Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
Developing and Testing an Effective Breach Response PlanWhether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to:
-understand the technical environment,
-determine what types of incidents would trigger the plan,
-know which stakeholders need to be notified and how to do so,
-develop steps to contain the breach, collect evidence, and initiate recovery.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Strategist
3/31/2016 | 3:40:03 PM
The key is to verify that the (daily) backups are clean, as a means of early ransomware detection and preventing good backups from being over-written. Nowhere do I see detailed advice on verifying backup integrity: a) How do you verify that a backup is not encrypted? Can it be automated or would it need a human to detect encrypted data? b) Keep in mind databases, Exchange, Active Directory and data in non-readable formats.
One solution to automating the integrity check is to seed your data with known static data- static files, database records, a mailbox, etc. Only the seed data could be restored and checked against the expected value. But this would be a custom solution, not something off the shelf as far as I know. In fact, seed data could be copied (low-level copy to bypass ransomware hooks into the OS) to another system and checked against expected values even hourly, as an early warning system for ransomware. Has anyone tried this approach?