introduction to incident response
play

Introduction to Incident Response Renana Friedlich, National - PowerPoint PPT Presentation

Sep 06, 2023 •484 likes •622 views

Introduction to Incident Response Renana Friedlich, National Incident Response Leader March 2016 Agenda Evaluation of Cybersecurity risks The attackers playbook Case study What can you do today Page 2 Evaluation of

  1. Introduction to Incident Response Renana Friedlich, National Incident Response Leader March 2016

  2. Agenda ► Evaluation of Cybersecurity risks ► The attacker’s playbook ► Case study ► What can you do today Page 2

  3. Evaluation of Cybersecurity risks Page 3

  4. Identity Theft Resource Center 2015 Survey Page 4

  5. Themes of most recent breaches Following same “playbook” (no need to change ): Gain access to internal company network ► Deploy RAT ► Obtain Windows “Domain Administrator” privileges ► Dump and crack password hashes of all corporate users ► Use cracked accounts to access sensitive data ► Extract data to a staging server ► Sell records when black market conditions are most favorable ► Page 5

  6. “Lessons learned” from breach investigations ► PCI compliance ≠ difficulty in breaching payment cards ► PCI QSA audits did not test for current attack path ► Too many ways to get from corporate network to payment card network ► Protection of privileged service accounts ► Searches of security event logs take far too long to run (need more horsepower!) ► Breaches detected via external analytics vs internal monitoring capabilities ► “Blind” spots on network identified *after* breach Page 6

  7. Case Study Page 7

  8. Notional attack timeline Day 2 Day 5 2016 Day 1 Attacker 2 6 4 9 1 Company 3 A 8 7 5 Company B Attacker blocks Attacker sends validates all emails from wire request to Company request and Company B to from fake email transmits funds victims Gmail account B account Page 8

  9. Lessons learned ► Money transfer procedure ► Two-factor authentication ► Create e-mail rules ► User awareness training Page 9

  10. What can you do today? • Identify the “crown jewels” of your organization Know your • Understand the data flows and assets that store, process and transmit the data critical assets • Inform your security operations team of the critical assets’ priority • Leverage Center for Internet Security and vendor benchmarks to assess logging Assess your devices on critical assets logging • Determine whether other tools are required for enhanced logging capabilities • Monitor, monitor, monitor the keys to the kingdom Privileged • Remove local administrator access from users! and remote account • Re-assess all remote accounts and whether any access is through single-factor management authentication • Build a comprehensive IR plan leveraging industry publications Build your IR • Build communication emails and other templates that help provide a consistent plan, IR experience templates • Conduct IR tabletops using real-life scenarios. Consider inviting external and tabletop partners (e.g., FBI) to participate Page 10

  11. “There are only two types of companies: those that have been hacked, and those that will be .” Robert Mueller, Former FBI Director Page 11

  12. Thank you Responding to 2015 Global Information Targeted Cyberattacks Security Survey http://isaca.org/cyberattacks http://www.ey.com/GL/en/Services/Advis ory/EY-cybersecurity Renana Friedlich Los Angeles, CA Phone: +1 213 977 3928 E-Mail: Renana.Friedlich1@ey.com Page 12

Recommend

Incident Response & Evidence Incident Response & Evidence Incident Response &

Incident Response & Evidence Incident Response & Evidence Incident Response &

Incident Response & Evidence Incident Response & Evidence Incident Response & Evidence Incident Response & Evidence Management Management Management Management CIPS Brandon Chapter November 28 2002 Dr. Marc Rogers PhD,

629 views • 27 slides
GE Incident Response Insight Awareness Advantage Sean Mason Director, Incident Response

GE Incident Response Insight Awareness Advantage Sean Mason Director, Incident Response

GE Incident Response Insight Awareness Advantage Sean Mason Director, Incident Response Investing in new talent & capabilities Incident response Cyber intelligence Digital forensics Security architecture Identity management

609 views • 42 slides
Incident Response: Goals of Incident Management Steps to Preparation Risk Assessment

Incident Response: Goals of Incident Management Steps to Preparation Risk Assessment

6/19/2015 Incidents Are Not Necessarily Emergencies Incident Laboratory Incidences and An event thats likely to have adverse consequences Emergency Response Programs Emergency Unanticipated circumstances resulting in

