>> Hello, and welcome to Cybrary.
My name is Max Alexander.
I'm going to be your subject matter expert for
Cybrary's Incident Response and
>> Advance Forensics course.
>> Today, we're going to talk about
the introduction to incident response.
To understand incident response,
we first need to provide
an overview of cybersecurity paradox.
Modern computer systems and
networks were designed to be connected.
To enable companies and businesses
>> to share information,
>> to reach out and touch customers,
and to just be interactive with each other,
with their employees,
we need that connectivity
within our networks and systems.
That being said,
no information system is going
>> to be 100 percent secure,
>> but that doesn't mean that we shouldn't try.
Lieutenant Colonel George Jacobson
during the Vietnam War said,
"Security is either 10 percent or 90 percent,
>> depending on the expert that you talk to.
>> But there is not any expert that will doubt that its
either the first 10 percent of
the first 90 percent." That's important.
Cybersecurity is the backbone
>> to protecting our networks,
>> to protecting our information,
to protecting our data systems,
so we still have to do that.
That being said, no matter what we do,
no information system is going
>> to be 100 percent secure.
>> Regardless of the measures that we put in place,
there's always going to be some type
of risk and some type of threat.
Even if we harden
the system as hard as we could make it,
there's going to be some type of
end-user or a person that
can interfere with that security and
users are always going to be the weakest link.
In very large organizations,
you're going to have individuals who
may not be very computer savvy,
and they might click on malicious links
>> or go to websites that they shouldn't go
>> to and that's going to endanger your system
because obviously, it was designed to be connective,
and there's that vulnerability
that that user could expose you to.
That being said, cybersecurity incidents will occur and
organizations must know how to respond to
those incidents as part of
due care and due diligence to their customer.
But also just as part of being a good business owner,
it's important to respond to
these cybersecurity incidents to
protect your proprietary information,
because that's what keeps you in business.
Or if we say the target incident,
you are not able to protect your networks,
your data systems that well,
it could impact your business
and other people may want to go shop at somewhere else.
It's very important to do that.
But to dovetail off of what Colonel Jacobson said,
Colonel T.E. Lawrence
>> from Lawrence in Arabia fame said,
>> "Defeating insurgents is messy and slow,
like eating soup with a knife."
That ties into this cybersecurity paradox
and to the constant threat
that is posed to information systems,
and computers, and networks.
We're always going to end up having to
fight this cybersecurity battle.
Technology advances every day,
there's new threats, there's new viruses,
so we're on the losing end
>> of that battle because there's
>> always someone out there trying to
one up the cybersecurity expert.
Therefore, these incidents are going to occur and
we have to know how to deal
with them and respond to them.
>> What is a cyber incident response?
>> To look at that, we can go to the
>> NIST Publication 800-61
>> and the Computer Security Response Center, CSRC,
>> of the National Institute of Standards and Technology,
NIST, defines both events
and incidents in that publication,
the security incident handling guide.
Whereas an event is described simply as
an observable occurrence in a system or network,
an incident is defined as a violation or
a threat of computer security policies,
acceptable use policies,
or standard security policies.
That's a lot of information.
To summarize that,
an incident is any violation of
your organization's security policies or
procedures that compromises or
attempts to compromise the confidentiality,
integrity, or availability of
that information so that CIA triad,
if you're a CISSP or studying for that CISSP,
anything that is going to or potentially
compromise that CIA triad is going to be an incident.
Each organization is going to be different.
They may have their own set of laws, regulatory rules,
administration procedures, policies,
guidelines that it's going to use
to defining a cybersecurity incidents.
It's important to check with
your organization if they've already got rules in
place to see what is defined as an incident.
How do cybersecurity incidents occur?
There's going to be many paths that are
going to lead to the occurrence of
the cybersecurity incident and they're
going to require some response.
Some of the most common ways
that incidents are going to occur,
and these are just a small list of incidents,
there is obviously more,
one of the first one is negligence.
If you're in a classified information setting,
or you've got proprietary information,
or sensitive information,
that could be mishandling that information.
If you're on a system and you've got access to
social security numbers or you've got
access to that proprietary information,
mailing that out to
someone who shouldn't have access to that,
that could cause great harm to your organization.
That is something to take into consideration.
Insider threats.
This is something that is emerging right now that
it's been going on since the dawn of time,
but it's now just coming into
the light and something that
we're going to have to deal with.
Some of those incidents
are example by Edward Snowden, Private Manning.
Regardless of whatever you
think their actions were right or wrong,
the organizations that they worked for feel
>> that they caused grievous harm to that organization.
>> We'll talk more about cyber insider threat later on and
just the type of
problems that they can cause for your organization.
Criminal activity is another type
of threat that are posed to information systems.
That could include data theft,
loss of trade secrets.
Someone hacking into your network and
accessing social security numbers,
credit card data, or
that proprietary information that
makes your business special.
Those are important consideration.
The basic theft of funds,
crimeware, ransomware,
having someone have to pay to access their data
again or obtain access to their computer systems.
Denial of service is the next one,
maybe it's an insider threat
that has planted some type of logic bomb
>> that prohibits you from accessing information.
>> Or distributed denial of
service attack like what Iran launched against
United States banking websites that
stopped their customers from going to the websites.
Could be extortion, again,
ransomware is another type of extortion
>> or the Sony hack,
>> which we'll also talk about later on,
trying to blackmail someone
to do something or not do something.
You have hacktivism, which is exemplified by anonymous.
They believe what they're doing is
the right thing and they take essentially action
by hacking people who they don't agree with
to some political ideology or end.
Then hacking for thrills.
You're going to have your
>> basic low-level script kiddies
>> all the way up to your advanced hackers,
>> such as Guicifer.
>> These are types of how cybersecurity incidents occur.
Again, this is not an all inclusive list,
but these are just some examples of
how and why they occur.