- Welcome to lesson 21,
explain appropriate incident response activities.
In our first lesson, 21.1
we're gonna focus in on incident management.
Now, incident management is inclusive
of the roles and the responsibilities,
the strategies and the procedures for preparing for,
responding to and managing security incidents.
Now, a security incident is an event
or an action that endangers the confidentiality,
the integrity, or the availability of information
or information systems.
But I do wanna make sure that we're distinguishing that
from a data breach.
A data breach is when data is exfiltrated or extracted
or there's a loss of control.
Now, data breaches may trigger reporting
and notification requirements
or a security incident is really could be as common
as a everyday event, right?
It doesn't tend to trigger any reporting
or notification requirements,
it's just an event or action that endangers
or potentially endangers confidentiality, integrity,
and availability that we need to respond to.
There are four primary incident management components
or activities, incident prevention, incident preparation,
incident detection, and incident response.
Now, how awesome if we can prevent an incident
from even happening.
So what do we do to try to prevent incidents?
What we do threat modeling?
To understand the most likely threats.
We do risk assessments to understand risk levels.
We do a controls implementation, right?
We put in multiple layers of diverse controls,
we monitor and then we do our assurance activities, right?
We test to make sure that our controls are all working
exactly the way we think they're working,
but we won't prevent every incident
so we have to be prepared for an incident.
And that preparation will include planning, documenting,
assigning responsibilities, training,
and practicing our response capabilities.
Then we need to be able to very quickly detect an incident.
So our activities there include monitoring,
incident reporting, analysis, and participation
in threat intelligence and information sharing activities
so that we can recognize an incident.
And lastly, actual incident response.
So an incident has happened, we've detected it.
Now we're gonna go through the process
of validating the incident, containing it,
mitigating it, eradicating it, recovering from it,
and then doing a post-incident evaluation.
So who's responsible for incident management?
Well, there's a lot of folks involved
and a lot of components.
We have policies, we have plans, and we have procedures.
Now we're gonna focus in at the plan and procedure
but it's worth mentioning the policy, right,
at the policy level, right?
We're going to sort of set the framework
for incident management.
And policy should always be approved
by the highest level in your organization
perhaps a board of directors or a board of trustees
or an agency, maybe agency leadership.
Then we have plan components, and then we have procedures.
So I wanna talk about the various plan components
and then specifically for procedures,
I wanna talk about playbooks.
So let's start with playbooks.
An incident playbook is a set of instructions
for planning for and responding to a specific type of attack
or event or scenario.
So while our incident plans as we're going to see
are more generic, there are certain steps
we're going to have to take for high risk events.
And so we're going to have a playbook designed
for those high risk events.
We're measuring them in terms of how likely
is this to happen and what would be the impact.
So for example, malware
or a distributed denial of service, a DDOS attack
or a ransomware extortion attack or payment card compromise.
So we have those playbooks that's really specific, right?
But then we come back up to our plan
which is overarching and a little bit more generic.
Some of the things we're gonna have in our plan
will be threat modeling, right?
Which is our process of how we're anticipating threats.
Categorization, which is the process
of how we're gonna classify incidents based on severity.
And that's gonna be important
because we're gonna use it to determine response times,
resource assignments, and preparation requirements.
Then we're gonna have our reporting standards
for how incidents should be documented
and communicated as well as when notification requirements
are going to be triggered.
And then importantly, we wanna have escalation thresholds.
Escalation thresholds referred to the point
at which an incident or an issue require a higher level
of response or attention.
Now, another component of our plan
is going to be the incident response team.
The membership of an incident response team or an IRT
is generally composed of internal personnel
and then adjunct external resources.
The internal personnel should always represent
a cross section of the organization.
So including operations, information security,
information technology, risk management,
marketing, legal and compliance, executive management,
maybe some key business units.
Why? Because an incident isn't just an IT issue,
it isn't just a security issue,
it is an organizational issue.
So we want a cross section of the organization
as part of our team.
Then we wanna have external resources
that we have identified, we have relationships with
and we're appropriate, we already have contracts with.
Forensic experts in case there's an incident
that has to have a forensic investigation,
legal counsel our insurance representatives,
we really need to understand how we're supposed to react
and what timeframe, what we can say and not say.
Because you know, if we don't follow insurance protocols,
there's a good chance that insurance won't pay out.
We wanna have public relations folks available to us
because this may become a public facing issue,
and we wanna know how to work with law enforcement.
So external resources, forensic experts,
legal counsel, insurance representatives,
public relations and law enforcement
and I'm sure you could probably think of others.
Now, we also wanna make sure that everybody
in the organization is ready to respond to an incident.
