What is Cyber Security?

Cyber security is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It’s also known as information technology security or electronic information security. The term applies in a variety of contexts, from business to mobile computing, and can be divided into a few common categories.

·         Network security is the practice of securing a computer network from intruders, whether targeted attackers or opportunistic malware.

·         Application security focuses on keeping software and devices free of threats. A compromised application could provide access to the data its designed to protect. Successful security begins in the design stage, well before a program or device is deployed.

·         Information security protects the integrity and privacy of data, both in storage and in transit.

·         Operational security includes the processes and decisions for handling and protecting data assets. The permissions users have when accessing a network and the procedures that determine how and where data may be stored or shared all fall under this umbrella.

·         Disaster recovery and business continuity define how an organization responds to a cyber-security incident or any other event that causes the loss of operations or data. Disaster recovery policies dictate how the organization restores its operations and information to return to the same operating capacity as before the event. Business continuity is the plan the organization falls back on while trying to operate without certain resources.

·         End-user education addresses the most unpredictable cyber-security factor: people. Anyone can accidentally introduce a virus to an otherwise secure system by failing to follow good security practices. Teaching users to delete suspicious email attachments, not plug in unidentified USB drives, and various other important lessons is vital for the security of any organization.

WHAT IS INCIDENT HANDLING IN CYBER SECURITY?

In the fields of computer security and information technology, computer security incident management involves the monitoring and detection of security events on a computer or computer network, and the execution of proper responses to those events.

How to create an incident response plan 

An incident response plan should be set up to address a suspected data breach in a series of phases. Within each phase, there are specific areas of need that should be considered.

The incident response phases are:

1. Preparation
2. Identification
3. Containment
4. Eradication
5. Recovery
6. Lessons Learned

1. Preparation

This phase will be the work horse of your incident response planning, and in the end, the most crucial phase to protect your business. Part of this phase includes:

• Ensure your employees are properly trainned regarding their incident response roles and responsibilities in the event of data breach
• Develop incident response drill scenarios and regularly conduct mock data breaches to evaluate your incident response plan.
• Ensure that all aspects of your incident response plan (training, execution, hardware and software resources, etc.) are approved and funded in advance

Your response plan should be well documented, thoroughly explaining everyone’s roles and responsibilities. Then the plan must be tested in order to assure that your employees will perform as they were trained. The more prepared your employees are, the less likely they’ll make critical mistakes.
 Questions to address 

• Has everyone been trained on security policies?
• Have your security policies and incident response plan been approved by appropriate management?
• Does the Incident Response Team know their roles and the required notifications to make?
• Have all Incident Response Team members participated in mock drills?

2. Identification

This is the process where you determine whether you’ve been breached. A breach, or incident, could originate from many different areas.
 Questions to address 

• When did the event happen?
• How was it discovered?
• Who discovered it?
• Have any other areas been impacted?
• What is the scope of the compromise?
• Does it affect operations?
• Has the source (point of entry) of the event been discovered?

3. Containment

When a breach is first discovered, your initial instinct may be to securely delete everything so you can just get rid of it. However, that will likely hurt you in the long run since you’ll be destroying valuable evidence that you need to determine where the breach started and devise a plan to prevent it from happening again.

Instead, contain the breach so it doesn’t spread and cause further damage to your business. If you can, disconnect affected devices from the Internet. Have short-term and long-term containment strategies ready. It’s also good to have a redundant system back-up to help restore business operations. That way, any compromised data isn’t lost forever.

This is also a good time to update and patch your systems, review your remote access protocols (requiring mandatory multi factor authentication), change all user and administrative access credentials and harden all passwords.

 Questions to address 

• What’s been done to contain the breach short term?
• What’s been done to contain the breach long term?
• Has any discovered malware been quarantined from the rest of the environment?
• What sort of backups are in place?
• Does your remote access require true multi-factor authentication?
• Have all access credentials been reviewed for legitimacy, hardened and changed?
• Have you applied all recent security patches and updates?

4. Eradication

Once you’ve contained the issue, you need to find and eliminate the root cause of the breach. This means all malware should be securely removed, systems should again be hardened and patched, and updates should be applied.

