Vulnerabilities / Threats
9/19/2007
07:20 AM
50%
50%

The Six Stages of Incident Response

Following these simple steps can help your organization handle a serious data breach

3:20 PM -- When you were reading about the TD Ameritrade hack, did you wonder what you would have done in that situation? Do you think your team has the skills and the tools to identify malicious code on your organization's computer systems? (See TD Ameritrade Breach Affects 6.3M Customers and Lawsuit Raises Questions on TD Ameritrade Breach.)

In Monday’s blog, I emphasized that your "first responders" have to have the training and tools necessary for dealing with various security incidents effectively and efficiently. Today, before I get too far ahead of myself and delve into incident response tools (because I really like IR tools), let's take a look at the six stages of incident response (IR).

  • Preparation: Be ready with the tools and training for incidents before they happen.
  • Identification: Identify incidents thoroughly; going through the IR process only to find a false alarm is no fun.
  • Containment: Contain the incident immediately to prevent possible collateral damage. This may mean revoking user accounts, blocking access at the firewall or updating antivirus rules to catch the malicious code.
  • Eradication: Get rid of the malicious code, unauthorized account, or bad employee that caused the incident.
  • Recovery: Make sure the system meets company standards or baselines, before returning it to service. Continue to monitor the system for any aberrant behavior to be sure that incident has been fully resolved.
  • Lessons Learned: Put together a report detailing what happened, why it happened, what could have prevented it, and what you’ll be doing to prevent it from happening again. Meet with management to go over the report and get buy-in for the changes needed to prevent similar incidents in the future.

These stages aren't difficult to read, but implementing them properly in a busy enterprise can be tricky. This is especially true when dealing with a compromise that impacts critical or customer-facing systems that must stay online to prevent financial loss.

This is when buy-in from management is crucially important. Top executives need to understand the situation in order to make informed decisions -- and it's your job to provide that information to them. Will you be ready?

-- John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1449
Published: 2014-12-25
The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.

CVE-2014-2217
Published: 2014-12-25
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.

CVE-2014-3971
Published: 2014-12-25
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

CVE-2014-7193
Published: 2014-12-25
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site ...

CVE-2014-7300
Published: 2014-12-25
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.