Preparation

CSIRTs do not spring up out of thin air. As much as managers may wish it were so, they cannot simply will a CSIRT into existence by creating a policy document and assigning staff members to the CSIRT. Instead, the CSIRT requires careful preparation to ensure that the CSIRT has the proper policy foundation, has operating procedures that will be effective in the organization's computing environment, receives appropriate training, and is prepared to respond to an incident.

The next two sections of this chapter, “Building the Foundation for Incident Response” and “Creating an Incident Response Team,” describe the preparation phase in greater detail.

The preparation phase also includes building strong cybersecurity defenses to reduce the likelihood and impact of future incidents. This process of building a defense-in-depth approach to cybersecurity often includes many personnel who might not be part of the CSIRT.

During the preparation phase, the organization should also assemble the hardware, software, and information required to conduct an incident investigation. NIST recommends that every organization's incident response toolkit should include, at a minimum, the following:

• Digital forensic workstations
• Backup devices
• Laptops for data collection, analysis, and reporting
• Spare server and networking equipment
• Blank removable media
• Portable printer
• Forensic and packet capture software
• Bootable USB media containing trusted copies of forensic tools
• Office supplies and evidence collection materials

You'll learn more about the tools used to conduct the incident response process in Chapters 12, 13, and 14.

Detection and Analysis

The detection and analysis phase of incident response is one of the trickiest to commit to a routine process. Although cybersecurity analysts have many tools at their disposal that may assist in identifying that a security incident is taking place, many incidents are only detected because of the trained eye of an experienced analyst.

NIST 800-61 describes four major categories of security event indicators:

• Alerts that originate from intrusion detection and prevention systems, security information and event management systems, antivirus software, file integrity checking software, and/or third-party monitoring services
• Logs generated by operating systems, services, applications, network devices, and network flows
• Publicly available information about new vulnerabilities and exploits detected “in the wild” or in a controlled laboratory environment
• People from inside the organization or external sources who report suspicious activity that may indicate a security incident is in progress

When any of these information sources indicate that a security incident may be occurring, cybersecurity analysts should shift into the initial validation mode, where they attempt to determine whether an incident is taking place that merits further activation of the incident response process. This analysis is often more art than science and is very difficult work. NIST recommends the following actions to improve the effectiveness of incident analysis:

• Profile networks and systems to measure the characteristics of expected activity. This will improve the organization's ability to identify abnormal activity during the detection and analysis process.
• Understand normal behavior of users, systems, networks, and applications. This behavior will vary between organizations, at different times of the day, week, and year and with changes in the business cycle. A solid understanding of normal behavior is critical to recognizing deviations from those patterns.
• Create a logging policy that specifies the information that must be logged by systems, applications, and network devices. The policy should also specify where those log records should be stored (preferably in a centralized log management system) and the retention period for logs.
• Perform event correlation to combine information from multiple sources. This function is typically performed by a security information and event management (SIEM) system.
• Synchronize clocks across servers, workstations, and network devices. This is done to facilitate the correlation of log entries from different systems. Organizations may easily achieve this objective by operating a Network Time Protocol (NTP) server.
• Maintain an organizationwide knowledge base that contains critical information about systems and applications. This knowledge base should include information about system profiles, usage patterns, and other information that may be useful to responders who are not familiar with the inner workings of a system.
• Capture network traffic as soon as an incident is suspected. If the organization does not routinely capture network traffic, responders should immediately begin packet captures during the detection and analysis phase. This information may provide critical details about an attacker's intentions and activity.
• Filter information to reduce clutter. Incident investigations generate massive amounts of information, and it is basically impossible to interpret it all without both inclusion and exclusion filters. Incident response teams may wish to create some predefined filters during the preparation phase to assist with future analysis efforts.
• Seek assistance from external resources. Responders should know the parameters for involving outside sources in their response efforts. This may be as simple as conducting a Google search for a strange error message, or it may involve full-fledged coordination with other response teams.

You'll learn more about the process of detecting and analyzing a security incident in Chapter 12, “Analyzing Indicators of Compromise.”

Containment, Eradication, and Recovery

During the incident detection and analysis phase, the CSIRT engages in primarily passive activities designed to uncover and analyze information about the incident. After completing this assessment, the team moves on to take active measures designed to contain the effects of the incident, eradicate the incident from the network, and recover normal operations.

