Of course, we want to try to prevent incidents,
but we have to be ready for when they happen.
We need to detect the incidents,
and this can come through use of various tools and technology that,
for example, detects a change in behavior on a system network or user,
looking for signatures of known types of attacks,
we often see this with, for example, malicious code,
heuristics,
which is a type of artificial intelligence and tries to learn when
there is something that maybe is undesirable.
We use alarms because they can notify us if there is something that's gone
wrong and an alert can come in that allow us as employees,
customers, suppliers, so we're able to be aware of a problem and,
of course, communicate that with these outside parties as well.
One of the things that can be important is to do audits and reviews
of how well we've handled incidents in the past.
What are the things we could learn?
When it comes to incident detection,
the first line of defense is often the help desk.
They are the first people who become aware of people
calling in and saying we're having a problem.
They have trouble tickets,
and we should look for trends and patterns in the types
of problems that people are having.
Alerts come in from our various monitoring systems,
maybe a security information event management system,
for example.
But when something goes wrong, our first priority must always be life safety,
looking after our employee's customers, and certainly,
the community around us as well.
But then we have to do some analysis of the incident.
The analysis of the incident should lead to a classification.
Is this really an incident or is it just noise?
It's not really serious and just we could call here a false positive,
or is it a true positive?
This is an incident and something we need to then immediately take action on.
The identification of it as a real incident should lead to the
classification of whether or not this is just a minor problem.
Is it serious or even catastrophic that could affect the whole organization,
for example.
Depending on the classification,
we can determine whether or not it's just an internal
problem or something has come from outside.
Was it something was done intentionally or just accidentally?
And then, of course, we activate the appropriate response teams.
If it's a minor incident, maybe just a few people are involved,
but if it's catastrophic,
it could be that we activate teams right up to the senior management
level and even our public relations group as well.
We want to contain incidents so we can contain the bad
effect or adverse impact of the incident,
and often, we'll do this through things like isolation.
We have a system that's infected, we disconnect it from the network.
In the case of a fire, we close fire doors,
we disable network connections,
we put a system into quarantine so we can examine and see what's going on.
And then quite often, this is where we'll use a sandbox.
A sandbox means we put, for example,
malware or an infected machine into a secure environment
where you can watch its execution, watch it,
what it's trying to do, but is limited into that area,
often a virtual machine, so it can't infect or spread to other systems.
One of the things we often will do,
power the system down and give us a chance to be able to
stop it from then continuing to generate whatever type of
malicious activity it's doing.
We then sometimes, in a minor incident, might just monitor.
For example,
we have things like honeypots where we can try to watch the type of activity,
or we see something that's going wrong and it's not
something which is spreading quickly,
but we can monitor so we can see whether or not there is
something going on and how that is developing.
We can learn maybe some of the behavior,
the tools and techniques of the attacker.
Some of the considerations when we want to contain or stop something from
spreading depends on whether or not this is a critical system.
If this is a system that is critical to business operations,
maybe I can't power it down or isolate it.
We also have to look is this something that's going to
spread or is it something which is just,
for example,
in one area and not going to start infecting other systems or networks.
We also said, in some cases,
we'll allow an attack to continue because we're trying to gather evidence,
we're trying to learn what's actually been going on so hopefully
we can improve our response and protection.
The key points review.
Incident management starts with preparation,
but then follows up with the ability, the watchfulness,
so we detect any type of an incident.
Then we need to classify the incident so we can respond appropriately.