564 views • 5 slides
BIRT BIRT Liaisons Incident Response Incident Follow-Up Q&A 1 2 PURPOSE OF

BIRT BIRT Liaisons Incident Response Incident Follow-Up Q&A 1 2 PURPOSE OF

5/20/2014 COURSE OUTLINE Purpose Building Incident Response Team Expectations BIRT BIRT Liaisons Incident Response Incident Follow-Up Q&A 1 2 PURPOSE OF BIRT PURPOSE OF BIRT Prepare units to respond to a

342 views • 4 slides
Incident Response and Information Sharing A Practical Approach Rapha el Vinot - TLP:GREEN May

Incident Response and Information Sharing A Practical Approach Rapha el Vinot - TLP:GREEN May

Incident Response and Information Sharing A Practical Approach Rapha el Vinot - TLP:GREEN May 22, 2015 The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response

407 views • 13 slides
PhiGARo: Automatic Phishing Detection and Incident Response Framework Martin Husk, Jakub

PhiGARo: Automatic Phishing Detection and Incident Response Framework Martin Husk, Jakub

PhiGARo: Automatic Phishing Detection and Incident Response Framework Martin Husk, Jakub egan {husakm|cegan}@ics.muni.cz ECTCM 2014 Fribourg, Switzerland Outline Introduction, Phishing incident response, PhiGARo (phishing

270 views • 23 slides
Agile Incident Response: Operating through Ongoing Confrontation Kevin Mandia Who Am I?

Agile Incident Response: Operating through Ongoing Confrontation Kevin Mandia Who Am I?

Agile Incident Response: Operating through Ongoing Confrontation Kevin Mandia Who Am I? Professorial Lecturer Carnegie Mellon University 95-856 Incident Response Master of Information System Management The George Washington

1.29k views • 60 slides
Above My Pay Grade: Incident Response at the National Level Jason Healey Atlantic Council

Above My Pay Grade: Incident Response at the National Level Jason Healey Atlantic Council

Above My Pay Grade: Incident Response at the National Level Jason Healey Atlantic Council Traditional Incident Response But at the national level, incident response is a different game Implications for Misunderstandings between geeks and

541 views • 27 slides
BALTIC SEA MARITIME INCIDENT RESPONSE GROUP PROJECT BALTIC SEA MARITIME INCIDENT RESPONSE GROUP

BALTIC SEA MARITIME INCIDENT RESPONSE GROUP PROJECT BALTIC SEA MARITIME INCIDENT RESPONSE GROUP

BALTIC SEA MARITIME INCIDENT RESPONSE GROUP PROJECT BALTIC SEA MARITIME INCIDENT RESPONSE GROUP PROJECT MIRG OOERATIONAL GUIDELINES The project developed the following operational guidelines: 1. Assessing the Safety Status of a Vessel

598 views • 16 slides
Planning for the Worst: The Role of Incident Response, Before Youve Had an Incident Sponsored

Planning for the Worst: The Role of Incident Response, Before Youve Had an Incident Sponsored

Planning for the Worst: The Role of Incident Response, Before Youve Had an Incident Sponsored By: Planning for the Worst: The Role of Incident Response, Before Youve Had an Incident Visit www.advisenltd.com at the end of this webinar to

498 views • 18 slides
Detection and Incident Response With osquery Javier Marcos @javutin $ whoami Security

Detection and Incident Response With osquery Javier Marcos @javutin $ whoami Security

Detection and Incident Response With osquery Javier Marcos @javutin $ whoami Security Engineer/Incident Responder Open source contributor (github.com/javuto) Former IBM, Facebook, Uber and Airbnb Current BitMEX Agenda Part 1:

981 views • 59 slides
TBD Challenges for Digital Forensics and Incident Response on Virtualization and Cloud Computing

TBD Challenges for Digital Forensics and Incident Response on Virtualization and Cloud Computing

TBD Challenges for Digital Forensics and Incident Response on Virtualization and Cloud Computing Platforms Introduction Christopher Day, Chief Security Architect, Terremark Responsible for Terremarks global information security services

332 views • 30 slides
Cyber Up! Digital Forensics & Incident Response Tobi West Principal Investigator Coastline

Cyber Up! Digital Forensics & Incident Response Tobi West Principal Investigator Coastline

