It is important that an incident response plan is
formulated, supported throughout the organization, and is regularly
tested. A good incident response plan can minimize not only the affects
of the actual security breach, but it may also reduce the negative
publicity.
From a security team perspective, it does not matter whether a breach
occurs (as such occurrences are an eventual part of doing business using
an untrusted carrier network, such as the Internet), but rather,
when a breach occurs. Do not think of a system as
weak and vulnerable; it is important to realize that given enough time
and resources, someone can break into even the most security-hardened
system or network. You do not need to look any further than the
Security Focus website, https://www.securityfocus.com/,
for updated and detailed information concerning recent security breaches
and vulnerabilities, such as the frequent defacement of corporate
webpages or the 2002 attacks on the root DNS nameservers.
The positive aspect of realizing the inevitability of a system breach is
that it allows the security team to develop a course of action that
minimizes any potential damage. Combining a course of action with
expertise allows the team to respond to adverse conditions in a formal
and responsive manner.
The incident response plan itself can be separated into four
phases:
Immediate action to stop or minimize the incident
Investigation of the incident
Restoration of affected resources
Reporting the incident to the proper channels
An incident response must be decisive and executed quickly. Because
there is little room for error, it is critical that practice emergencies
are staged and response times measured. This way it is possible to
develop a methodology that fosters speed and accuracy, minimizing the
impact of resource unavailability and potential damage in the event of
an actual system compromise.
An incident response plan has a number of requirements,
including:
A team of in-house experts (a Computer Emergency
Response Team)
A legally reviewed and approved strategy
Financial support from the company
Executive/upper management support
A feasible and tested action plan
Physical resources, such as redundant storage, standby systems,
and backup services
The Computer Emergency Response Team (CERT) is a
group of in-house experts who are prepared to act quickly in the event
of a catastrophic computer event. Finding the core competencies for a
CERT can be a challenge. The concept of appropriate personnel goes
beyond technical expertise and includes logistics such as location,
availability, and desire to put the organization ahead of ones
personal life when an emergency occurs. An emergency is never a
planned event; it can happen at any moment and all CERT members must
accept the responsibility that is required of them to respond to an
emergency at any hour.
CERT teams typically include system and network administrators as well
as information security experts. System administrators provide the
knowledge and expertise of system resources, including data backups,
backup hardware available for use, and more. Network administrators
provide their knowledge of network protocols and the ability to
re-route network traffic dynamically. Information security personnel
are useful for thoroughly tracking and tracing security issues as well
as performing a post-mortem (after the attack)
analysis of compromised systems.
Although it may not always be feasible, there should be personnel
redundancy within a CERT. If depth in core areas is not applicable to
an organization, then cross-training should be implemented wherever
possible. Note, if only one person owns the key to data safety and
integrity, then the entire enterprise becomes helpless in that one
person's absence.
Some important aspects of an incident response to consider include
legal ramifications. Security plans should be developed with members
of legal staff or some form of general counsel. Just as every company
should have their own corporate security policy, every company should
have its own way of handling incidents from a legal
perspective. Local, state, and federal regulatory issues are beyond
the scope of this document, but are mentioned because the methodology
for performing a post-mortem analysis, at least in part, is dictated
by (or in conjunction with) legal counsel. General counsel can alert
technical staff of the legal ramifications of security breaches; the
hazards of leaking a client's personal, medical, or financial records;
and the importance of restoring service in mission-critical
environments such as hospitals and banks.