At a high level, the containment, eradication, and recovery phase of the process is designed to achieve these objectives:

1. Select a containment strategy appropriate to the incident circumstances.
2. Implement the selected containment strategy to limit the damage caused by the incident.
3. Gather additional evidence as needed to support the response effort and potential legal action.
4. Identify the attackers and attacking systems.
5. Eradicate the effects of the incident and recover normal business operations.

You'll learn more about the techniques used during the containment, eradication, and recovery phase of incident response in Chapter 14, “Containment, Eradication, and Recovery.”

Postincident Activity

Security incidents don't end after security professionals remove attackers from the network or complete the recovery effort to restore normal business operations. Once the immediate danger passes and normal operations resume, the CSIRT enters the postincident activity phase of incident response. During this phase, team members conduct a lessons learned review and ensure that they meet internal and external evidence retention requirements.

Policy

The incident response policy serves as the cornerstone of an organization's incident response program. This policy should be written to guide efforts at a high level and provide the authority for incident response. The policy should be approved at the highest level possible within the organization, preferably by the chief executive officer. For this reason, policy authors should attempt to write the policy in a manner that makes it relatively timeless. This means that the policy should contain statements that provide authority for incident response, assign responsibility to the CSIRT, and describe the role of individual users and state organizational priorities. The policy is not the place to describe specific technologies, response procedures, or evidence-gathering techniques. Those details may change frequently and should be covered in more easily changed procedure documents.

NIST recommends that incident response policies contain these key elements:

• Statement of management commitment
• Purpose and objectives of the policy
• Scope of the policy (to whom it applies and under what circumstances)
• Definition of cybersecurity incidents and related terms
• Organizational structure and definition of roles, responsibilities, and level of authority
• Prioritization or severity rating scheme for incidents
• Performance measures for the CSIRT
• Reporting and contact forms

Including these elements in the policy provides a solid foundation for the CSIRT's routine and crisis activities.

Procedures and Playbooks

Procedures provide the detailed, tactical information that CSIRT members need when responding to an incident. They represent the collective wisdom of team members and subject matter experts collected during periods of calm and are ready to be applied in the event of an actual incident. CSIRT teams often develop playbooks that describe the specific procedures that they will follow in the event of a specific type of cybersecurity incident. For example, a financial institution CSIRT might develop playbooks that cover

• Breach of personal financial information
• Web server defacement
• Phishing attack targeted at customers
• Loss of a laptop
• General security incident not covered by another playbook

This is clearly not an exhaustive list, and each organization will develop playbooks that describe their response to both high severity and frequently occurring incident categories. The idea behind the playbook is that the team should be able to pick it up and find an operational plan for responding to the security incident that they may follow. Playbooks are especially important in the early hours of incident response to ensure that the team has a planned, measured response to the first reports of a potential incident.

Documenting the Incident Response Plan

When developing the incident response plan documentation, organizations should pay particular attention to creating tools that may be useful during an incident response. These tools should provide clear guidance to response teams that may be quickly read and interpreted during a crisis situation. For example, the incident response checklist shown in Figure 11.2 provides a high-level overview of the incident response process in checklist form. The CSIRT leader may use this checklist to ensure that the team doesn't miss an important step in the heat of the crisis environment.

Incident Response Providers

In addition to including internal team members on the CSIRT, the organization may decide to outsource some or all of their actions to an incident response provider. Retaining an incident response provider gives the organization access to expertise that might not otherwise exist inside the firm. This may come at significant expense, so the organizations should decide what types of incidents may be handled internally and which justify the use of an outside provider. Additionally, the organization should understand the provider's guaranteed response time and ensure that it has a plan in place to respond to the early stages of an incident before the provider assumes control.

CSIRT Scope of Control

The organization's incident response policy should clearly outline the scope of the CSIRT. This includes answers to the following questions:

• What triggers the activation of the CSIRT? Who is authorized to activate the CSIRT?
• Does the CSIRT cover the entire organization or is it responsible only for certain business units, information categories, or other divisions of responsibility?
• Is the CSIRT authorized to communicate with law enforcement, regulatory bodies, or other external parties and, if so, which ones?
• Does the CSIRT have internal communication and/or escalation responsibilities? If so, what triggers those requirements?

Internal Communications

Internal communications among the CSIRT and with other employees within the organization should take place over secure communications channels that are designated in advance and tested for security. This may include email, instant messaging, message boards, and other collaboration tools that pass security muster. The key is to evaluate and standardize those communications tools in advance so that responders are not left to their own devices to identify tools in the heat of an incident.

