Instructor: Incident classification. 2 2
So now that we've prioritized things, 3 3
we need to classify our incidents. 4 4
Now, some organizations are going to add additional layers 5 5
of incident classification, 6 6
depending on their particular needs. 7 7
Now, there are lots of different ways 8 8
to classify your incident, 9 9
but some of the most common are things like data integrity, 10 10
system process criticality, 11 11
downtime, economic, 12 12
data correlation, reverse engineering, 13 13
recovery time and detection time. 14 14
Let's take a look at each of those in this lesson. 15 15
First, we have data integrity. 16 16
This is any incident where the data is modified 17 17
or loses integrity. 18 18
I like to think about this as my checking account. 19 19
If my checking account has a thousand dollars in it 20 20
and somebody went in and modified that 21 21
and made it say that I had $10 in it, 22 22
that would be a modification of the data integrity 23 23
of my checking account balance. 24 24
That would make me upset 25 25
because I just lost a bunch of money, right? 26 26
And so, that is the issue here 27 27
when you start dealing with data integrity. 28 28
If you can't trust the data, 29 29
that is going to be an incident of this type. 30 30
Second, we have system process criticality. 31 31
Now, this is an incident that disrupts 32 32
or threatens a mission essential business function. 33 33
So in my company, one of our essential business functions 34 34
is being able to deliver training to you, our students. 35 35
If somebody took down our video server, 36 36
that doesn't necessarily cost us money initially, 37 37
but the longer it's down, 38 38
it's going to cost us more money and a lot of upset customers. 39 39
That is a system process criticality. 40 40
It disrupts or threatens 41 41
our mission essential business function, 42 42
which for us is delivering training to you. 43 43
Next we have downtime 44 44
And downtime is an incident 45 45
that degrades or interrupts the availability of an asset, 46 46
system or business process. 47 47
Now, there's lots of ways to create downtime. 48 48
It can be a technical thing 49 49
such as your system is going to be overrun 50 50
by denial of service attack. 51 51
Or it can be a non-technical thing. 52 52
For example, let's say you call up an airline 53 53
and you have a lot of people 54 54
who start calling that airline all at the same time. 55 55
Well, that can create a very long queue 56 56
for you to get to a customer service agent. 57 57
And if there's an excessively long queue 58 58
like four or five hours, 59 59
that essentially is going to be downtime 60 60
and that is going to make that system be interrupted 61 61
because there is not the availability of agents 62 62
to support your call. 63 63
This, again, will be going against the business process 64 64
as opposed to going against a particular asset or system. 65 65
Next, we have economic. 66 66
When we look at our categories, 67 67
we also have to consider the economics of things. 68 68
This is when an incident creates 69 69
a short-term or long-term cost. 70 70
As I mentioned in the last lesson, 71 71
it can cost hundreds of thousands of dollars per hour 72 72
when there's downtime on a system. 73 73
So even though you have downtime, 74 74
there is the physical downtime associated with it, 75 75
there's also an economic cost to that as well. 76 76
If I went and hacked your system 77 77
and destroyed your data on a server, 78 78
that might cause downtime, 79 79
but even if it didn't, 80 80
it's still going to have an economic cost to you 81 81
because you have to recover that data 82 82
and that requires contractors 83 83
or employees spending valuable time 84 84
to bring that stuff back to the way it was. 85 85
Next, we have data correlation. 86 86
Now data correlation is an incident 87 87
that's linked to a specific TTP 88 88
or tactics techniques and procedures 89 89
of known adversary groups with extensive capabilities. 90 90
So if I'm looking at a particular indicator or compromise 91 91
inside my seam based on an alert that fired, 92 92
and I say that that thing has been known to happen 93 93
with APT28, which is a nation state actor, 94 94
that would have the hair on the back of my neck 95 95
standing up a little bit more. 96 96
That's going to have a higher priority 97 97
because that is a well-known actor 98 98
that has a lot of capabilities. 99 99
And so, I need to really be thinking 100 100
how I'm going to get them out of my network. 101 101
The next one we have is reverse engineering. 102 102
This is any incident which the capabilities of the malware 103 103
are discovered to be linked to an adversary group. 104 104
So again, if you have some kind of malware in your system 105 105
and as you're reverse engineering it, 106 106
you're able to determine this goes with APT XYZ, 107 107
that tells you this is an advanced persistent threat, 108 108
it's a nation state or a large criminal organization 109 109
and now it's going to be more significant 110 110
than somebody who's just simply stumbled onto your system 111 111
because they're a script kiddie. 112 112
So these are the kind of things you want to think about 113 113
as you're doing your categories. 114 114
Next, we have recovery time. 115 115
And recovery time is an incident 116 116
that requires extensive recovery time 117 117
due to its scope or severity. 118 118
This would mean we're going to have a higher recovery time, 119 119
therefore a higher priority 120 120
because that means we're going to have longer downtime, right? 121 121
And more costs 122 122
because the longer it takes me to recover 123 123
and get back to normal, 124 124
the more cost and time is going to be associated with it. 125 125
And the final category we have is detection time. 126 126
If you have a very high detection time, 127 127
meaning it takes a long time to discover something, 128 128
this incident would not be discovered quickly, 129 129
making it more dangerous 130 130
because if there's a bad guy in my system 131 131
and they're there for a long time before I find them, 132 132
they have a lot more chance to do bad things. 133 133
As an instant responder, 134 134
we are often racing against the clock 135 135
when dealing with intrusions, incidents 136 136
and possible data breaches. 137 137
In fact, according to one study, 138 138
only 10% of data breaches 139 139
were discovered within the first hour, 140 140
meaning that person was in your system 141 141
for at least an hour 142 142
90% of the time before they were discovered. 143 143
Now, as we go further into that study, 144 144
it actually shows that 20% of the incidents 145 145
took days to discover 146 146
and then 40% took months to discover. 147 147
So almost 50% of these incidents 148 148
can go on for months or years at a time 149 149
before being discovered, 150 150
which gives the attacker 151 151
a lot of time to do things on your system. 152 152
Now, why is all this important? 153 153
Because nearly 40% of adversaries 154 154
had successfully exfiltrated data 155 155
within minutes of starting their attack. 156 156
And so as I said, only 10% were found within an hour, 157 157
which means 90% went longer than an hour. 158 158
And so, that means 40% of the time, 159 159
they are definitely going to have your information. 160 160
And so, detection time is really important 161 161
because the adversaries are beating the defenders 162 162
a lot of the time. 163 163
And so, we have to continue to work 164 164
on getting our detection times down. 165 165
And therefore, if you have a high detection time, 166 166
you have a higher priority incident 167 167
because they're going to have a chance 168 168
to do a lot more damage to you.