Instructor: Response coordination. 2 2
Now, in preparation, one of the other things we have 3 3
to think about is how we're going to coordinate our response 4 4
because an incident response is going to require coordination 5 5
between different internal departments 6 6
and external agencies. 7 7
Let me give you a quick example of this. 8 8
Twitter had a massive breach to their security. 9 9
Now, due to the massive breach, 10 10
lots of high profile accounts started tweeting out messages 11 11
asking for Bitcoin. 12 12
We started seeing this from companies like Apple 13 13
and we saw it from Jeff Bezos 14 14
which is one of the richest people in the world. 15 15
We saw it from Barack Obama 16 16
the former president of the United States. 17 17
We also saw it from Kanye West, one of the big music stars. 18 18
And we saw from Joe Biden, who was a presidential candidate 19 19
at the time, as well as Warren Buffet 20 20
another large investor in the world, and even Elon Musk. 21 21
And all of these were high-profile accounts 22 22
that were hacked as part of this breach. 23 23
Now, when this happened, 24 24
Twitter immediately locked down those accounts 25 25
so that the attackers couldn't use them anymore 26 26
and then they started working 27 27
with external agencies such as the FBI 28 28
to come help them figure out what was going on. 29 29
And within two weeks, they had the suspect 30 30
in custody at the FBI and started to figure out 31 31
exactly what happened as part of this incident response. 32 32
Now, in this case, this was a big event 33 33
and it became very newsworthy, but this kind of thing 34 34
does happen a lot in the industry 35 35
where you're going to be working with both internal 36 36
and external players to work on your incident response. 37 37
And when you do that, you have to coordinate that. 38 38
Now, one of the questions you have to ask yourself is 39 39
who are the affected stakeholders? 40 40
In the case of Twitter 41 41
the FBI got involved because this was a major attack 42 42
against all these high profile accounts. 43 43
Two of those accounts I just showed you 44 44
were President Barack Obama 45 45
and presidential candidate Joe Biden. 46 46
And that's a real good reason 47 47
for the FBI to get involved pretty quickly here. 48 48
But when you have an incident, 49 49
you need to start thinking about 50 50
who are the affected stakeholders. 51 51
There are lots of them out there inside 52 52
and outside your organization. 53 53
For instance, 54 54
you might have senior leadership that gets involved. 55 55
You might have regulatory bodies, 56 56
you might have your internal legal counsel 57 57
or external law enforcement. 58 58
It might be your internal human resources 59 59
or your internal public relations 60 60
and externally with the media. 61 61
All of these are people who are valid stakeholders 62 62
when you have an incident and you have to consider 63 63
how does this incident affect them 64 64
and how are you going to coordinate your response. 65 65
Let's go ahead and look at each of these. 66 66
First we have senior leadership. 67 67
When we talk about senior leadership, this is the executives 68 68
and managers who are responsible for business operations 69 69
and various functional areas within your company. 70 70
Now, the reason this is important is because a lot 71 71
of our incident responders tend to be technical people 72 72
and so we might, as technical people say, the quickest way 73 73
to solve this incident is to shut down that server. 74 74
But if we're not understanding the business impact 75 75
of those actions, that could have second 76 76
and third order effects, they'll be very bad 77 77
for our organization. 78 78
So we're going to have to get senior leadership involved 79 79
to understand if I do this, it's going to have this and that 80 80
and the other effect, and we have to mitigate those. 81 81
For example, if your credit card processing system 82 82
has been compromised, if you immediately shut it down, 83 83
you are cutting off your ability 84 84
to process new transactions. 85 85
Now, that might be the right answer technically 86 86
but from a business standpoint 87 87
that could actually hurt you even worse. 88 88
And so you have to start weighing these factors 89 89
and working across the organization 90 90
to make sure you have another way 91 91
to accept payments before shutting down 92 92
that credit card system. 93 93
Or maybe you're going to make the decision 94 94
that it's okay to shut down the system 95 95
but you understand you're going to be giving up the ability 96 96
to process credit cards right now. 97 97
That is a business decision, not a technical decision. 98 98
And so it is one that you have to have 99 99
senior leaderships buy-in on. 100 100
The next key stakeholder we have 101 101
to consider is regulatory bodies. 102 102
These are governmental organizations that oversee 103 103
the compliance with specific regulations and laws. 104 104
For example, if we're talking about HIPAA 105 105
which has to do with healthcare, 106 106
you're going to have to be overseen 107 107
by health and human services 108 108
