Assumptions
These are the assumptions made for the <company name> in respect to how this incident response policy is developed.
- There already exists employees a part of an incident response team, monitoring and response.
- The Cyber Incident Response Team (CIRT) has a Security Information and Event Management (SIEM) tool that ingests networking traffic as well as successful/failed logins and has rules in place to create alerts.
- There will also be an Intrusion Detection System/ Intrusion Protection System (IDS/IPS) and Endpoint Detection and Response tool (EDR) in place to help detect and prevent potential malicious activity from occurring on the network.
- Web Servers are running onsite and are controlled internally.
Incident Response Policy
The incident response policy will include multiple parties to find and address the incident that will occur within the <company name> network. This policy will align with the SANS Institute Incident Handler’s Handbook.
The Cyber Incident Response Team will be incharge of monitoring the network activity internally and connecting points that fall on the perimeter of the company’s network. There is also a network team that is responsible for fixing internal networking issues and will be consulted if a networking issue is involved in an incident. There will also be outside contractors and vendors that may be consulted.
The manager of the incident response team, the Chief Information Security Officer, and the CEO will be notified of an incident at different points of the investigation. The manager of the incident response team will have the authority to declare an incident and minor remediation steps, like isolating user devices from the internal network, but not removing a production server from the internal network. The CISO has authority to declare any remediation steps.
Team structure and necessary relationships
The Cybersecurity Incident response team will be composed of security operations analysts and engineers that have varying knowledge of incident handling. This incident response team will be 24/7 and have coverage at all times to respond to identifying alerts.
The executive incident response team will include the incident response manager, the CISO, the networking team manager, and for some instances the CEO.
An outside vendor may be called when the CIRT manager believes the vendor may be able to give insight into the investigation or in the recovery stage to report. Additionally, in the aftermath, the CISO may need to contact the legal team and law enforcement to report the incident. In order to determine if contact is necessary, the CISO and CIRT manager should discuss legal obligations with the internal legal team.
Incident Response Procedures
This portion of the policy follows the SANS framework highlighting steps 2 through 7 and outlines the response for a website compromise.
2. Preparation
This phase of the policy is meant to prepare the team for identifying and responding to an incident found in the company’s environment.
- This policy is meant to encompass procedures for the company to follow when addressing incidents.
- This company will have periodic checking in place to scan their network and devices for potential compromises.
- The Cyber Incident Response Team (CIRT) has a Security Information and Event Management (SIEM) tool that ingests networking traffic as well as successful/failed logins and has rules in place to create alerts.
- There will also be an Intrusion Detection System/ Intrusion Protection System (IDS/IPS) and Endpoint Detection and Response tool (EDR) in place to help detect and prevent potential malicious activity from occurring on the network.
- CIRT members will have ongoing training to better learn how to respond to detections and how to perform throughout the incident.
- There should also be periodic vulnerability scans on servers to potentially find known vulnerabilities.
3. Identification
Identifying the indicator pointing to an attack involves knowing what is normal on the network and then being able to identify the abnormal to investigate further. This portion of the compromise may come in many forms. There may be an alert for many failed logins and then successful or network traffic to a suspicious external IP address. There may also be indicators of a malware download. These indicators may come through a SIEM, IDS, or anti-virus software.
During this identification process, CIRT members should be documenting indicators and evidence. CIRT members should be performing research based on the indicators like file hashes and IP origins. CIRT members should escalate to the CIRT manager once they believe there is an incident.
4. Containment
Once an incident is identified, the next phase is containment. This phase is meant to prevent further damage or exposure from occurring.
- If a website has been compromised there is potential access has been granted to the attacker to be within the network and potentially plant malware or command and control software.
- If there is a known compromised laptop/device then the CIRT manager will immediately authorize isolation of the device.
- If there is a known compromised production server, then the CIRT manager will escalate to the CISO, who will determine based on the information provided if the server can be taken offline and remediated.
- If the successful infiltration of the network is due to a compromised account, the account shall be disabled or forced password reset.
During the containment, forensic imaging of the device will take place to document the system as now evidence, including logs.
5. Eradication
This phase of the plan is the process of removing or remediating the issue, like changing passwords or deleting files and restoring to previous versions.
- If there is an account compromise, CIRT should force password reset of the user’s account
- If there is malware downloaded on the server or device, delete all files associated
- If any environment variables or registry keys were modified, reset or remove the variables.
- If restoring environment variables or registry keys or removing malware is not possible, then the computer will need to be reimagined.
6. Recovery
This part of the process includes returning the functionality of the compromised system back to normal.
- There should exist a way to test the compromised device before returning it to the network to determine if remediation was correctly implemented and there are no other potential compromises.
- There should also exist documentation that the testing occurred and was successful before returning the device to the network.
7. Lessons Learned
This part of the process is understanding what went right and what went wrong in the previous steps and devising steps to better the process. This part of the process is not meant to place blame on any missteps, it is meant to understand if all the processes in places were followed and if any changes should be made to them. The CIRT manager should receive information from their subordinates that were part of the incident and consolidate the information into an easy digestible document.
Communications Plan
This portion of the policy describes how effective communication will take place during the attack and afterwards.
3. Identification
During this phase, there will be communication between the CIRT members to help determine if the alert is an incident. The team member will report up to the manager of identifying features of the alert. Once determined that the alert is actually an incident, the CIRT manager will report the incident to the CISO depending on how severe the impact of the incident is.
4. Containment
During this phase, there will be communication between the CIRT members and the manager determining the spread of the attack and everything that is affected. As well as how they should be containing the incident and best practice.
5. Eradication
During this phase, there will be communication about steps being taken to remove the issue causing the incident. Additionally, there should be discussion on how to collect potential logs or files from the attacker as evidence. If there is a vendor specific attack, that vendor should be notified within this period, in order for them to perform an internal analysis.
Also at this phase, there should be discussion about bringing the incident to the attention of the internal legal team or law enforcement. The CISO will be the role designated with reaching out to these outside parties.
6. Recovery
During this phase, there will be communication between the CIRT members and the manager to make sure they are following best practices and discuss how to put the affected device back onto the network.
Additionally at this phase or within a reasonable time after identification of the incident, there should be discussion about alerting the media and customers that may have data exposed. This may need email or phone communication, even potentially retraining call center staff in preparation of the flood of concerned callers.
7. Lessons Learned
During this phase, there will be communication between the CIRT members and the manager to make sure there is documentation and evidence of all the events that occurred during the incident. The manager will add sections about lessons learned and how to improve processes. This may also be shared with the CISO and CEO.
References
Cichonski, Paul, et al. “Computer Security Incident Handling Guide.” National Institute of Standards and Technology, U.S. Department of Commerce, Aug. 2012, nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf.
Kral, Patrick. “Incident Handler’s Handbook.” SANS Institute Information Security Reading Room, 5 Dec. 2011, http://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901.
“SAMPLE INFORMATION SECURITY INCIDENT RESPONSE PLAN.” ISBA Mutual, EPlace Solutions, Inc., 2015, http://www.isbamutual.com/wp-content/uploads/2018/08/Cyber-Incident-Response-Plan.pdf.
This work is licensed under a Creative Commons Attribution 4.0 International License.
