Vulnerabilities / Threats
9/19/2007
07:20 AM
50%
50%

The Six Stages of Incident Response

Following these simple steps can help your organization handle a serious data breach

3:20 PM -- When you were reading about the TD Ameritrade hack, did you wonder what you would have done in that situation? Do you think your team has the skills and the tools to identify malicious code on your organization's computer systems? (See TD Ameritrade Breach Affects 6.3M Customers and Lawsuit Raises Questions on TD Ameritrade Breach.)

In Monday’s blog, I emphasized that your "first responders" have to have the training and tools necessary for dealing with various security incidents effectively and efficiently. Today, before I get too far ahead of myself and delve into incident response tools (because I really like IR tools), let's take a look at the six stages of incident response (IR).

  • Preparation: Be ready with the tools and training for incidents before they happen.
  • Identification: Identify incidents thoroughly; going through the IR process only to find a false alarm is no fun.
  • Containment: Contain the incident immediately to prevent possible collateral damage. This may mean revoking user accounts, blocking access at the firewall or updating antivirus rules to catch the malicious code.
  • Eradication: Get rid of the malicious code, unauthorized account, or bad employee that caused the incident.
  • Recovery: Make sure the system meets company standards or baselines, before returning it to service. Continue to monitor the system for any aberrant behavior to be sure that incident has been fully resolved.
  • Lessons Learned: Put together a report detailing what happened, why it happened, what could have prevented it, and what you’ll be doing to prevent it from happening again. Meet with management to go over the report and get buy-in for the changes needed to prevent similar incidents in the future.

These stages aren't difficult to read, but implementing them properly in a busy enterprise can be tricky. This is especially true when dealing with a compromise that impacts critical or customer-facing systems that must stay online to prevent financial loss.

This is when buy-in from management is crucially important. Top executives need to understand the situation in order to make informed decisions -- and it's your job to provide that information to them. Will you be ready?

-- John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.