
experience in discovering and containing incidents, the IT staff, individual who's
aware of systems and network areas, system or network administrators, physical
security staff, since incidents can be physical intrusions,
responsible for physical security and identifying the extent of any damage, and
then the attorney, an individual responsible for providing legal advice.
So all of these entities are going to collaborate and form the IH in our team,
even if they're not directly responding to the incidents.
Your teams, especially in the planning process will typically involve a cross
section of representatives from different departments.
See it in risk analysis, you see it in business continuity and disaster recovery
planning, which we are going to talk about a little bit more.
An incident can also be an outage at a primary facility.
The response can be your disaster recovery plan.
Roles and responsibilities continued by HR representatives, PR specialist.
Pr specialists are the mouthpiece.
They're the ones that are going to talk to
public, responsible for conveying company details after an incident.
Remember, we talked about regulations and legalities that dictate
you have to report to your customer base when certain types of events take place,
but you're going to want to do that as delicately as possible to minimize the
reputational damage that a data breach can bring.
Financial auditor, individual who assesses
financial loss coming from an incident, pretty straightforward.
The IR officer, it's responsible for all actions of the team and function.
Typically, that's a coordinator manager.
Maybe a high executive level like the CISO or the corporate representative.
The IR manager, pretty self explanatory.
The IR assessment team, group of individuals who make decisions on the
classifications and the severity, and they are custodians responsible for the
remediation and resolution of the incident occurred.
Now, take these job roles with a grain of salt.
They're not always going to directly map to maybe your experience in these roles.
They're not always going to be this diverse.
A lot of times your response team is going to be smaller than this.
You want to have a dedicated person for each role.
A lot of times you're going to wear many hats.
Depending on the size of the organization, you may or may not have a
series of titles that fall the same naming convention responsibilities.