So incident response training should be included
in our organizational wide set of programs,
security, education, training, and awareness programs.
At the highest level, our executives
including our board of directors as well
should be educated on incident related organizational risks.
All personnel in our organization should be aware
of potential incident scenarios and how to report them.
And then first responders, who's ever going to be
responding initially boots on the ground
to an incident as well as all incident response team members
should receive training related to their assigned tasks.
Then we also want to exercise our preparedness.
So incident response exercises should be conducted
on a periodic basis to assure readiness.
Now, exercises include things like walkthroughs, tabletops,
and simulations, very similar to what we talked
about earlier with continuity of operations.
Now, participants in our exercises should include
the incident response team, our external resources,
and as applicable executive management,
even our board of directors, perhaps.
For a good example would be ransomware.
You know, ransomware is all about extortion.
And we definitely wanna have executive management
and a representative of the board
when we're making decisions about pain and extortion demand.
So let's look at those exercise options,
walkthrough, tabletop, and simulation.
Walkthrough is when our personnel or departments review
or kind of literally walkthrough their plans
and procedures for completeness.
So we say, okay, here's your incident response plan.
Go through it. Is it right? Is it wrong?
Does it need to be modified?
Really, our objective here is accuracy.
A tabletop, again, it's scenario-based group workshop.
We're gonna bring people together and we're gonna say,
"Okay here's an incident.
Pull out your plans, your procedures, your playbook,
see if we have anything that actually can address
this particular incident."
And we're also looking for participant readiness.
Like, have you ever even looked at that plan before?
Do you know what to pull out? Do you know what to do?
So our objectives are familiarity with the plan,
accuracy of the plan and coordination
between departments and groups.
And then lastly, with a simulation.
And that's a localized scenario
that simulates an actual event.
- In a pre-planned simulation,
it's scheduled and our attendees are invited.
In a surprise simulation,
our attendees are kind of notified in the moment.
So we have a scenario and we go through the motions
of how we would respond if that was an actual event.
Again, our objective is readiness.
You know, there's pros and cons
to both pre-planned and surprise.
Pre-planned, you're gonna know
that everybody's attending, right?
It's on everybody's schedule.
Surprise, there's a good chance you won't get everybody.
You won't get your whole incident response team
but you're gonna learn a lot about how do you work
with a smaller team and who needs to be cross-trained?
And that, my friends, brings us to a three second challenge.
Five challenge questions, three seconds each.
Let's do it.
A set of instructions for responding
to a specific type of event.
1, 2, 3.
That's gonna be an incident playbook.
Number two, the process of anticipating threats.
1, 2, 3.
And that's gonna be threat modeling.
Remember, we talked about three different ways
to approach threat modeling, right?
Asset centric, architecture centric, and attacker centric.
Number three, scenario-based group workshop
focused on the application of plans and procedures.
1, 2, 3.
It's gonna be a tabletop exercise.
Number four, the point at which an incident
or issue require a higher level of attention or response.
1, 2, 3.
That's gonna be the escalation threshold.
And lastly, number five, the type of simulation exercise
that attendees are scheduled for.
1, 2, 3.
It's gonna be a pre-planned.
All right, that brings us to yet another security in action.
This one about an incident response team.
Your study and your organization's incident response plan
and playbooks.
And you're really, really surprised to learn
that all of the incident response team members
are IT personnel.
And when you ask your manager, why is this,
you're told that, "Only IT personnel
have the necessary skills to evaluate an incident
and quickly fixing the issue is our number one priority."
Uh-oh, okay?
What's your response?
Do you agree with that?
Again, you've been looking at your incident response plan
and playbook, and what you learn is that every member
of that incident response team are IT personnel.
So you say to your manager, why is this right?
And they say, well, yeah, but only IT personnel
really will know what to do, right?
They only have that necessary skills
to evaluate the incident and quickly fix it.
Do you agree?
How would you respond?
Go ahead and put me on pause.
Think about your response, jot some notes down
and come on back.
Well, security incident often has business implications
and should be considered a risk management issue.
The IRT, the incident response team should be expanded
to include a cross section of the organization
including operations, information security.
It of course, are very important.
Risk management, marketing, legal, compliance,
executive management and potential external resources
should be identified and documented,
including forensic experts, legal counsel,
insurance representatives,
public relations and law enforcement.
You never know when you might need to call on one of them.
So explaining this to your manager
why it's not just an IT issue.
Why an incident is absolutely
a business risk management issue.
Hopefully you get through.
You get some changes made and if you do that,
that is security in action.
There's your word cloud a lot there.
You know what to do.
When you're ready, go on over to the next lesson,
I'll be waiting for you there.