>> As part of the education process
is that once we understand something
>> we can hopefully defend against it.
>> Since we know what it is,
we know essentially
>> how that an actor may want to attack us.
>> We can begin to essentially make
fortifications to our defenses.
We talked earlier about the cybersecurity paradox
and resiliency is going
>> to be the answer to that paradox.
>> Not to say that we shouldn't attempt to defend
>> against potential threats toward networks
>> but due to the cybersecurity paradox,
>> it's not if an incident is going to happen, but when.
Resiliency in the form of a business continuity plan
>> and disaster recovery plan is going to be
>> imperative in those first steps
to recovering from an incident.
Without a plan,
>> there's essentially not going to be a blueprint
>> directing employees on how or what to recover,
and then without that plan,
there's no way to test the plan to ensure
that it's going to be effective when needed.
So this whole idea of resiliency
is to essentially keep in mind
that emergency preparedness is
our best proactive defense
against a lot of these attacks.
A lot of folks and a lot of organizations
>> they say, "Well, I have antivirus,
>> I have my threat team, I'm good to go."
>> But they may not have put a lot of thinking
into the actual disaster recovery process itself.
While they may have an incident response team,
they don't have anything else that goes along with it
>> to help their organization
>> as they have some of these attacks occurring.
>> One of the more recent examples are the hospitals
>> that have been victim to malware.
>> They have great IT staff.
They essentially knew what to do
>> during the response phase,
>> but they didn't have any backups.
If they'd essentially backed up the data
>> and if they would have planned
>> for an incident like that to have occurred,
>> it would have made the overall impact
of that incident a lot less.
We talk about resiliency failures next.
So just because we have a plan in place,
doesn't necessarily mean that
>> it's a good plan or the right plan.
>> We want to test these plans
and we want to make sure that they work
>> and want to make sure that they make sense.
>> Then this is a case study from the Hurricane Sandy.
In this, you can see that
>> there's essentially generators
>> that are downstairs that would have helped a hospital
>> essentially have power during a blackout
>> such as Hurricane Sandy that wiped out
>> a lot of the power grid in that northeast sector.
>> There are a few places in the US
>> where hospitals have put as much thought
>> and money into disaster planning as New York
>> and yet two of the city's busiest medical centers
>> failed a fundamental test of readiness
>> during Superstorm Sandy,
>> they lost power and a patient in the hospital
>> is on life support I can tell you
>> that's probably not a good thing to have happen.
>> Both hospitals,
NYU Langone Medical Center
>> and Bellevue Hospital Center,
>> had difficulty determining
>> what exactly lead to their power failures.
>> But the culprit appeared to be
the most common type of flood damage there is,
>> water in the basement.
>> As you can see from those diagrams
that they had planned that,
yes, when power goes out,
we're going to have a generator up on the second roof,
and essentially the gas
to that generator will flow to it,
and then we will have power except that
>> they put the supply lines
>> and the basement which floods.
>> While both hospitals
>> put their generators on high floors
>> where they could be protected in the flood,
>> other critical components of the backup power system,
such as fuel pumps and tanks
remained in the basement
just a block from the East River.
Obviously, they thought
through the plan, they had a plan.
It just wasn't a good plan
>> and they didn't test the plan.
>> It's not essentially just having a plan,
it's thinking through all of the aspects of that plan.
Identify what can go wrong,
what can go right,
testing it, validating that plan,
and getting a third set of eyes to work over that plan
>> and make sure that it's going to work,
>> or we're going to have
>> one of those Homer Simpson Doh moments.
>> That's going to conclude the overall course for
incident response and
advanced forensics and incident recovery.
As we talk about in this section of the course,
incident recovery is going to be
our last phase of the incident response process.
Then in recovering,
>> we've hopefully gathered up a lot of the data
>> about the attack that we've had
and that's going to help us formulate
the strategy that we're going to use
to recover from that incident.
Now, keeping in mind that recovery,
again, as we discussed,
it's not just a purely technical aspect
>> that may involve many of the players
>> within your organization.
>> But once we've identified essentially the threat,
we know how it's acted and what it has done to network,
into our systems, we can then begin
that process of recovery.
Now, as part of that recovery, hopefully,
we've had some type of plan
>> and we've got some type of resiliency in place.
>> Then again, resiliency is going to help us
>> bounce back from those disasters
>> because without a plan,
>> we'll be just left wondering
about trying to figure out what to do.
But through our business continuity planning,
through testing these processes
and procedures, hopefully,
we've identified a way that
when and if disaster does occur,
that we're able to recover from
it a lot better and come back online.
Again, though,
if we don't test these plans and procedures,
we could end up like these hospitals
>> who thought they had a great plan
>> that weren't able to execute it
>> due to one of those Homer Simpson Doh moments.
>> Again, thank you for watching
the incident response and advanced forensics course.
I hope you liked it.
If you have any questions,
please write in, please e-mail.
We're always trying to update our course material
>> and we're more than happy to answer questions
>> or try and put together another course
>> for something you guys are interested in.
Again, thank you for watching,
and please join us again for
more exciting courses from Cybrary.