14.2.1 Incident Responses

Learn how to properly respond to security or privacy incidents in enterprise settings.

Data theft, malware, or unauthorized access to secure content can have major consequences on a company. That is why they all have detailed security policies that establishes what's allowed to happen on their computer networks and how to respond should a security breach happen. The security policy should define the chain of custody - i.e. how evidence of a security breach is handled and by who.

Detection

As soon as an incident happen, it's very important to document as much as you can about what happened. There are three main types of incident detection, passive, active and proactive detection.

Passive Detection

Happens when security incidents are detected while not being looked for (e.g. finding prohibited content while doing routine system maintenance; finding additional network traffic while checking logs).

Active Detection

Happens when actively searching for ongoing security incidents (e.g. when an IDS detects malicious traffic and alerts the network admin).

Proactive Detection

Happens when an organization actively researches and find flaws in their network and finds way to patch those before they can be used against it. Best examples are penetration testing and threat hunting.

Response

The organization's security policy should define who the first responder is, i.e. who gets notified immediately when an incident happen and is therefore for securing the system ASAP and documenting what happened. Make sure that whoever's handling the evidence is properly trained - any mistakes could render everything that will be collected inadmissible in court and cause major losses for the organization.

The next step is to collect evidence - as much as possible. This includes:

• capturing system images and data
• all information about the compromised system(s) (serial number, )
• screen shots
• interviewing witnesses
• documenting ALL of the details (date/times, locations, etc.)
• performing a sector-by-sector copy of the hard drive

When capturing data, prioritize the most volatile information. This means to capture a compromised or affected computer's RAM, since that will be erased on power-off. Then you can capture the system swap file or virtual RAM (depending on Linux vs Windows. Then you'd want to document all the active network connections that the time of the incident (connected IP addresses, browser cookies & history, and all system logs). From there, you might just want to backup the entire system itself.

#XIV

#Aplus