-: Documenting procedures, one of the first steps 2 2
inside of your preparation phase 3 3
is going to be to document procedures. 4 4
Now again, let's review the preparation phase 5 5
and what it does. 6 6
When we're in the preparation phase, 7 7
we are trying to make the system resilient to attack 8 8
by hardening our systems, writing policies and procedures, 9 9
and setting up confidential lines of communication. 10 10
So writing these policies and procedures 11 11
and documenting them is very important. 12 12
By preparing for an instant response, 13 13
we're going to make sure we are documenting our procedures, 14 14
putting resources in place, 15 15
and the different procedures in place, 16 16
as well as conducting training. 17 17
All of this is really important to us 18 18
because it's going to make sure that we're ready to respond 19 19
when an incident occurs. 20 20
For example, most organizations are going to have 21 21
instant response plans on file and ready to go. 22 22
Essentially, these are your war plans. 23 23
When you see something happen, 24 24
you can look up what do you do in response 25 25
to that particular thing. 26 26
For instance, maybe you're going to be dealing 27 27
with a DDoS attack, or a virus or a worm outbreak, 28 28
or a fishing attack, or data exfiltration, 29 29
whatever it is you're going to have different responses 30 30
and different procedures for each of those things. 31 31
And so as part of your detection later on, 32 32
you're going to classify what that incident is 33 33
and then respond appropriately. 34 34
But here in preparation, 35 35
this all happens before there's an incident. 36 36
We have to have these standard steps ready to go 37 37
that are tested, and we're ready to respond. 38 38
So one of the best ways to do this 39 39
is making sure you have a playbook. 40 40
Now a playbook is a standard operating procedure. 41 41
And it tells our junior analysts and incident handlers 42 42
exactly what they should do 43 43
in response to different scenarios. 44 44
Now if you don't have these already, 45 45
you can actually go to a website 46 46
known as incidentresponse.com/playbook. 47 47
And when you go there, 48 48
you're going to click on I want to make a plan. 49 49
Once you get there, 50 50
you're going to find a Playbook gallery 51 51
that has a bunch of playbooks already created for you. 52 52
For instance, let's take a look at Phishing. 53 53
If we click on Phishing, 54 54
it will open up and give us a document 55 55
that's about 10 or 12 pages 56 56
that tells us exactly what we should do 57 57
in terms of Phishing. 58 58
Now as it goes through, 59 59
it's going to tell us how we can automate our response, 60 60
how we can detect it, 61 61
what actions we should take. 62 62
And each part it has a flow chart that gives us the actions. 63 63
For instance, we can go through preparation 64 64
and how we can determine what we're going to do 65 65
and how we're going to train people, 66 66
and how we're going to do interviews 67 67
with all the different functions. 68 68
And as we go through that, 69 69
we have internal and external paths. 70 70
And then we can move into our detection phase 71 71
and it shows us all the different ways 72 72
that we can detect this type of a phishing attack. 73 73
And then, we go into our analysis phase. 74 74
What type of things are we looking for 75 75
as we're trying to triage and categorize this? 76 76
And then we go into our containment phase. 77 77
How are we going to stop this phishing attack? 78 78
And then we can look at eradication. 79 79
How are we going to triage it and confirm the report? 80 80
What kind of communications we're going to have? 81 81
How are we going to eradicate a malware 82 82
that may have been download as part of this phishing attack 83 83
and things like that? 84 84
And then we move into our recovery phase. 85 85
And then after that, we move into our post-incident phase 86 86
and it tells us all the things we need to do. 87 87
Now again, I went through this very quickly 88 88
because you don't need to know all the details 89 89
of all these flow charts that I went through on the screen. 90 90
But the important thing is to realize 91 91
that you can get these type of playbooks as a starting point 92 92
and then customize them for your organization. 93 93
At the end of the playbook, 94 94
it's even going to give you some different things 95 95
that you should be doing 96 96
such as what does a proactive response look like? 97 97
What does a quick containment look like? 98 98
What does effective remediation look like? 99 99
And what should your action plan be? 100 100
All of this is information that's contained 101 101
inside this playbook 102 102
and allows a junior analyst to do this work very quickly 103 103
because they can follow these flow charts 104 104
and know exactly what to do. 105 105
Now in addition to the playbooks, 106 106
it's also important for us to know 107 107
who we're going to call as we start escalating things 108 108
and notifying people, 109 109
and this is a really important thing to ask. 110 110
