Vulnerabilities / Threats
9/19/2007
07:20 AM
Connect Directly
RSS
E-Mail
50%
50%

The Six Stages of Incident Response

Following these simple steps can help your organization handle a serious data breach

3:20 PM -- When you were reading about the TD Ameritrade hack, did you wonder what you would have done in that situation? Do you think your team has the skills and the tools to identify malicious code on your organization's computer systems? (See TD Ameritrade Breach Affects 6.3M Customers and Lawsuit Raises Questions on TD Ameritrade Breach.)

In Monday’s blog, I emphasized that your "first responders" have to have the training and tools necessary for dealing with various security incidents effectively and efficiently. Today, before I get too far ahead of myself and delve into incident response tools (because I really like IR tools), let's take a look at the six stages of incident response (IR).

  • Preparation: Be ready with the tools and training for incidents before they happen.
  • Identification: Identify incidents thoroughly; going through the IR process only to find a false alarm is no fun.
  • Containment: Contain the incident immediately to prevent possible collateral damage. This may mean revoking user accounts, blocking access at the firewall or updating antivirus rules to catch the malicious code.
  • Eradication: Get rid of the malicious code, unauthorized account, or bad employee that caused the incident.
  • Recovery: Make sure the system meets company standards or baselines, before returning it to service. Continue to monitor the system for any aberrant behavior to be sure that incident has been fully resolved.
  • Lessons Learned: Put together a report detailing what happened, why it happened, what could have prevented it, and what you’ll be doing to prevent it from happening again. Meet with management to go over the report and get buy-in for the changes needed to prevent similar incidents in the future.

These stages aren't difficult to read, but implementing them properly in a busy enterprise can be tricky. This is especially true when dealing with a compromise that impacts critical or customer-facing systems that must stay online to prevent financial loss.

This is when buy-in from management is crucially important. Top executives need to understand the situation in order to make informed decisions -- and it's your job to provide that information to them. Will you be ready?

-- John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.