Chapter 8. Incident Response Planning

An incident response plan contains the plans and procedures implemented by your information security program. It ensures that you have adequate and repeatable processes in place to respond to any information security incident that could affect your organizational network or information systems.

This is very apparent from the following news stories:

• Pizza Hut PCI data breach:
  • First reported on October 14, 2017
  • For more information: https://www.bleepingcomputer.com/news/security/users-report-fraudulent-transactions-after-pizza-hut-admits-card-breach/
• Deloitte data breach affecting customers across governments and businesses:
  • First reported on September 25, 2017
  • For more information: https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails

In this chapter, you will learn:

• Why you need an incident response plan
• What components make up the incident response plan
• Tools and techniques related to incident response
• The...

Do I need an incident response plan?

Yes, you do. Information security breaches are inevitable in today's highly complex and extremely interconnected world. A well-thought-out incident response plan will help to ensure that you have all of the necessary processes and procedures to hunt for threats in your environment, ensure that those threats are properly contained and eradicated, and that you are able to properly restore your organization to a state where business can resume.

Regardless of the size of your organization, you need to ensure that you have a well-thought-out process for how your organization will respond in the event of an information security incident. Of course, the size and complexity of your incident response plan will vary greatly depending on the size and complexity of your organization. Additionally, an incident response plan is not weighed by the pound. Your incident response plan should be concise and to the point.

The incident response plan is key to the success of...

Components of an incident response plan

As with most concepts presented in this book, ultimately, the incident response plan is a business plan and must be designed and implemented with your organization's mission and business in mind. Essentially, the purpose of your incident response plan is to ensure that your organization can continue operating and providing services.

The incident response plan comprises many phases, which make up the overall incident response program life cycle. This life cycle includes:

• Initial activities that initiate, plan, and implement the incident response capability, including:
  • Ongoing dialog with the organization's IT and business stakeholders to ensure that the incident response capability meets business objectives
  • The necessary planning to establish the organization's incident response capability as a functioning business program
  • Establishment of a repeated life cycle that will characterize the incident response process for the organization
• The repeatable operational...

Preparing the incident response plan

This includes not only the requirements needed to establish an enterprise incident response capability but also the necessary IT/cyber hygiene to ensure that enterprise and business unit information systems are properly defended.

The incident response program should not be siloed off from the rest of IT and information security planning. Considering this as the information responses capability is being planned any necessary technical updates that are discovered and are required to ensure that an information system is defensible should be captured and appropriately mitigated as part of the organization's risk management program.

Understanding what is important

As part of your preparation activities to conduct a successful incident response, you need to have a thorough understanding of what is important to your business/mission organization. If you have been following the guidance in this book to establish a successful information security program, then you...

Identification – detection and analysis

Now that we have gone through the process of preparation, we are now prepared to discuss the activities around detection and analysis.

A key concept that you must understand and develop as a core component of your incident response capability is the concept of incident triage. The reality is that not all incidents are treated the same, and by using a triage approach you are able to focus on the events that are important while ignoring the noise.

The following list provides a sample of the potential attack vectors that can be used by an attacker that the incident responder will need to be prepared to respond to. Each one of the following categories is very different in how it can be exploited, and therefore will require different mechanisms to discover abnormal behavior:

• Compromised credentials: An attack made possible due to the harvesting of information system credentials:
  • System (OS) / service account compromises
  • User account compromises

• Web attacks:...

Identification – incident response tools

We utilize people, processes, and technical tools to implement the identification phase of the incident response process, which includes detection and analysis.

Observational (OODA) technical tools

These types of tools allow the incident responder to have visibility into the network, allowing them to establish a baseline for what it normally looks like, and to easily visualize when anomalous behavior is occurring. Observational technical tools include:

• Host and network-based intrusion prevention and intrusion detection systems (IPS/IDS): These tools are put in place to perform real-time monitoring of your network and server/workstation activity. These tools are typically signature-based and look for suspicious activity that matches a preconfigured signature. If a condition matches a signature the tool will either block (IPS) or alert (IDS). The open source tool examples are as follows:
  • Suricata: https://suricata-ids.org/
  • OSSEC: https://ossec.github.io...

Remediation – containment/recovery/mitigation

Remediation is the point in the process where you, as the incident responder, engage the threat and work to protect the organization from further harm.

We are now at the point in the process where we perform the actions necessary to respond to the threat. This is made possible through the high-quality data made available through the observe and orient tools. We have taken that data and made an appropriate decision based on our organization's mission and legal requirements. With that decision, we implement the appropriate information security tools to do the following:

1. Contain the threat:
   • Initially limiting damage: Ensuring that the attacker is unable, or finds it very difficult, to cause damage to other information systems.
   • Fully containing threat: The reality is that as you respond to the incident you may not be able to fully contain the threat within the first few minutes of the incident. However, your goal is full containment so that you can...

Remediation - incident response tools

Remediation is the point in the process where you, as the incident responder, engage the threat and work to protect the organization from further harm.

Act (Response) (OODA) tools

Tools that should be part of an effective response toolkit include:

• Forensics tools: These tools allow you to accurately examine digital media using processes that allow for the establishment of a legal, sound, audit trail ensuring that you can accurately do the following:
  • Identify important investigative information for backup
  • Preserve identified information for future analysis
  • Analyze preserved information to uncover facts
  • Act on facts through further investigation, response, or reporting

Open source tool examples:

• • CAINE: http://www.caine-live.net/
  • SANS Investigative Forensic Toolkit (SIFT): https://digital-forensics.sans.org/community/downloads
• Backup tools: In most cases, it is safer to restore an environment from a backup rather than attempting to clean it after an intrusion has...

Post incident activity

We will cover post incident activity in the following sections.

Lessons-learned sessions

Once you have usefully closed out an incident, it is important that you conduct a lessons-learned session to determine the following:

• Where improvements need to be made in the process:
  • Do new procedures need to be created?
  • Do new alerts, signatures, and/or search parameters need to be added to automation tools?
  • Were the plans followed? Did we run around, scream, and shout?
  • Is training required?

Conducting a thorough lessons-learned session, with tasks to perform updates, will help to instill confidence that your incident response program is competent and that you are willing to address shortcomings and improve your own processes.

Once you have discovered actions, you must ensure that you complete those activities. Ensure that you develop tasks or projects as necessary to mitigate any of your discovered shortcomings in your incident response process.

Incident response plan testing

Like business...

Summary

The incident response plan ensures that the information security program has the necessary people, processes, and technologies in place to respond to an information security incident against your organizational information systems.

In this chapter, you learned:

• What makes up the incident response plan and why you use one
• What is needed to establish an effective incident response plan
• Automation, tools, and techniques needed to effectively support incident response activities

In the next chapter, you will learn about the security operation center. The security operations center serves to provide visibility and responses for the enterprise network, allowing for immediate action if an attacker is detected. The security operations center is a natural extension of the incident response discussion as your security operations center is typically tasked with the implementation and monitoring of the incident response plan.