Chapter 12: Dealing with Incident Response Procedures

To protect businesses against disasters, we must have solid incident response plans and procedures. There are many different types of incidents a company will face. For example, dealing with a flood is totally different from dealing with the failure of a server’s hardware. They will have many plans in place, one for each incident, and it is vital that employees know their role in the plan for it to be effective. The plan must be exercised at least on an annual basis to be effective. Let’s look at each of these in turn, beginning with the incident response procedures.

This chapter will deal with incident response and will be divided into the following elements:

• Incident Response Procedures
• Attack Frameworks
• Utilizing Data Sources to Support Investigations
• Knowing how to Apply Mitigation Techniques or Controls to Secure an Environment
• Implementing Cybersecurity Resilience

...

Incident Response Procedures

Before we start making incident response plans, we need to have a process in place, and the process we are going to use is as shown in Figure 12.1:

Figure 12.1 – Incident response process

The incident response process must be carried out in order, starting with stage 1, which is the preparation phase. Let’s look at these stages in order:

• Preparation: The preparation phase is where the different incident response plans are written and kept up to date. System configurations are documented as well.
• Identification: Once an incident has occurred, it is important that the appropriate incident response plan is invoked, and that stakeholders and the incident response team for that particular incident are notified.
• Containment: At this stage, we will isolate or quarantine computers, to prevent the attack from spreading any further and collect the volatile evidence. We will disable any accounts used by the...

Utilizing Data Sources to Support Investigations

There are many different types of data sources that cybersecurity teams can utilize to gain more knowledge and a clear understanding of how much damage has been done and the extent of the incident. Let’s look at the different types of data sources that we can search to support investigations, starting with a vulnerability scan output.

Vulnerability Scan Output

The vulnerability scanner can identify various vulnerabilities, such as software flaws, missing patches, open ports, services that should not be running, and weak passwords. This will help you avoid attacks such as SQL injection, buffer overflows, denial of service, and other type of malicious attacks. A credentialed vulnerability scan is the most effective as it provides more information than any other vulnerability scan.

SIEM Dashboards

Security Information Event Management (SIEM) dashboards are very useful to the security operations centers as they provide...

Knowing How to Apply Mitigation Techniques or Controls to Secure an Environment

Should we find that we have a vulnerability, we need to take action to mitigate the risk, so let’s look at some of the techniques or controls that we can use.

Reconfigure Endpoint Security Solutions

When technologies change or we suffer a data breach, we might have to reconfigure the endpoint security solutions. We are going to look at these types of configurations in the following sections, starting with an application approved list

Application Approved List

We can use application whitelisting where the approved applications are listed. This means that if an application is not listed, it cannot be launched. Some devices such as pf-sense have Allowed Lists. For the purposes of the Security+ exam, if we want to prevent users from installing applications or prevent malware from installing, we will create a whitelist. Neither the unauthorized applications nor the malware will be on the...

Implementing Cybersecurity Resilience

It is important that companies have redundancy or fault tolerance built in so that they are protected from cyber attacks.

Redundancy

Redundancy is the process of when one part of a system fails but we have the ability to keep the system running. It could also be referred to as fault tolerance. Let’s begin by looking at the different types of redundancy that companies could deploy. We will start with disks and then move on to geographical dispersal.

Disk

There is a need for the disk setup on servers to provide redundancy, sometimes known as fault tolerance. In simple terms, this means that if one or more disks fail, the data is still available. There are different Redundant Array of Independent Disks (RAID) levels, so let’s look at each of these in turn, starting with RAID 0:

• RAID 0: RAID 0 uses a minimum of two disks with a maximum of 32 disks; see Figure 12.4:

Figure 12.4 – RAID...

Review Questions

Now it’s time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. What RAID model has a minimum of three disks? How many disks can it afford to lose?
2. What RAID models has a minimum of four disks? How many disks can it afford to lose?
3. What is the difference between RAID 5 and RAID 6?
4. Where will a diskless virtual host access its storage?
5. What types of disks does a SAN use?
6. What is an example of cloud storage available to a personal user?
7. At what stage of incident response procedures would you reduce the services running on a computer on a domain controller that is infected with malware?
8. During a disaster recovery exercise, the IRP team is given a scenario to respond to. What type of exercise are they likely to carry out?
9. Why would a cybersecurity team use the MITRE ATT&CK Framework?
10. What are the four key elements...