1 / 15

INCIDENT RESPONSE IMPLEMENTATION

INCIDENT RESPONSE IMPLEMENTATION. David Basham University of Advancing Technology Professor: Robert Chubbuck NTS435. Incident Response: The Need.

cara-wade
Download Presentation

INCIDENT RESPONSE IMPLEMENTATION

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. INCIDENT RESPONSE IMPLEMENTATION David BashamUniversity of Advancing Technology Professor: Robert ChubbuckNTS435

  2. Incident Response: The Need Due to an increase in the number of threats to networks both internally and externally there is a need not only for the detection of breaches but a prompt response to such events. In order to help safeguard our organization’s data and the privacy of our clients an Incident Response plan will be implemented based on the NIST Computer Security Incident Handling Guide (SP 800-61)

  3. INCIDENT RESPONSE: Policy Development Management Commitment In order for an Incident Response plan to be of use we will need to have the commitment, coopoeration, and support of the various heads of management. This will require the overall idea to be discussed among those managers and their agreement. • Managers Involved • CEO • COO • CAO • CIO • Second Level Managers

  4. INCIDENT RESPONSE: Process of Development Step 6 Step 2 Step 3 Step 4 Step 5 Step 1 • Establish Team for development of Incident Response Plan (IRP) • Define scope of policy and Organizational Structure of IRT. • Prioritize the severity of different incidents • Create Standard Operating Procedures (SOP’s) • Test SOP’s in various scenarios for soundness. • Roll out final Incident Response Plan. • Define what constitutes a security incident. • Develop Audit procedures for IRP. • Review tests and change SOP’s as needed. • Identify third parties requiring contact. • Define roles of team members. • Begin Selection of IRT Members. • Establish timetable for completion. • Review NIST SP 800-61 • Develop drafts of reporting and contact forms. • Develop Performance Measurements. • Review final draft with appropriate Management • Begin Training for members of IRT.

  5. INCIDENT RESPONSE: Basic Model Selection Team Model • Internal Due to the size of the organization combined with the sensitive nature of the information that is being protected it will be best to use a fully internal team consisting of employees. • Central Incident Response Team Currently the structure of the organization does not create the need for more than one response team. However, furture expansion may mean converting this model to that of Distributed Incident Response Teams .

  6. INCIDENT RESPONSE: Suggested Basic Team Structure Upper Management Incident Response Team Lead Technical Lead IT Liaison Public Relations Liaison Support Staff

  7. INCIDENT RESPONSE: Interdepartmental Dependencies • The following departments will designate a liaison to work with the IRT when needed. • Legal Department • Human Resources • Facilities Management • IT Central Support

  8. INCIDENT RESPONSE: IRT Services Intrusion Detection The monitoring and detection portion of network security is handled by a group that falls under both IRT and IT. The members that work on intrusion detection are under the management of IT, but their services and direction fall under the IRT. Advisory Distribution Should our organization reach the size where destributed incident response teams are used the notification about new threats and vulnerabilities to the other teams (and appropriate personel) will become part of the standard operating procedures. Education and Awareness The IRT will contribute to the training and awareness of the organization’s users in order to proactively combat some of the simpler avenues of attack.

  9. INCIDENT RESPONSE: Third Party Contacts Customers, Constituents, & Media Law Inforcement Agencies Internet Service Providers Incident Response Team Trustwave: Spider LabsIncident Response Statistics Software & Support Vendors

  10. INCIDENT RESPONSE: Proposed IRT Cycle Detection Proactive or Reactive defense. Preparation Internal checks and training. Preparation Detection Review Analyze effectiveness of response. Containment Eradication and Recovery. Review Containment Post-Incident Activity Contacting Third Parties and Press Release if needed.. Post-Activity

  11. INCIDENT RESPONSE: Interdepartmental Exchange of Control • Network Security Group • Monitoring for events and informing the IRT when one occurs. • Internal Audit • Assumes control after IRT cycle and reviews to ensure completion. • Incident Response Team • Assumes control of Incident and directs efforts until completion of IRT cycle.

  12. INCIDENT RESPONSE: Documentation Current Status of the Incident Upon completion of the IRT Cycle this documentation should cover the current state of the incident and any remaining problems or suggestions. Incident Summary This documentations should summarize the incident in question from its detection to final analysis. All actions taken by the Incident Response Team In order to keep track of changes and for reference purposes any and all changes/actions taken by the IRT should be documented. Impact Assessment An analysis of the overall impact (financial, reputation, etc…) should be included as documentation for reference and legal purposes. Cycle Summary A shortened summary of the important details of the IRT cycle should be documented for reference purposes.

  13. INCIDENT RESPONSE: Law Enforcement Involvement Local Police In instances of local disturbances, physical break-ins and incidents caused by employees the findings will be turned over to local police and charges filed should it be decided that it is warranted by the legal department. S.L.E.D. In instances of computer crime that does not leave the boundaries of the state of South Carolina the South Carolina Law Enforcement Division will be notified and brought into the investigation if deemed nescisary by the legal department. F.B.I. In instances of computer crime that cross state lines or if it involves the breaking of Federal law the Federal Bureauof Investigation will be notified and brought into the investigation if deemed nescisary by the legal department.

  14. INCIDENT RESPONSE: Media Involvement In certain cases a security incident may require some kind of statement or media publication. In order to best protect our organization no one outside the public relations department (Senior Level Management excluded) is authorized to represent the company in any form of media. The IRT will coordinate with the PR, legal, and other necessary departments to create any press and/or media releases.

  15. Incident Response: References Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012, January 31). Computer Security Division - Publications: Drafts. Retrieved June 9, 2012, from National Institute of Standards and Technology: http://csrc.nist.gov/publications/drafts/800-61-rev2/draft-sp800-61rev2.pdf Henderson, C. (2011). Retrieved June 9, 2012, from Build Security In: https://buildsecurityin.us-cert.gov/swa/presentations_032011/CharlesHenderson-2011GlobalSecurityStatsAndTrends.pdf

More Related