Incident response relies on existing security infrastructure tools such as logging systems, intrusion
and detection and prevention systems, and security information and event management systems to provide
us with a prevention methodology for incident response.
The incident response cycle includes four distinct phases, the first one being prevention.
We want to win all possible to prevent an attack from occurring.
That's our primary goal.
However, as once somebody once said it's not a matter of if we have a data breach, it's only a matter
of time.
We want to detect and analyze any problems in our network.
Obviously, if prevention doesn't work and we have a data breach, we need to be able to detect the
problem as it's occurring.
If we can't detect it while it's occurring, we want to be able to detect it as soon as possible.
This is where a detection analysis comes into play.
We want to be able to detect the problem, how it got in, what vulnerability it exploited, and analyze
what the problem is occurring throughout our network.
Finally, we want to contain the issue.
Once we've contained it, we want to eradicate it.
And then we want to come back to the normal working standard that our system was utilizing before the
incident occurred.
Once that's all been taken place, we need to do an R or an after action review.
During this review process, we're going to identify what we could have done better so that the vulnerability
never got exploited in the first place.
We want to verify could we have done this faster.
Was there certain problems that we saw?
We want to continually I understand that we're not perfect people.
Those problems that exist can be recovered from and bring it up as a learning process.
Within containment we have segmentation.
Segmentation prevents direct communication between hosts of different segments from talking.
This reduces lateral movement by attackers, much like you may see in segmentation for network architecture,
where you need to segment a machine off of our network.
If I have a machine in the HR department or several machines in the HR department that have been infected
with a malware, I need to segment them off my network as quickly as possible.
I don't want them to have communication with other machines either on that segment or cross segment
it into a different department, such as operations or maintenance.
By segmenting the traffic either through VLANs or access control lists, I can thereby restrict traffic
from that machine that's been infected from communicating with other machines.
I can also do what's called isolation.
Isolation takes segmentation one step further.
I can isolate the machine in such a way that I can monitor what's going on.
It has no communication outside of what I allow it to have.
It's the next stage or the next evolution of segmentation.
When you come down to it, I'm isolating that machine or that series of machines, and I'm monitoring
to see what's going on within the process.
What files are they moving?
Are they doing a ransomware attack?
Are they encrypting my files?
Are they communicating with a server offsite?
I want to be able to monitor everything that that machine is going through, so that I can quickly identify
if there was a specific portion of the malware that maybe we hadn't seen through our normal detection
analysis Process.
This is where isolation is really key.
Finally, I want to remove the problem.
Once I've identified all the threat intelligence that I can off that machine, I want to remove the
item from my network as a whole.
This means unplugging it or moving the hard drive.
It could be physically going to the device and logically pulling the plug, or just simply cutting off
the internet connection altogether and not allowing it to proceed forward with any further communication
across the network.
We want to remove the threat from our network.
Once we've gathered all the Intel or data that we possibly can.
That brings us to our next phase of eradication.
I want to be able to remediate the problem.
Once I've identified everything that's occurring.
I want to remediate the core problem within the machine and the vulnerabilities that it utilized.
The vulnerability could be a simple patch, or it could be a singular issue with a phishing email where
somebody clicked on a link, whatever it is, whether it's an antivirus program to remove malware off
the machine from a phishing link or it's a vulnerability that an attacker may have exploited, I want
to go through and remediate the problem as best I can.
However, sometimes remediation isn't always possible through a preferred means.
There may be financial constraints or business constraints.
It could be a lack of technology.
It could be any number of things.
If that's the case, I may want to use something called compensating controls.
Compensating controls allow for resource constraints such as budget personnel availability to take place
and bring the same level.
And I want to repeat that the same level of remediation to the problem without spinning the original
idea.
I may have a device that 100% is the problem, and I just plug it in and it fixes the issue.
Something like a firewall if I need an access control list to be in play.
However, if that's not possible due to these constraints, I can use compensating controls to limit
the structure and perform the same principle that the original device or the original fix would have
occurred.
I also want to do vulnerability mitigation.
Once we recover from the incident, we want to restore the system to pre-incident state, but also ensure
similar disruptions don't occur in the future.
We want to mitigate those problems by eliminating the root cause of the event or the incident once we've
identified what occurred.
This vulnerability mitigation fixes the core root of the problem and identify specific vulnerabilities
in order to remediate those specific issues that allowed the incident to occur in the first place.
Finally, I want to sanitize.
Once we talk about sanitization, we're referring to rendering access to the data or the event media
infeasible for future use.
If I have a piece of malware that I just can't get rid of on an antivirus program, the best thing may
to be just to overwrite the data with zeros and ones and reimage the device.
Eradication when we talk about sanitization can mean overwriting the data.
It could also mean encrypting the data so that somebody doesn't have access to it before degaussing,
or even destroying the data as a whole.
Any one of these items to sanitize the data to ensure that it cannot be reutilized or used by an attacker
in the future, is what we call sanitization.
Finally, I want to recover or reconstruct the issue.
When we talk about reconstruction or reimaging the device, we often refer to a device or a problem
that's had an issue and we just can't fully 100% get past it.
This is where reimaging or reconstructing take place.
When I re-image a device, I'm literally wiping the drive and putting the brand new operating system
on top of it.
It's not uncommon if I've got a piece of malware inside of a lone client, and that client is causing
some issues just to wipe the drive, re-image it and hand it back to the employee as a fresh, brand
new machine.
This is what's referred to as Reimaging.
However, I may sometimes have to reconstruct it.
Maybe it's a server where I've got one little issue that I just can't get past.
I can reconstruct the entire system in such a way that it ignores that one piece of malware, and then
I can rewrite or destroy that piece of malware.
It's the long about way of doing it.
Unlike an antivirus, uh, protocol, but it still does the same job.