Are you prepared for your next Cyber Security Incident?

Category: Blog

By Janice

18/10/2016

At 7 Elements, we manage security incidents for our clients that cover a broad spectrum of threats, from highly capable advanced persistent threats through to opportunistic and untargeted attacks using commonly available exploit code.
All incidents are unique, as such, 7 Elements believe that a flexible approach is required to ensure that the response to an incident is proportional and fit for purpose. Each incident will vary in terms of the technical capability, size of response and the forensic rigour required to deal with it effectively.

Event Driven Incident Response
By taking an event driven approach to incident management that clearly defines key activities and associated resources you can ensure that each incident is managed on its own merits, resulting in a tailored response rather than a one size fits all approach.

We have implemented an event driven approach, which utilises five key stages and would provide a good starting point when looking at your own organisation's approach to cyber related incident response:

Using this approach and as part of your cyber response planning, ask yourself the following three questions:

“Do you have documented procedures that cover each phase?”
“What are your organisational capabilities within each of those stages?”
“Do we need to partner with an external entity to provide expertise?”

While this is not an exhaustive list, it provides a good foundation and will enable an organisation to then focus on incident preparation.

Incident Preparation
Preparation is key to any planned incident response, however it can be difficult for organisations to anticipate what exactly will be required in the event of an incident. For many organisations, incident response procedures plan to tackle scenarios identified through business continuity risks or following internal incidents. Procedures are often completed or reviewed as part of an annual business planning process by those with a focus on the business. This results in an introspective focus that can leave incident management procedures lacking. An introspective focus does not effectively anticipate the full suite of scenarios that an organisation may face in responding to an incident. Such an internal emphasis does not take into account the evolving threat landscape or the changing external environment in which the organisation operates. Without placing incident response measures in this dynamic external context, organisations may find their response measures are lacking in the face of current attacks.

Of course, gaining information about factors external to your organisation, such as threats, is often an insurmountable challenge, but organisations have an opportunity to carry out reviews of the breaches of their competitors or other organisations similar to their own.

Groups conducting attacks, whether for financial gain or other motives, will frequently use the same methods of compromise. This fact has clearly been demonstrated in the recent attacks on the electronic point of sale systems in the US retail sector and the on-going use of targeted phishing emails to gain access to corporate networks. There are also previous attack trends of utilising SQL injection or memory scraping malware as attack methods to draw upon as examples of attack methodologies being reused. The use of similar methods by attackers means that organisations have an opportunity to identify attack approaches and vulnerabilities that could be applicable to them. Organisations should therefore look to use the experiences of others within their sector to enhance their own incident management procedures.

While it is accepted that the full details of the incident will not be publicly available, many industries have information sharing forums and employees build-up relationships with their counterparts in other organisations. It is likely that an organisation will be able to garner sufficient information to identify vulnerabilities exploited by attackers and key attack vectors. This information can be used to review the incident and determine if the organisation is itself vulnerable to such an attack. In short, organisations should conduct a post-incident review of the incidents that impact other organisations.

Using the information available, an organisation can identify potential attack scenarios and whether they are likely to be breached as a result. By playing out these scenarios within the context of their own environment, organisations will be able to identify if they have compensating controls in place or where they may be required. Once compensating controls are in place organisations can then test their effectiveness in the context of these scenarios and therefore gain assurance that they are not exposed to the attacks their peers have suffered.

This process may be assisted by experts such as security testers, ordinarily external to the incident response planning process. Penetration testers can provide insight into the scenario planning and assessment process. By the very nature of their jobs, penetration testers are often skilled at identifying and understanding attack vectors. By using such experts, organisations will be able to add more rigor to their assessment of scenarios as well as challenge preconceptions. Ultimately, this will result in a more resilient approach to incident response.

Reviewing the incidents of others will enable organisations to anticipate the types of attacks they may be vulnerable to and prepare for them, ultimately keeping cool in a crisis. By keeping abreast of the threat landscape, spotting trends within relevant industries and reacting to the external environment, organisations will be able to plan effectively for incidents, if not reduce the likelihood of a successful attack. Should an attack occur, organisations will have more resilient incident response measures in place with which to tackle these anticipated threats. By learning from others' misfortunes organisations may be able to avoid the pain of going through a similar experience.
So on the basis of learning from others, what are the key questions that all CEOs and CISOs should be asking on a regular basis:

"Are we vulnerable to the attacks being reported in the media?"
"What assurance activity have we done to confirm that we are not vulnerable?"
"If we were compromised, would an attacker be able to gain access to unencrypted sensitive data?"
"What assurance activity have we done to confirm this position?"

Taking the time before an incident occurs to correctly prepare will inevitably lead to a robust and fit for purpose approach to cyber security related incidents, and in the event of such an incident, respond effectively and rapidly.

Dave Stubley LinkedIn

7 Elements website: https://www.7elements.co.uk/

To be featured or find out more about Company Connecting:

e-mail us on support@companyconnecting.com

call us on 0845 643 5375

or contact Janice on Linkedin

"Are you prepared for your next Cyber Security Incident?" First published on Company Connecting OCtober 2016
©Company Connecting