Who are we going to call? 111 111
And no, the answer is not "Ghostbusters". 112 112
Instead, the answer is, we're going to consult our call list. 113 113
Now a call list is a predefined list 114 114
of instant response contacts in hierarchical order 115 115
for notification and escalation. 116 116
Essentially, if you're the analyst 117 117
and you're working at three in the morning 118 118
and you detect something, 119 119
who are you going to call? 120 120
Who are you going to wake up? 121 121
Are you going to use a phone? 122 122
Are you going to use a landline, 123 123
a cell phone, a satellite phone? 124 124
What about email? 125 125
Is it going to be a corporate account or a personal account? 126 126
Well, all of this depends on what your plan says 127 127
and how you want to make contact. 128 128
Now the reason why this is so important 129 129
is because if that incident happens to be 130 130
where an attacker has gotten into your systems 131 131
and they have control of your network, 132 132
you don't want to send an email over that network 133 133
because you're going to tip your hand 134 134
and let the adversary know 135 135
that you've detected them in your network. 136 136
So you need to have secondary and tertiary ways 137 137
of contacting people. 138 138
Your call list is going to help you define that. 139 139
Who are you going to call? 140 140
When are you going to call them, and at what level? 141 141
Are you going to call your manager or your manager's manager, 142 142
or the director, or the CEO? 143 143
The answer is, it depends. 144 144
Depending on how bad the incident is, 145 145
it will determine how high up the chain of command 146 146
and how far up your organization you need to call. 147 147
Another thing you need to work on 148 148
inside the preparation phase 149 149
is the creation of an incident form. 150 150
Now an incident form is going to be used to record 151 151
all the details about the reporting of an incident 152 152
and assign it a case or a job number. 153 153
And a lot of organizations, this has become a digital form 154 154
or some kind of a SharePoint website or a database 155 155
where it can collect all this information. 156 156
In the old days, it was actually a form 157 157
that was filled out with pen and paper. 158 158
Regardless of which one you're using, 159 159
you're going to have a lot of the same type 160 160
of information though. 161 161
You're going to have things like the date, the time, 162 162
and the location of the incident 163 163
and the detection of the incident. 164 164
You're going to have the reporter 165 165
and the incident handlers names and contact details. 166 166
You're going to have things like how the incident 167 167
was observed or detected. 168 168
What was the log or the alert or the thing 169 169
that made you think, "Ah, we have an incident here." 170 170
We also are going to define what type of incident we have. 171 171
Is this a worm, a data breach, 172 172
a piece of malware, unauthorized privileges, 173 173
or whatever the type of thing is? 174 174
We want to put that down. 175 175
And then, we're going to look at the scope of the incident. 176 176
Is this a small scope or a big scope? 177 177
Is it affecting the entire organization 178 178
or just a small part of the organization? 179 179
For instance, let's say you had a system error 180 180
that was taking down your entire website. 181 181
That'd be a big deal 182 182
and it's probably going to go further up the chain of command 183 183
than if you had something that was taking out 184 184
maybe just the payroll system 185 185
and it was three weeks before payroll is going to be due. 186 186
All of these are issues we're going to have to address 187 187
but depending on how big or small the issue is 188 188
that's going to tell us what the scope of the incident is. 189 189
And finally, we have to have the incident description 190 190
and event logging. 191 191
This is where we're going to have all the information we have 192 192
about the incident. 193 193
For example, if I'm working as an incident handler 194 194
and somebody calls into the SOC 195 195
and I'm taking down the report and they say, 196 196
"I'm having some issues. 197 197
I think there's malware on my system. 198 198
As I'm moving my mouse to the right, it's going to the left. 199 199
When I click on this, it doesn't work." 200 200
Those are indications that there could be 201 201
some kind of remote access Trojan on that system, 202 202
so I can get that information from the user 203 203
and then pass that information over to the incident handler 204 204
or the incident responder 205 205
who's going to work that specific case. 206 206
As we're moving through the incident, 207 207
this is all the information we want to gather 208 208
so we have more information 209 209
and we understand what happened when it happened 210 210
and all the steps that have happened up to this point. 211 211
So we pass it off to responder, 212 212
they can continue that log and we can use that later on 213 213
as a way to go back and look at this event.