Incident response relies on existing security
infrastructure tools such as logging systems,
intrusion detection and prevention system
and security information and event management systems to provide
us with a prevention methodology for incident response.
The incident response cycle includes four distinct phases.
The first one being prevention,
we want to win all possible to prevent an attack from occurring.
That's our primary goal. However, as once somebody once said
it's not a matter of if we have a data breach, it's only a matter of time.
We want to detect and analyze any problems in our network.
Obviously, if prevention doesn't work and we have a data breach,
we need to be able to detect the problem as it's occurring.
If we can't detect it while it's occurring,
we want to be able to detect it as soon as possible.
This is where a detection analysis comes into play.
We want to be able to detect the problem,
how we got at what vulnerability exploited and analyze
what the problem is occurring throughout our network.
Finally, we want to contain the issue.
Once we've contained it,
we want to eradicate it and then we want to come back to
the normal working standard that our system was utilizing before the incident.
Once that's all been taken place, we need to do an a ar or an after action review.
During this review process,
we're going to identify what we could have done better so that the
vulnerability never got exploited in the first place we want to verify,
could we have done this faster?
Was there certain problems that we saw?
We want to continually I understand that we're not perfect people.
Those problems that exist can be recovered from and bring it up as a learning process
within containment, we have segmentation.
Segmentation prevents direct communication between hosts
of different segments from talking.
This reduces lateral movement by Attackers.
Much like you may see in segmentation for network architecture,
we need to segment a machine off of our network.
If I have a machine in the hr department or several machines
in the hr department that have been affected with a malware,
I need to segment that off my network as quickly as possible.
I don't want them to have communication with other
machines either on that segment or cross segment it into
a different department such as operations or maintenance by segmenting
the traffic either through vlans or access control list.
I can thereby restrict traffic from that machine
that's been infected from communicating with other machines.
I can also do what's called isolation. Isolation takes segmentation.
One step further,
I can isolate the machine in such a way that I can monitor what's going on.
It has no communication outside of what I allow it to have.
It's the next stage or the next evolution of segmentation when you come down to it,
I'm isolating that machine or that series of machines.
And I'm monitoring to see what's going on within the process.
What files are they moving? Are they doing a ransomware attack?
Are they encrypting my files? Are they communicating with a server offsite?
I want to be able to monitor everything that that
machine is going through so that I can quickly identify
if there was a specific portion of the malware that
maybe we hadn't seen through our normal detection analysis process.
This is where isolation is really key.
Finally, I want to remove the problem.
Once I've identified all the thread intelligence that I can off that machine,
I want to remove the item from my network as a whole.
This means I'm plugging it or removing the hard drive.
It could be physically going to the device and
logically pulling the plug or just simply cutting off
the internet connection altogether and not allowing it to
proceed forward with any further communication across the network.
We want to remove the threat from our network.
Once we've gathered all the Intel or data that we possibly can,
that brings us to our next phase of eradication.
I want to be able to remediate the problem.
Once I've identified everything that's occurring,
I want to remediate the core problem within the machine.
And the vulnerabilities that it utilized.
The vulnerability could be a simple patch or it could be a
singular issue with a phishing email where somebody clicked on a lake,
whatever it is,
whether it's an antivirus program to remove malware off the machine from a
phishing lake or it's a vulnerability that an attacker may have exploited.
I want to go through and remediate the problem as best I can.
However, sometimes remediation
isn't always possible through a preferred means.
There may be financial constraints or business constraints.
It could be a lack of technology. It could be any number of things. If that's the case,
I may want to use something called compensating controls.
Compensating controls allow for resource constraints such as budget personnel
availability to take place and bring the same level.
And I want to repeat that the same
level of remediation to the problem
without spinning the original idea.
I may have a device that 100% is the problem and I just plug it in and it
fixes the issue something like a firewall if I
need an access control list to be in play.
However, if that's not possible due to these constraints,
I can use compensating controls to limit the structure and perform the same
principle that the original device or the original fix would have occurred.
I also want to do vulnerability mitigation.
Once we recover from the incident,
we want to restore the system to pre incident state
but also ensure similar disruptions don't occur in the future.
We want to mitigate those problems by eliminating the
root cause of the event or the incident.
Once we've identified what occurred,
this vulnerability mitigation fixes the core root of
the problem and identifies specific vulnerabilities in order
to remediate those specific issues that allowed the
incident to occur in the first place.
Finally, I want to sanitize.
Once we talk about sanitization,
we're referring to rendering access to the data or the gen
and me infeasible for future use.
If I have a piece of malware that I just can't get rid of on an antivirus program,
the best thing may be just to overwrite the data
with zeros and ones and reimage the device eradicate.
When we talk about syndication can mean overwriting the data.
It could also mean encrypting the data so that somebody doesn't have access
to it before degaussing or even destroying the data as a whole.
Any one of these items to sanitize the data to ensure that it cannot be
reutilized or used by an attacker in the future is what we call sanitization.
Finally, I want to recover or reconstruct the issue.
When we talk about reconstruction or reimaging the device,
we ought to refer to a device or a problem that's had an issue
and we just can't fully 100% get past it.
This is where reimaging or reconstructing take place when I reimage the device,
I'm literally wiping the drive and putting the
brand new operating system on top of it.
It's not uncommon if I've got a piece of malware inside of a lone client
and that client is causing some issues just to wipe the drive,
reimage it and hand it back to the employees a fresh brand new machine.
This is what's referred to as reimaging.
However, I may sometimes have to reconstruct it.
Maybe it's a server where I've got one little issue that you just can get past,
I can reconstruct the entire system
in such a way that it ignores that one piece of malware
and then I can rewrite or destroy that piece of malware.
It's the long about way of doing it unlike an antivirus uh
protocol, but it still does the same job.