Cyber Up! Digital Forensics & Incident Response Tobi West Principal Investigator Coastline College NSF Grant Award #1800999 Agenda Background on Coastline College Need for Incident Response Professionals Overview Advisory

571 views • 14 slides
SW District Incident Response 1 Incident Management Coordinator 4 Motorist Assistance

SW District Incident Response 1 Incident Management Coordinator 4 Motorist Assistance

SW District Incident Response 1 Incident Management Coordinator 4 Motorist Assistance Operators 3 FillIn Motorist Assistance Operators from Maintenance 1 Work Zone Coordinator 2 MoDOT TMC Operators 1 City of Springfield

404 views • 24 slides
The Incident Responders Toolkit the stuff they dont teach you in school Judith van Stegeren

The Incident Responders Toolkit the stuff they dont teach you in school Judith van Stegeren

The Incident Responders Toolkit the stuff they dont teach you in school Judith van Stegeren After my graduation After my graduation Where I work Skill set What I do What I do Case study: incident response Incident Response for fictional

709 views • 39 slides
EVERY MINUTE COUNTS COORDINATING HEROKU'S INCIDENT RESPONSE / Blake Gentry @blakegentry

EVERY MINUTE COUNTS COORDINATING HEROKU'S INCIDENT RESPONSE / Blake Gentry @blakegentry

EVERY MINUTE COUNTS COORDINATING HEROKU'S INCIDENT RESPONSE / Blake Gentry @blakegentry PERSONAL BACKGROUND Lead Engineer at Heroku since 2011 Worked on nearly all parts of the platform In 2012, I led a project to overhaul Herokus Incident

1.03k views • 72 slides
A perspective to incident response or another set of recommendations for malware authors

A perspective to incident response or another set of recommendations for malware authors

A perspective to incident response or another set of recommendations for malware authors Alexandre Dulaunoy - TLP:WHITE alexandre.dulaunoy@circl.lu June 7, 2013 CIRCL, national CERT of Luxembourg CIRCL 1 is composed of 6 full-time incident

572 views • 21 slides
2018 Data Security Incident Response Report Building Cyber Resilience: Compromise Response

2018 Data Security Incident Response Report Building Cyber Resilience: Compromise Response

2018 Data Security Incident Response Report Building Cyber Resilience: Compromise Response Intelligence in Action April 11, 2018 Contact Information Theodore J. Kobus, III Casie D. Collignon Leader, Privacy and Data Protection Practice

448 views • 23 slides
National Incident Management System National Incident Management System and and National

National Incident Management System National Incident Management System and and National

National Incident Management System National Incident Management System and and National Response Plan National Response Plan Overview March 2006 HSPD-5: Management of Domestic Incidents HSPD-5 Objectives: Single comprehensive

463 views • 21 slides
National Incident Management System National Incident Management System and and National

National Incident Management System National Incident Management System and and National

National Incident Management System National Incident Management System and and National Response Plan National Response Plan Overview March 2006 HSPD-5: Management of Domestic Incidents HSPD-5 Objectives: Single comprehensive

196 views • 17 slides
Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX

Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX

Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX PRESENTATION Environment Management Series: EMS004 Key Information: Env Incident Identification & Response (V2) (SIMEC Mining) 2018 WHAT IS AN

445 views • 8 slides
Process-based cyber incident response Mr Jorge Silveira Executive Director of Information

Process-based cyber incident response Mr Jorge Silveira Executive Director of Information

Code Yellow - Cybersecurity Process-based cyber incident response Mr Jorge Silveira Executive Director of Information Management & Chief Information Officer Northeast Health Wangaratta @HISA_HIC #HIC18 Introduction about

340 views • 18 slides
Public Safety Response to a School Incident What You Can Do!!!

Public Safety Response to a School Incident What You Can Do!!!

Active Shooter Awareness Public Safety Response to a School Incident What You Can Do!!! http://www.drc-group.com/project/jitt-schoolactiveshootersafety.html Presentation Overview This presentation provides guidance to individuals, including

603 views • 34 slides
Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX

Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX

Environment Management Series ENVIRONMENT INCIDENT IDENTIFICATION & RESPONSE TOOLBOX PRESENTATION WHYALLA SHARED FACILITY Environment Management Series: EMS004 Key Information: Environment Incident Identification & Response (V2)

264 views • 9 slides

More recommend