Chapter 5 Building an Incident Response Program Flashcards
- Any observable occurrence on a network
- i.e. user accessing a files stored on a server, administrator changing permissions on a shared folder, and an attacker conducting a port scan
Event
- Any event that has negative consequences
- i.e. malware, server crash, use your accessing file they are not authorized to view
Adverse event
- A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
- i.e. accidental loss of sensitive information, intrusion into a computer system by an attacker, the use of a keylogger to steal a password, and a launch of a denial-of-service attack
Security incident
A team responsible for responding to computer security incidents that occur within an organization by following standardized response procedures and incorporating their subject matter expertise.
Computer Security Incident Response Teams (CSIRT)
What are the phases of incident response according to NIST?
- Preparation
- Detection and Analysis
- Containment eradication and Recovery
- Post-incident activity
- Part of the Preparation phase
- NIST recommends that every organization’s incident response toolkit include at the minimum, the following.
- Digital forensic workstations
- Backup devices
- Laptops for data collection, analysis, and reporting
- Spare server and networking equipment
- Blank removable media
- Portable printer
- Forensic and packet capture software
- Bootable USB media containing trust two copies of forensic tools
- Office supplies and evidence collection materials
- Part of the Detection and Analysis phase
- NIST 800-61 describes four major category sources of security event indicators: what are they?
- Alerts
- Logs
- Publicly available information
- People
- One of NIST 800-61 four major categories of security event indicators
- Originates from intrusion detection and prevention systems, SIEMs, Management Systems, antivirus software, file integrity checking software, and third party monitoring services.
Alerts
- One of NIST 800-61 four major categories of security event indicators
- Generating by operating systems, services, applications, network devices and network flows
Logs
- One of NIST 800-61 four major categories of security event indicators
- Provides info about new vulnerabilities
- Keeping up with new exploits can prevent some incidents from occurring and assist in analyzing new attacks
Publicly available information
- One of NIST 800-61 four major categories of security event indicators
- Represents users inside the organization or external sources who report suspicious activity that may indicate a security incident is in progress
People
- Part of the Detection and Analysis phase
- NIST recommends the following actions to improve the effectiveness of an incident analysis
- Profile networks and systems to measure the characteristics of expected activity
- Understand normal behavior of users, systems, networks, and applications
- Create a logging policy that specifies the information that must be logged by systems, applications, and network devices
- Perform event correlation to combine information from multiple sources
- Synchronize clocks across servers, workstations, and network devices
- Maintain an organization-wide knowledge base that contains critical information about systems and applications
- Create network traffic as soon as the incident is suspected
- Filter information to reduce clutter
- Seek assistance from external resources
The Containment, Eradication, and Recovery phase of the process is designed to achieve these objectives:
- Select the containment strategy appropriate to the incident circumstances
- Implement the selected containment strategy to limit the damage caused by the incident
- Gather additional evidence, as needed to support the response effort and potential legal action
- Identify the attackers and attacking systems
- Eradicate the effects of an incident and recover normal business operations
Post-incident activity includes what?
- Lessons Learned review
- Evidence retention
NIST recommends that incident response policies contain what key element?
- Statement of management commitment
- Purpose of objectives of the policy
- Scope of the policy (to whom it applies and under what circumstances)
- Definition of cybersecurity incidents and related terms
- Organizational structure and definition of roles, responsibilities, and level of authority
- Prioritization or severity rating scheme for incidents
- Performance measures for the CSIRT
- Reporting and contact forms
Design to be a step-by-step recipe style responses to cyber security incidents
Playbooks