External Communications

CSIRT team members, business leaders, public relations teams, and legal counsel may all bring to the table requirements that may justify sharing limited or detailed information with external entities. The incident response plan should guide these efforts. Types of external communications may include the following:

• Law enforcement may wish to be involved when a cybersecurity incident appears to be criminal in nature. The organization may choose to cooperate or decline participation in an investigation but should always make this decision with the advice of legal counsel.
• Information sharing partners, such as the Information Sharing and Analysis Center (ISAC), provide community-based warnings of cybersecurity risks. The organization may choose to participate in one of these consortiums and, in some cases, share information about ongoing and past security incidents to partners in that consortium.
• Vendors may be able to provide information crucial to the response. The manufacturers of hardware and software used within the organization may be able to provide patches, troubleshooting advice, or other guidance crucial to the response effort.
• Other organizations may be actual or potential victims of the same attack. CSIRT members may wish to coordinate their incident response with other organizations.
• Communications with the media and the general public may be mandatory under regulatory or legislative reporting requirements, voluntary, or forced by media coverage of a security incident.

It is incumbent upon the CSIRT leader to control and coordinate external communications in a manner that meets regulatory requirements and best serves the response effort.

Threat Classification

In many cases, the incident will come from a known threat source that facilitates the rapid identification of the threat. NIST provides the following attack vectors that are useful for classifying threats:

• External/Removable Media An attack executed from removable media or a peripheral device—for example, malicious code spreading onto a system from an infected USB flash drive.
• Attrition An attack that employs brute-force methods to compromise, degrade, or destroy systems, networks, or services—for example, a DDoS attack intended to impair or deny access to a service or application or a brute-force attack against an authentication mechanism.
• Web An attack executed from a website or web-based application—for example, a cross-site scripting attack used to steal credentials or redirect to a site that exploits a browser vulnerability and installs malware.
• Email An attack executed via an email message or attachment—for example, exploit code disguised as an attached document or a link to a malicious website in the body of an email message.
• Impersonation An attack involving replacement of something benign with something malicious—for example, spoofing, man-in-the-middle attacks, rogue wireless access points, and SQL injection attacks all involve impersonation.
• Improper Usage Any incident resulting from violation of an organization's acceptable usage policies by an authorized user, excluding the previous categories; for example, a user installs file-sharing software, leading to the loss of sensitive data, or a user performs illegal activities on a system.
• Loss or Theft of Equipment The loss or theft of a computing device or media used by the organization, such as a laptop, smartphone, or authentication token.
• Unknown An attack of unknown origin.
• Other An attack of known origin that does not fit into any of the previous categories.

In addition to understanding these attack vectors, cybersecurity analysts should be familiar with the concept of an advanced persistent threat (APT). APT attackers are highly skilled and talented attackers focused on a specific objective. These attackers are often funded by nation-states, organized crime, and other sources with tremendous resources. APT attackers are known for taking advantage of zero-day vulnerabilities—vulnerabilities that are unknown to the security community and, as a result, are not included in security tests performed by vulnerability scanners and other tools and have no patches available to correct them.

Severity Classification

CSIRT members may investigate dozens, hundreds, or even thousands of security incidents each year, depending on the scope of their responsibilities and the size of the organization. Therefore, it is important to use a standardized process to communicate the severity of each incident to management and other stakeholders. Incident severity information assists in the prioritization and scope of incident response efforts.

Two key measures used to determine the incident severity are the scope of the impact and the types of data involved in the incident.

Activity 11.1: Incident Severity Classification

You are the leader of cybersecurity incident response team for a large company that is experiencing a denial-of-service attack on its website. This attack is preventing the organization from selling products to its customers and is likely to cause lost revenue of at least $2 million per day until the incident is resolved.

The attack is coming from many different sources, and you have exhausted all of the response techniques at your disposal. You are currently looking to identify an external partner that can help with the response.

Classify this incident using the criteria described in this chapter. Assign categorical ratings for functional impact, economic impact, recoverability effort, and information impact. Justify each of your assignments.

Activity 11.2: Incident Response Phases

Identify the correct phase of the incident response process that corresponds to each of the following activities:

Activity 11.3: Develop an Incident Communications Plan

You are the CSIRT leader for a major e-commerce website, and you are currently responding to a security incident where you believe attackers used a SQL injection attack to steal transaction records from your backend database.