Whether you do this yourself, or hire a third party to do it, you need to be thorough. If any trace of malware or security issues remain in your systems, you may still be losing valuable data, and your liability could increase.

 Questions to address 

• Have artifacts/malware from the attacker been securely removed?
• Has the system be hardened, patched, and updates applied?
• Can the system be re-imaged?

5. Recovery

This is the process of restoring and returning affected systems and devices back into your business environment. During this time, it’s important to get your systems and business operations up and running again without the fear of another breach. Questions to address 

• When can systems be returned to production?
• Have systems been patched, hardened and tested?
• Can the system be restored from a trusted back-up?
• How long will the affected systems be monitored and what will you look for when monitoring?
• What tools will ensure similar attacks will not reoccur? (File integrity monitoring, intrusion detection/protection, etc)

6. Lessons Learned

Once the investigation is complete, hold an after-action meeting with all Incident Response Team members and discuss what you’ve learned from the data breach.  This is where you will analyze and document everything about the breach.  Determine what worked well in your response plan, and where there were some holes. Lessons learned from both mock and real events will help strengthen your systems against the future attacks.

 Questions to address 

• What changes need to be made to the security?
• How should employee be trained differently?
• What weakness did the breach exploit?
• How will you ensure a similar breach doesn’t happen again?

Security incident management is the process of identifying, managing, recording and analyzing security threats or incidents in real-time. It seeks to give a robust and comprehensive view of any security issues within an IT infrastructure. A security incident can be anything from an active threat to an attempted intrusion to a successful compromise or data breach. Policy violations and unauthorized access to data such as health, financial, social security numbers, and personally identifiable records are all examples of security incidents.

Types of Security Incidents

• Brute force attacks—attackers use brute force methods to breach networks, systems, or services, which they can then degrade or destroy. …
• Email—attacks executed through an email message or attachments. …
• Web—attacks executed on websites or web-based applications.
• Unauthorized access to, or use of, systems, software, or data. Unauthorized changes to systems, software, or data. Loss or theft of equipment used to store or work with sensitive university data. Denial of service attack.

THE CYBERSECURITY INCIDENT MANAGEMENT PROCESS

As cybersecurity threats continue to grow in volume and sophistication, organizations are adopting practices that allow them to rapidly identify, respond to, and mitigate these types of incidents while becoming more resilient and protecting against future incidents.

Security incident management utilizes a combination of appliances, software systems, and human-driven investigation and analysis. The security incident management process typically starts with an alert that an incident has occurred and engagement of the incident response team From there, incident responders will investigate and analyze the incident to determine its scope, assess damages, and develop a plan for mitigation.

This means that a multi-faceted strategy  for security incident management must be implemented to ensure the IT environment is truly secure. The ISO/IECstandard/27035 outlines a five-step process for security incident management, including:

1. Prepare for handling incidents.
2. Identify potential security incidents through monitoring and report all incidents.
3. Assess identified incidents to determine the appropriate next steps for mitigating the risk.
4. Respond to the incident by containing, investigating, and resolving it (based on outcome of step 3).
5. Learn and document key takeaways from every incident.

Unlike most threats several years ago, which tended to be short-lived and easy to notice, many of today’s threats are more stealthy, specifically designed to quietly, slowly spread to other hosts, gathering information over extended periods of time and eventually leading to exfiltration of sensitive data and other negative impacts. Identifying these threats in their early stages is key to preventing subsequent compromises, and sharing information among organizations regarding the signs of these threats is an increasingly effective way to identify them.”

Seven key actions organizations should execute to handle effectively computer incidents:

1. Create, provision and operate a formal incident response capability.
2. Reduce the frequency of incidents by effectively securing network systems and applications
3. Document their guidelines for interactions with other organizations regarding incidents.
4. Prepare to handle any type of incident and more specifically to handle common incident types.
5. Emphasize the importance of incident detection and analysis throughout the organization.
6. Create written guidelines to prioritize incidents.
7. Use the lessons-learned process to gain value from incidents

Incident Response

• Preparation. Preparation is the key to effective incident response. …
• Detection and Reporting. The focus of this phase is to monitor security events in order to detect, alert, and report on potential security incidents. …
• Triage and Analysis. …
• Containment and Neutralization. …
• Post-Incident Activity.

