>> Hello. Welcome to Cybrary.
My name is Max Alexander,
and I will be your subject matter expert for
incident response, and advanced forensics.
Today, we're going to talk about
incident response policy.
The first thing we're going to talk
about is the creation or
implementation of policy, and procedures.
A lot of organizations,
especially if you're just getting started,
you may not have an adequate policy, or procedure.
It's important to clarify
policies, and procedures so individuals who
are joining your incident response team will
have a direction, and guidance of where they should go.
Basically, incident response policy will guide
the incident response team of
what actions they should take during incidence.
The policy should also place a higher priority on
incidents that pose a greater risk to the organization.
Essentially, if you're having all types of
incidents, or all kinds of incidents,
you're not going to want to wait
>> every incident equally.
>> Obviously, certain incidents would
have a higher priority than others.
Maybe a DDoS attack is
something you would want to devote a lot of time,
money, resources, and energy,
into trying to investigate, and remediate,
whereas maybe a spam email wouldn't want
the full force of the incident response investigation.
The response should also correspond to the priority
of the incident, and the risk
for the overall organization.
Again, that's just going back
and saying that if it's not really that big of a risk,
why bother devoting all of that time, and
money into investigating something
that's more or less trivial.
Defining risk, and deciding what needs security,
that should be the paramount task
in your risk assessment policy.
Ideally, we would want to secure
everything, and anything that we
could if money were no object,
but essentially,
what a lot of organizations will be
constrained by is money, and time.
Using this security Uber Alles method is not always
the best way to go about securing
things because we do have resource constraints.
We essentially can't secure everything,
and it does not provide the benefit for the cost.
We have to understand
what is this we want to protect that we value the most.
That's going to fall under asset valuation.
In order to do asset valuation,
we have to look at the total cost of
an asset to include the purchase price,
development, and maintenance cost, advertising cost,
cost for support, repair,
and replacement as well as the cost
due to loss of reputation, and so on.
Essentially, it is just asking if this asset
were to be destroyed, or you had to replace this asset,
you're having to think of all of the total cost
that it would require to replace that asset,
and that's keeping in mind
what we talked about previously,
is that there may be some hidden cost as well.
If you're heading to replace certain assets,
trying to think of the total cost
of research, and development,
media attention, and all of
those things that you may not necessarily think
up to be learned, and replace that asset.
The next thing that we're going to talk
about when we're looking at how to
secure, and what needs security is defining a threat.
Threat is a person, or a thing that is
likely to cause danger, or damage.
That could be an employee who doesn't have
a good idea of
information security, and clicks on an email,
it could be an external threat,
such as a hacker, or someone who wants to
break into your building, and steal your files,
all of those things would
necessarily be considered threats.
Then vulnerability is something
that is open to attack, harm, or damage.
It could be maybe an unpatched operating system
or an unpatched flaw that you have in software.
It could be a lock on a door
>> that doesn't work properly.
>> Those are vulnerabilities.
Then lastly is risk.
Risk is going to be defined as
the possibility that a threat
will exploit that vulnerability.
What is the possibility that
someone in your office might click on a link
that downloads some malicious software, and
wipes out their laptop, and puts ransomware on it?
Or what is the risk that some hacker is going
to exploit that vulnerability
in your unpatched software, and destroy your system?
[NOISE] How do we calculate loss?
Loss would essentially be able to help guide
the organization on prioritizing
what needs to be protected, and what doesn't.
Exposure factor is the first thing
that we would have to look at.
An exposure factor is defined as the percent
of loss of an asset if the risk materializes.
That's essentially expressed in
a numerical fashion of 0.0,
which is nothing, to 1.0,
which would be 100 percent.
Then the single loss expectancy.
Single loss expectancy is the cost of
a single realized risk against an asset,
and that's expressed in a dollar sign.
When you look at single loss expectancy,
that's essentially saying,
if this risk were to occur,
how much damage do I think
>> that I'm going to experience?
>> Then the annualized rate of occurrence is
the frequency occurrence of
the type of incident occurring.
1.0 is going to equate to one time a year,
2.0 is going to equate to two times a year,
0.1 is going to be one time in 10 years etc.
That just helps you calculate
the frequency of something occurring.
Then your annualized loss expectancy.
That's going to be calculated by multiplying
your single loss expectancy
with your annualized rate of occurrence.
For instance, if you had a single loss expectancy of
$75,000, and you were
expecting that to occur twice within that year,
then essentially you would end up
with $150,000 of damage.
Likewise, if you had something that was $75,000 of
damage, and you were expecting that to
occur once in 100 years,
you would have $75 for your annualized loss expectancy.
What you're going to do with
those numbers is essentially,
you're going to look at how much
>> it would cost to secure
>> something in order to prevent that from occurring.
You're looking at trying to prevent
that last example that's
expected to cost you a loss of $75 a year,
but you're essentially devoting
$100,000 into preventing that loss.
That's not a very good return on investment.
You never want the amount of
resources, and time that you're devoting to
something to cost more
than you expect it to cost your business.