The Incident Response Process

There is a general path that cyber security incidents follow during their lifetime. If the organization has a mature incident response capability, it will have taken measures to ensure they are prepared to address an incident at each stage of the process. Each incident starts with the first time the organization becomes aware of an event or series of events indicative of malicious activity. This detection can come in the form of a security control alert or an external party informing the organization of a potential security issue. Once alerted, the organization moves through analyzing the incident through containment measures to bring the information system back to normal operations. There is no set incident response process. One standard that is widely used is the National Institute of Standards and Technology (NIST) Incident Response process. The following diagram, taken from the NIST Special Publication 800-61, shows how the NIST process flows...

The Incident Response Framework

Responding to a data breach, ransomware attack, or other security incident should never be an ad hoc process. Undefined processes or procedures will leave an organization unable to both identify the extent of the incident and be able to stop the bleeding in sufficient time to limit damage. Further, attempting to craft plans during an incident may in fact destroy critical evidence, or worse, create more problems.

Having a solid understanding of the incident response process is just the first step to building this capability within an organization. What organizations need is a framework that puts processes to work utilizing the organization's available resources. The incident response framework describes the components of a functional incident response capability within an organization. This framework is made up of elements such as personnel, policies, and procedures. It is through these elements that an organization builds its capability...

The Incident Response Plan

With the incident response charter written and the CSIRT formed, the next step is to craft the incident response plan. The incident response plan is the document that outlines the high-level structure of an organization's response capability. This is a high-level document that serves as the foundation of the CSIRT. The major components of the incident response plan are as follows:

• Incident response charter: The incident response plan should include the mission statement and constituency from the incident response charter. This gives the plan continuity between the inception of the incident response capability and the incident response plan.
• Expanded services catalog: The initial incident response charter had general service categories with no real detail. The incident response plan should include specific details of what services CSIRT will be offering. For example, if forensic services are listed as part of the service...

Incident Response Playbooks

The incident response framework should also address the technical aspects of incident response. This is where playbooks and workflows come into play. A workflow is a short document that guides an analyst on using a tool or executing a technique. For example, in Chapter 13, we will be looking at incident triage. A workflow associated with incident triage is collecting an incident triage package via Velociraptor. These workflows are then combined into a playbook. Playbooks are created to give organizations a clear path through the process, but with a degree of flexibility if the incident under investigation does not fit neatly into the box.

A good indicator of which playbooks are critical is the organization's risk assessment. Examining the risk assessment for any threat rated critical or high will indicate which scenarios need to be addressed via an incident response playbook. Most organizations would identify a range of threats, such...

Testing the Incident Response Framework

So far, there have been several areas that have been addressed in terms of preparing for an incident. From an initial understanding of the process involved in incident response, we moved through the creation of an incident response plan and associated playbooks.

Once the capability has been created, it should be run through a tabletop exercise to flush out any gaps or deficiencies. This exercise should include a high-level incident scenario that involves the entire team and one of the associated playbooks. A report that details the results of the tabletop exercise and any gaps, corrections, or modifications should also be prepared and forwarded to the senior leadership. Once leadership has been informed and acknowledges that the CSIRT is ready to deploy, it is operational.

As the CSIRT becomes comfortable executing the plan under a structured scenario, they may want to try more complex testing measures. Another option...

Summary

Benjamin Franklin is quoted as saying, "By failing to prepare, you are preparing to fail." In many ways, this sentiment is quite accurate when it comes to organizations and the threat of cyber-attacks. Preparing for a cyber-attack is a critical function that must be taken as seriously as any other aspect of cyber security. Having a solid understanding of the incident response process to build on with an incident response capability can provide organizations with a measure of preparation so that in the event of an incident, they can respond. Keep in mind as we move forward that forensic techniques, threat intelligence, and reverse engineering are there to assist an organization in getting to the end, that is, back up and running.

This chapter explored some of the preparation that goes into building an incident response capability. Selecting a team, creating a plan, and building the playbooks and escalation procedures allow a CSIRT to effectively address...

Questions

1. A tabletop exercise should be conducted after changes are made to the incident response plan and/or playbooks.
   • A) True
   • B) False
2. Which of the following roles would not be a member of the CSIRT core team?
   • A) Incident coordinator
   • B) CSIRT analyst
   • C) Legal
3. It is not important to have technical resources available as part of the incident response framework to aid during an incident.
   • A) True
   • B) False
4. The risk assessment is a valid data source for identifying high-risk incidents for playbook creation.
   • A) True
   • B) False

Answers

1. A
2. C
3. B
4. A

Further Reading

• Computer Security Incident Handling Guide, NIST SP 800-61 Rev 2: https://csrc. nist.gov/publications/detail/sp/800-61/rev-2/final
• ENISA Incident Handling in Live Role Play Handbook: https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/documents/incident-handling-in-live-role-playing-handbook/ view
• Incident Handler's Handbook by Patrick Kral, SANS Reading Room: https://www. sans.org/reading-room/whitepapers/incident/incident-handlers-handbook- 33901