because they're the ones who run the HIPAA program. 109 109
If you're dealing with something like 110 110
the California Consumer Privacy Act or CCPA, 111 111
you're going to be dealing with the state of California. 112 112
If you're dealing with something like credit card data 113 113
you're going to be dealing with PCIDSS 114 114
and those people who run that program. 115 115
Again, these are the different regulatory bodies 116 116
you're going to have to consider. 117 117
Now, a quick note, when you're dealing with PCIDSS 118 118
they're not technically a regulatory body 119 119
from a legal standpoint 120 120
but they do oversee all of the payment card systems. 121 121
Now, generally, when we talk about the term regulatory 122 122
we are talking about legal. 123 123
And with PCIDSS, it is not a legal requirement. 124 124
It is a contractual requirement 125 125
between you and your payment processor. 126 126
The next stakeholder we have to consider is legal. 127 127
Now, legal is the business or organization's legal counsel 128 128
and they're going to be responsible 129 129
for mitigating risk from civil lawsuits. 130 130
For example, as you're planning out your response 131 131
of what you're going to do to stop the breach of data 132 132
you want to make sure legal is in the room 133 133
because your actions could come up later on 134 134
if your company is sued for its response. 135 135
And so you want to make sure they're in the room 136 136
and they understand what you're doing 137 137
and they have input into it. 138 138
On the other side of the coin, we have law enforcement 139 139
and law enforcement is an external stakeholder. 140 140
They may provide services 141 141
to assist in your incident handling efforts or to prepare 142 142
for legal action against the attacker in the future. 143 143
Just like I was talking about earlier with Twitter, 144 144
they brought the FBI in 145 145
because they wanted to pursue legal action 146 146
against that attacker, and the FBI was able 147 147
to bring in additional services to help them 148 148
in that incident response 149 149
to be able to deal with it much quicker. 150 150
Now, one quick thing to note, your decision 151 151
to involve law enforcement 152 152
has to be made by senior executives 153 153
with guidance from your internal legal counsel. 154 154
You as an incident responder, 155 155
should not immediately pick up the phone 156 156
and call the FBI or the local police. 157 157
This is something your business has to decide. 158 158
Now, there are cases where it is legally required 159 159
to bring in law enforcement, 160 160
but in a lot of cases it is more 161 161
of a civil issue, and you have the determination 162 162
and the right to decide if you want to press charges 163 163
and bring in law enforcement. 164 164
So keep that in mind and remember, 165 165
your senior executives get to make that decision. 166 166
Our next stakeholder is human resources 167 167
and this is an internal stakeholder. 168 168
They're going to be used to ensure there's no breaches 169 169
of employment law or employee contracts 170 170
during the incident response. 171 171
For example, 172 172
if you are suspecting that there's an internal threat 173 173
and you want to start questioning employees 174 174
or you want to start going through employee files, 175 175
you're going to have to consult human resources 176 176
because you could be breaching employment law 177 177
or employee contracts. 178 178
So make sure you involve human resources. 179 179
And our final stakeholder we want to consult 180 180
is public relations or PR. 181 181
Public relations is used to manage the negative publicity 182 182
from a serious incident. 183 183
Now, this is important because you want to make sure 184 184
as the technical lead, as an incident responder 185 185
you're not the one answering questions to the media. 186 186
You don't want to be the one up there 187 187
behind all those microphones 188 188
with a sea of reporters asking you questions. 189 189
You have people in your organization 190 190
whose job it is to handle that 191 191
and they're going to come up with a clear, concise message 192 192
that can be said over and over again 193 193
to all the inquiries reporters have. 194 194
This way, you're on-brand 195 195
and on-message across your organization. 196 196
Remember, public relations needs to be involved 197 197
especially with larger breaches that may get the interest 198 198
of media and the press. 199 199
Now, as part of the CSIRT team, it's going to be your role 200 200
to help provide information to these stakeholders. 201 201
As part of the CSIRT, you're going to be asked 202 202
for information regarding the estimated downtime, 203 203
the scope of the systems and data affected 204 204
and other relevant details. 205 205
And by having that information 206 206
and providing that up to the appropriate senior leadership, 207 207
human resources, legal, public relations, and others 208 208
it's going to make sure 209 209
that we all are providing a consistent message 210 210
and that we are coordinating our response efforts.