BENEFITS OF EFFECTIVE INCIDENCE RESPONSE PLAN

When used appropriately, a proactive response plan aims to use electronically stored information efficiently to reduce risk while maximizing an organization’s ability to gather digital evidence. By executing a proactive plan versus a reactive plan, you can implement the measures necessary to benefit your business. This can also help you increase reaction or identification time for a potential event.

Crime Prevention

One of the biggest assets of an effective proactive incident response plan is a better ability to prevent crime. Cyber threats are, unfortunately, exceedingly common, especially when your company has something valuable to offer, like healthcare information or personal financial records.

Rather than living in fear, a proactive plan makes it easier to see when these kinds of threats are forthcoming. Thinking proactively offers numerous advantages to your crime prevention strategies, allowing you to better detect malicious activity and abnormalities. The more you know about your environment in a normal state, the quicker you will be able to identify an incident in the early stages. Rather than striking back after an assault has been initiated, you can do your best to stop an attack in its tracks when appropriate proactive measures are in place.

Reduced Investigative Costs

Facing a cyber attack comes with many necessary tasks, from investigating the source of a breach to implementing additional security measures to prevent current weaknesses from leading to further complications. Companies who do not prepare for the enduring possibility of attack are often shell shocked when something happens, making the investigation process longer and harder than ultimately necessary, but those who do are much more likely to be ready to take action.

A proactive incident response plan assumes that incidents are always possible, which makes acting on an issue much easier. Engaging with or, at the very least, identifying reputable outside resources can help reduce the price and turnaround time of negotiating during an incident. In addition, you won’t lose any time looking, vetting, and contacting investigative agencies; instead, you’ll be ready for anything at the first sign of trouble. No one wants to keep investigative resources on speed dial, but when something happens, you’ll be glad the connections are there.

Targeted Security Monitoring

When you aren’t expecting an attack, a surprise problem can create an internal panic, forcing you to channel all of your resources into figuring out what happened. This may seem like a good use of time and energy while in the midst of fighting back, but in reality, all you’re doing is leaving yourself vulnerable. When an organization is reacting to an incident, security controls are somewhat limited, which makes it more likely that an additional problem can catch you unawares while you’re distracted by what happened.

By using a proactive approach, your company has a better opportunity to implement targeted security monitoring that can identify many types of threats before they increase in severity, providing you with an opportunity to mitigate future problems. When you’re expecting an attack, you can put a game plan in place for how to respond to a crisis while still staying on top of current security practices.

Confidence of Clients and Investors

If you were looking to invest in a company or hire a company to provide services for you or your family, would you trust someone with a history of bungled security issues? How a business responds to a breach can be a huge deciding factor in public perception and consumer trust, whether creating a responsible persona or highlighting procedural failures. It only takes one publicized problem to seriously harm a reputation, making your response plans extremely valuable.

With a more proactive plan in place, organizations are better able to respond appropriately to incidents. By implementing a higher level of “security maturity,” it’s possible to grow investor and client confidence, both in security and across the board. A proactive plan can help reduce reputation risk during and in the aftermath of an incident, putting your company in a much better overall position.

Avoidance of Penalties

A security breach can feel like your world is crashing down around you, but some problems aren’t exclusively internal. Depending on the nature of your company and the kind of incident in question, outside authorities may require involvement. Law enforcement agencies may request the immediate release of any electronic info or related data at any time, and if you don’t have a plan in place for organization, there may be additional trouble on the horizon.

A proactive incident response plan lets you make necessary information readily available, allowing you to avoid any legal penalties by presenting forensically sound data quickly and efficiently. A reactive plan doesn’t afford the same flexibility, forcing you to collect information while in the midst of managing an unforeseen situation. This can seriously interfere with your security practices and procedures taking eyes off of your network and wasting time that could be devoted to rebuilding defenses.

Rather than building the wall higher and higher in an attempt to stop a security breach through reactive planning, a proactive plan can be the asset your company deserves. When you want to do right by your business, the proper professional resources can be a major advantage contact us always.  to learn more about how you can implement a proactive incident response plan to increase the effectiveness of risk management while safeguarding your business against attack.

Drop your comment