About Incident Response
The threats to companies are increasing despite growing expertise and investments in IT security. Companies can no longer protect themselves effectively through prevention alone. It shows that most organizations can’t detect initial intrusions (Attivo Survey, 2020)¹. Nearly two-thirds (64%) of respondents indicated that 100 days of dwell time². They must therefore be in a position to react correctly to events in
IT systems. As soon as a company detect violation of their security policy and a raise a security incident³, since those events mostly compromise sensitive personal & business data they needs to respond quickly (before major damage occurs). To be able to do this, the methodology of incident handling helps.
While focusing on incident response capabilities, the incident response methodology also underlies processes and procedures that can be applied to any security incident.
As we observe a rise in the number of security incidents, the IR handling processes helps with the use of attack categories to faster identify and scope the problem and apply different response strategies.
For example,the National Institute of Standards and Technology (NIST) categorizes the the types of attack incidents as follows:
External/Removable Media: An attack exe cuted from removable media (e.g. flash drive or CD) or a peripheral device.
• Attrition: An attack that employs brute force methods to compromise, degrade, or destroy systems, networks, or services.
• Improper Usage: Any incident resulting from violation of an organization’s acceptable usage policies by an authorized user, excluding means from the above categories.
• Loss or Theft of Equipment: The loss or theft of a computing device or media used by the organization, such as a laptop or smartphone.
• Other: An attack that does not fit into any of the other categories.
Handling the given incidents is essentially the task of Computer Emergency Response Teams
or Computer Security Incident Response Teams, also commonly known as CERT or CSIRT.
After an initial assessment of the situation, it is typically necessary to determine whether
there is an imminent danger to life and limb (such as in the case of manufacturing and industrial plants), but also a risk of manipulation, sabotage, or exfiltration of sensitive data.
If necessary, such a danger can be contained with immediate measures, whereby the attacker
should not be made aware of the existence of the incident response activities if possible. The
incident response team then attempts to identify the attacker’s current and past activities
to a sufficient extent and observe them over a period of time to gain a picture of their capabilities, procedures and possible motives.
Information gathering is essential to tracing the activities of an incident. It ensures sufficient evidence identification and IOC development that will enable the IR team to assess and define the extent of compromise. In this critial stage of the incident response process, Maltego supports IR teams to gather intelligence from both public and paid data sources.
Views: 30
