Vulnerabilities / Threats
9/19/2007
07:20 AM
Connect Directly
RSS
E-Mail
50%
50%

The Six Stages of Incident Response

Following these simple steps can help your organization handle a serious data breach

3:20 PM -- When you were reading about the TD Ameritrade hack, did you wonder what you would have done in that situation? Do you think your team has the skills and the tools to identify malicious code on your organization's computer systems? (See TD Ameritrade Breach Affects 6.3M Customers and Lawsuit Raises Questions on TD Ameritrade Breach.)

In Monday’s blog, I emphasized that your "first responders" have to have the training and tools necessary for dealing with various security incidents effectively and efficiently. Today, before I get too far ahead of myself and delve into incident response tools (because I really like IR tools), let's take a look at the six stages of incident response (IR).

  • Preparation: Be ready with the tools and training for incidents before they happen.
  • Identification: Identify incidents thoroughly; going through the IR process only to find a false alarm is no fun.
  • Containment: Contain the incident immediately to prevent possible collateral damage. This may mean revoking user accounts, blocking access at the firewall or updating antivirus rules to catch the malicious code.
  • Eradication: Get rid of the malicious code, unauthorized account, or bad employee that caused the incident.
  • Recovery: Make sure the system meets company standards or baselines, before returning it to service. Continue to monitor the system for any aberrant behavior to be sure that incident has been fully resolved.
  • Lessons Learned: Put together a report detailing what happened, why it happened, what could have prevented it, and what you’ll be doing to prevent it from happening again. Meet with management to go over the report and get buy-in for the changes needed to prevent similar incidents in the future.

These stages aren't difficult to read, but implementing them properly in a busy enterprise can be tricky. This is especially true when dealing with a compromise that impacts critical or customer-facing systems that must stay online to prevent financial loss.

This is when buy-in from management is crucially important. Top executives need to understand the situation in order to make informed decisions -- and it's your job to provide that information to them. Will you be ready?

-- John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.