Hello, my name is David,
and welcome to Post Incident
Response, often
times sad to say we'd be
caught up in the technical
environment and
we overlook, I guess, what you
can call soft skills.
However, the soft skills
and the technical skills do
come together in a way
that can't be overlooked.
And if it is overlooked, then
you're not going to be, well,
well-rounded, holistic incident
response. And
hopefully we're
learning as we go where module five
already talking about some
incident activities, one
of which is incident recovery
that is falling
there. At the end of our response
process preparation,
we talked about briefly,
but scattered
throughout all of our
time together.
So far, preparation,
as you've seen, is a key element in
making sure that you can
completely and adequately perform
detection and analysis, containment,
eradication and recovery, and
then also your post incident
activity.
So as we move over to
post incident,
we are going to kind of
cover an element in
that third step, which is
containment, eradication and
recovery, because it falls,
I guess you could say it's fluid.
So it's going to happen
there early as the insect
response process.
Moves along, but
it also is going to be part of
your post instead of activity
as well, and it's important
to track these issues because if you
don't, you could very
easily lose track of what's going on
now. Recovery is
simplest definition is return
to normal activity.
That's true whether it's
surgery.
As you can see, my extra hardware
x ray there
that's attached to my
spine.
Now, they're pretty
big screws, actually.
But I went through back surgery
a couple years ago
and I had to recover
from that back surgery.
So it was.
You could say a long and torturous
road, and
it has to be handled correctly,
if it's not, you could actually
create and cause more
problems than what
you seek to solve
by having the surgery.
And when it comes the incident
response, the same thing holds very,
very true as
you move into the recovery phase.
After you've declared
your incident, after you've done
your evidence, gathering your
analysis and throughout
the process of the analysis, you're
developing indicators of compromise,
which are then passed out to other
teams on the incident response team,
like your firewall and
your network and your system
admins so that they can update
their tools moving into containment
now.
And as those indicators
are added to your toolset
and systems are identified
that were affected and they're
forensically captured and imaged
and examined and they
are reimaged and brought back
into service.
As you can see, that containment
issue is almost now moving directly
into recovery.
And whereas it may
be a long road and a hard road, it
has to be handled correctly or
you will recover completely
and you could expose
yourself to future
incidents based on the lack
of proper recovery.
Now, this stage of the process
does not reside
with the cybersecurity team.
As it's strictly defined
in the process,
you will be dealing with a wide
variety of other teams, like I
mentioned, exchange admins
or Rathmines database
admins, help desk
people in users, management,
legal resources.
Any time there's an incident
of any scope,
then you're going to see a lot of
different people brought in.
So as we move over into recovery,
you are actually going to be dealing
now instead more with administrators
and database admins and others
who are responsible for various
segments of the network and systems
that are attached to the network.
But I don't think
that that doesn't mean that you have
a role like you do,
especially whoever
is assigned as the incident manager,
because the authority is vested
in your manager in
order to make sure that
these steps are actually followed
through on and completed.
And that all has to be documented
by your incident recorder
or whoever may have been assigned
to that
position.
If these steps fail
and recovery is not completed
entirely, then again,
you can have some other issues to
deal with.
As I said, the incident manager sort
of becomes a playground monitor
here. He has to corral
all of these different
beings and persons in
positions together
to make sure that
the recovery process is still
flowing along and being properly
managed can handle.
If you've never been involved in an
incident, you're going to be.
Involved in a ton of meetings,
phone calls.
I find them to be highly annoying,
but they also are essential
because it's through those
calls in meetings that
all the responsible parties are
held to task or are
held to the fire, so to speak.
And if you don't have meetings,
you're not going to be able to
confirm that your recovery
process is actually flowing along
smoothly and rapidly
as well.
So if the incident manager
isn't calling meetings and
holding them and making sure that
these things are being followed up
on, then there's a problem
in the works that could hinder
the entire incident response
process.
I hate to say it, but the meetings
are essential, especially
if they're well managed and they
move along
in a methodical manner.
I know
sitting through these lessons
with me here in the past, I've
been involved in these meetings both
internally and externally, and
I've seen good and bad incident
managers.
And the assistant manager position
is one of extreme
authority and responsibility.
So that person, whoever is
assigned there, needs to be someone
who can manage a
wide variety of disparate
personalities or
story. We were doing tabletop
exercise for a company.
We show up and
what we're actually doing is meeting
with different entities
within the company.
So our first meeting was with the
security team.
They were our response
or stock analysts or
whoever was assigned to the security
team in order to help protect the
network.
And we went through the tabletop
with them and got to the
side where we were discussing the
problems that they were facing.
And they mentioned that they have
problems working with the exchange.
And so we go
on through a series of other
meetings.
Finally, we have all of the
leadership sitting in one room from
Cisco all the way down.
And the incident response team
leader was sitting across the table
from the exchange Agnon.
And by the time the meeting was
over, the two were screaming at each
other across the table and the
system basically just sat there
and did nothing to quell
the problem.
That is bad leadership,
everyone. So don't be that person.
Now, there are a lot of items
covered in the recovery that will
hit on here, restoring systems
to normal operation.
Some of these should be pretty
obvious to you by now.
Confirming the restoration is
important. Often times I've
seen systems are put back into
operation, but nobody confirms
remediating the vulnerabilities and
ensuring that they are fixed,
replacing compromised files with
clean versions.
Patching is huge,
but oftentimes difficult in the
corporate environment, but it needs
to be done.
Password changes should happen if
necessary.
Tightening the network security I
mentioned just a few minutes ago,
the perimeter needs to be checked.
Firewall admins need to be involved
sys admin so that you
can tighten down your perimeter and
make sure that no other attacks
might occur. The same
variety increase logging,
monitoring and auditing should also
come into play. Their
metrics comes into play.
I personally don't like metrics very
much, but I know and recognize
it is essential.
So how do you determine them?
A lot of people use cost.
They'll break it down by systems,
personnel, legal fees and fines.
There's this disruption.
Cost time could be a
useful metric when it comes to
recovery and measuring your
progress.
Different issues come into play
there. You can do lots of time,
do the system failure or loss.
You could do personnel time
that have been expended on the
incident.
So let's review quickly.
Define recovery for me.
Return to normal.
Who handles the recovery process?
The larger team with the incident
manager making
sure that is being taken care of
provide a good list of recovery
items. We just covered that
and defined metrics and provides
examples
on personnel
cost. Business disruption
could all be metrics to use to
judge the recovery process.
Do you have any questions?
Reach out to them on cyber.
Be one three five.
Have a great day.