researchsoc.iu.edu Thank you for attending. The webinar will begin shortly.
JUNE 25, 2020 Strategies for Better Incident Response ResearchSOC Webinar Series Research Security Operations Center The NSF Collaborative Security Response Center
Housekeeping All participants are on mute. ● Ask your questions via the Q&A feature. ● We will record this webinar and ● provide a link. Slides will also be made available. ●
Who is ResearchSOC? Project leadership REN-ISAC Threat intelligence Project liaison OmniSOC 24x7x365 Virtual Security Teams* Eyes on Glass SOC Training for STINGAR decoy Vulnerability scanning Higher Ed infosec computers (honeypots)
JUNE 25, 2020 Strategies for Better Incident Response Joshua Drake Senior Security Analyst IU Center for Applied Cybersecurity Research
Security Incidents and Response Defining an incident • Series of events resulting in compromise or threat of compromise to your physical or digital assets Functions of incident response • Minimize the negative impact • Gather and protect information • Communicate and coordinate with stakeholders • Maintain or recover operational availability
Elements of effective incident response Prepared Define in advance methods for: • assigning roles and responsibilities • documenting the incident and the response actions Systematic • communicating information to stakeholders • validating an incident has occured Iterative • containing malicious behaviors • maintaining operational security
Elements of effective incident response Prepared Covers response across many areas crucial to your organizational objectives Systematic • aligns with organizational objectives • prioritizes the most important response functions: • Minimize the negative impact Iterative • Gather and protect information • Communicate and coordinate with stakeholders • Maintain or recover operational availabilit y
Elements of effective incident response Response procedures should be tested and updated Prepared regularly • easy to find for all stakeholders Systematic • easy to read • frequently referenced continually refined • Iterative
A Little Preparation Incident Response Checklist Key responsibilities Define organizational objectives Who can declare an incident? ❏ ❏ Define roles and responsibilities Who can form an incident response ❏ ❏ Maintain inventory of assets and risks team? ❏ Create a MISPP Who can communicate with external ❏ ❏ Create an Incident Response Policy stakeholders? ❏ Who can close an incident? ❏
A Little Preparation Incident Response Checklist Key responsibilities Define organizational objectives Who can declare an incident? ❏ ❏ Define roles and responsibilities Who can form an incident response ❏ ❏ Maintain inventory of assets/liabilities team? ❏ Create a MISPP Who can communicate with external ❏ ❏ Create an Incident Response Policy stakeholders? ❏ Who can close an incident? ❏
Poll Questions Q1. Do you have a Master Information Security Policy in place today? Q2. Do you have an incident response policy in place today? TrustedCI.org/guide MISPP and Incident Response Templates
Response Workflow- Filling out the framework
Response Workflow- Identification Strategies for identification Who all staff and stakeholders Train and educate staff on reporting ❏ ➔ Tools indicators of compromise (IoC) Make IoC easy to report security controls - antivirus, IDS/IPS ❏ ➔ Have adequate controls in place system Logs and reports ❏ ➔ Conduct regular security exercises human reporting of unusual activity ❏ ➔ Have effective threat intelligence ❏ Actions capture and review log data (automation!) ➔ gather relevant information for analysis ➔ triage and Escalate potential events ➔
Response Workflow- Documentation Effective documentation strategies Who help desk, analysts, incident response team Take analog notes if possible ❏ ➔ Tools Record date and time for all discoveries ❏ and actions taken notebooks, paper and pens ➔ Backup documentation collaborative note taking software ❏ ➔ Conduct interview/note taking asap cold storage ❏ ➔ Continue to document during all steps ❏ Actions of response record the timeline of events ➔ capture images of affected machines ➔ protect evidence by maintaining chain of custody ➔
Response Workflow- Escalation Strategies for effective escalation Who CISO, help desk, analysts, incident response team Clearly define how to escalate a ❏ ➔ Tools potential incident in IR policy Assign the responsibility for declaring information security policies - MISPP, IRP ❏ ➔ an incident in IR policy predefined escalation channels ➔ Test escalation channels with security predefined thresholds for declaring an incident ❏ ➔ exercises Actions report and escalate incidents ➔ validate if an incident has occured ➔ declare the incident and form the incident ➔ response team
Response Workflow- Containment Strategies for effective containment Who incident response team, IT Halt the breach but don’t destroy ❏ ➔ Tools crucial information Maintain operational security as network and system management ❏ ➔ defined in your IR policy sandbox environment(s) ➔ Document all actions taken with backup/imaging software ❏ ➔ timestamps Actions Gather as much info as possible from ❏ identify affected systems and isolate them from ➔ affected systems the rest of your resources backup or image affected systems for later ➔ investigation disable accounts and services ➔
Response Workflow- Recovery Strategies for effective recovery Who incident response team, IT Assign resources according to ❏ ➔ Tools objectives Assess risk of restoring vs rebuilding policies ❏ ➔ compromised systems organizational objectives ➔ Carefully consider if you will involve Actions ❏ outside resources in response determine the extent of incident ➔ Have a communication strategy ❏ classify the severity of the incident ➔ Define a role to handle ❏ identify impact to operations and obligations to ➔ communications in response team develop a recovery strategy assign adequate resources to execute recovery ➔ plan
Response Workflow- Eradication Strategies for effective eradication Who incident response team, IT, management, outside Catalog evidence gathered ❏ ➔ agencies Carefully remediate all sources of ❏ compromise after RCA Tools Evaluate and improve security controls incident documentation ❏ ➔ based on findings security controls ➔ Carefully test and monitor affected ❏ Actions systems after the incident verify no indicators of compromise remain ➔ perform root cause analysis ➔ remove sources of compromise ➔ verify integrity of recovered systems ➔
Response Workflow- Final Steps Strategies for effective maturation Who incident response team, management, security Assess what worked and what didn’t ❏ ➔ team, legal team with the existing plan Have your final report vetted by Tools ❏ management and/or legal post-mortem ➔ Review, revise, and add security policies policy review ❏ ➔ as you use them in the field Actions Keep track of vulnerabilities and rough ❏ write narrative report based on final documentation ➔ spots in process to test in future determine if further legal/criminal action is needed ➔ security exercise distribute report to stakeholders and community as ➔ required and desired
Takeaways Most incidents are not high severity ❏ Practice and experience are your most effective ❏ tools and practicing calm and organized response Security is a process, not a product, start building ❏ momentum today Build your own template and start maturing it ❏ TrustedCI.org/guide MISPP and Incident Response Templates
Poll Questions Q3. Have you or your organization responded to an incident in the last 90 days? ResearchSOC Webinars More information on: • security exercises • security metrics • crisis management
Thank you Joshua Drake, Senior Security Analyst @ drakejc@iu.edu researchsoc.iu.edu
Contact us researchsoc.iu.edu rsoc@iu.edu @ The ResearchSOC is supported by the National Science Foundation under Grant 1840034. The views expressed do not necessarily reflect the views of the National Science Foundation or any other organization.
Strategies for Better Incident Response ResearchSOC Webinar Series - June 2020 Joshua Drake Senior Security Analyst, Indiana University Center for Applied Cybersecurity Research
Recommend
More recommend