Currently, only the core CSIRT members are responding. Develop a communication plan that describes the nature, timing, and audiences for communications to the internal and external stakeholders that you believe need to be notified.

1. Which one of the following is an example of a computer security incident?
   1. User accesses a secure file
   2. Administrator changes a file's permission settings
   3. Intruder breaks into a building
   4. Former employee crashes a server
2. During what phase of the incident response process would an organization implement defenses designed to reduce the likelihood of a security incident?
   1. Preparation
   2. Detection and analysis
   3. Containment, eradication, and recovery
   4. Postincident activity
3. Alan is responsible for developing his organization's detection and analysis capabilities. He would like to purchase a system that can combine log records from multiple sources to detect potential security incidents. What type of system is best suited to meet Alan's security objective?
   1. IPS
   2. IDS
   3. SIEM
   4. Firewall
4. Ben is working to classify the functional impact of an incident. The incident has disabled email service for approximately 30 percent of his organization's staff. How should Ben classify the functional impact of this incident according to the NIST scale?
   1. None
   2. Low
   3. Medium
   4. High
5. What phase of the incident response process would include measures designed to limit the damage caused by an ongoing breach?
   1. Preparation
   2. Detection and analysis
   3. Containment, eradication, and recovery
   4. Postincident activity
6. Grace is the CSIRT team leader for a business unit within NASA, a federal agency. What is the minimum amount of time that Grace must retain incident handling records?
   1. Six months
   2. One year
   3. Two years
   4. Three years
7. Karen is responding to a security incident that resulted from an intruder stealing files from a government agency. Those files contained unencrypted information about protected critical infrastructure. How should Karen rate the information impact of this loss?
   1. None
   2. Privacy breach
   3. Proprietary breach
   4. Integrity loss
8. Matt is concerned about the fact that log records from his organization contain conflicting timestamps due to unsynchronized clocks. What protocol can he use to synchronize clocks throughout the enterprise?
   1. NTP
   2. FTP
   3. ARP
   4. SSH
9. Which one of the following document types would outline the authority of a CSIRT responding to a security incident?
   1. Policy
   2. Procedure
   3. Playbook
   4. Baseline
10. A cross-site scripting attack is an example of what type of threat vector?
    1. Impersonation
    2. Email
    3. Attrition
    4. Web
11. Which one of the following parties is not commonly the target of external communications during an incident?
    1. The perpetrator
    2. Law enforcement
    3. Vendors
    4. Information sharing partners
12. Robert is finishing a draft of a proposed incident response policy for his organization. Who would be the most appropriate person to sign the policy?
    1. CEO
    2. Director of security
    3. CIO
    4. CSIRT leader
13. Which one of the following is not an objective of the containment, eradication, and recovery phase of incident response?
    1. Detect an incident in progress
    2. Implement a containment strategy
    3. Identify the attackers
    4. Eradicate the effects of the incident
14. Renee is responding to a security incident that resulted in the unavailability of a website critical to her company's operations. She is unsure of the amount of time and effort that it will take to recover the website. How should Renee classify the recoverability effort?
    1. Regular
    2. Supplemented
    3. Extended
    4. Not recoverable
15. Which one of the following is an example of an attrition attack?
    1. SQL injection
    2. Theft of a laptop
    3. User installs file sharing software
    4. Brute-force password attack
16. Who is the best facilitator for a postincident lessons learned session?
    1. CEO
    2. CSIRT leader
    3. Independent facilitator
    4. First responder
17. Which one of the following elements is not normally found in an incident response policy?
    1. Performance measures for the CSIRT
    2. Definition of cybersecurity incidents
    3. Definition of roles, responsibilities, and levels of authority
    4. Procedures for rebuilding systems
18. A man-in-the-middle attack is an example of what type of threat vector?
    1. Attrition
    2. Impersonation
    3. Web
    4. Email
19. Tommy is the CSIRT team leader for his organization and is responding to a newly discovered security incident. What document is most likely to contain step-by-step instructions that he might follow in the early hours of the response effort?
    1. Policy
    2. Baseline
    3. Playbook
    4. Textbook
20. Hank is responding to a security event where the CEO of his company had her laptop stolen. The laptop was encrypted but contained sensitive information about the company's employees. How should Hank classify the information impact of this security event?
    1. None
    2. Privacy breach
    3. Proprietary breach
    4. Integrity loss