Incident Response
- •
def
- •
the organized process of handling a security incident, following the NIST SP 800-61 (Incident Response Lifecycle)
- •
- •
preparation
- •
communication methods, incident handling hardware/software (laptops, removable media, forensic tools), analysis resources (documentation, network diagrams, baselines, critical file hashes), mitigation software (clean OS/app images), and clear policies so everyone knows their role
- •
- •
detection and analysis
- •
many different detection sources with varying detail; a high volume of activity makes separating real threats from noise a real challenge; analysis might reveal a buffer overflow attempt, malware identified by anti-virus, a host-based monitor detecting a configuration change, or network traffic deviating from the norm
- •
- •
isolation and containment
- •
letting an incident run its course is generally a bad idea, since it can spread quickly; sandboxes can be used to safely run and analyze malware, though isolation itself can sometimes trigger destructive behavior in malware designed to react to lost connectivity
- •
- •
recovery
- •
eradicate the cause (remove malware, disable breached accounts, fix vulnerabilities), then recover the system (restore from backups, rebuild, replace compromised files, tighten the perimeter)
- •
- •
lessons learned
- •
hold a post-incident meeting with everyone affected, promptly (memories fade); ask what happened, how the plan performed, what would be done differently, and which indicators to watch for next time
- •
- •