Responding to Intrusions By Nathaniel Robinson

Before an Intrusion Happens Create a CSIRT What they do , who are they? Create an IRP What is in the report?

What a CSIRT does? A team or an organization that provides services and support , to other persons for the sake of preventing, defending, and responding to computer security incidents. Provide security awareness training and technical documents for workers Will respond to intrusions or take a look at an incident to see the necessary actions to take Identifies and analyzes what has happened including the impact and the threat.

Who are the CSIRT Core Staff Manager or team lead Assistant managers, supervisors, group leaders Hotline, help desk Incident handlers Vulnerability handlers Forensic analysts

Creating an IRP Make Initial Assessments Communicate the Incident Who to Contact Contain Damage and Minimize Risk Identify the type and Severity of the Compromise Protect Evidence Create a log How to respond to an incident Assess incident damage and cost Review the response and update policies

Responding to an Incident 6 Steps Initiate the IRP Engage vendors Consider notifying law enforcement Contact Insurance Carriers Asses legal risks and obligations Develop a communication plan

Initiate the IRP Initiating the IRP puts everyone into their respective place The plan should have who to communicate to and how to respond to the intrusion Have the plan in place makes responding to the intrusion easier and responses run smoother.

Engage Vendors Engage Vendors to protect evidence, conduct forensic analysis, and restore network Most companies do not have the right resources are talent to respond to a sophisticated attack Most Vendors specialize in security

Consider Notifying Law Enforcement Drawbacks and Benefits If choose to notify law enforcement contact FBI in your district FBI will have the resources and people to conduct forensic analysis and respond to the intrusion Also law enforcement will have the jurisdiction to monitor whomever is attacking your network

Contact Insurance Carriers U.S. insurance industry produced 1 billion in policies covering hacker attacks in 2014. Identify coverage areas Document losses and response cost , makes it easier to submit them for recovery

Asses Legal risks and Obligations Identify and protected and sensitive information Consider duties of confidentiality arising out of contract and common law Will be able to determine whether and to whom breach notification must be given Allows you to asses potential litigation risks and take steps to reduce those risk.

Develop a Communication Plan Develop a communication plans for four different groups The Press, Customers, Public, and Government Agencies Update Plan as needed

Bibliography http://www.insidecounsel.com/2012/04/06/technology-effectively- responding-to-a-network-int http://whatis.techtarget.com/definition/Computer-Security- Incident-Response-Team-CSIRT http://www.first.org/conference/2008/papers/killcrece-georgia- slides.pdf