1 1 00:00:00,480 --> 00:00:02,730 Incident classification. 2 2 00:00:02,730 --> 00:00:04,560 So now that we've prioritized things, 3 3 00:00:04,560 --> 00:00:06,810 we need to classify our incidents. 4 4 00:00:06,810 --> 00:00:09,420 Now, some organizations are going to add additional layers 5 5 00:00:09,420 --> 00:00:10,950 of incident classification, 6 6 00:00:10,950 --> 00:00:12,960 depending on their particular needs. 7 7 00:00:12,960 --> 00:00:14,340 Now, there are lots of different ways 8 8 00:00:14,340 --> 00:00:15,840 to classify your incident, 9 9 00:00:15,840 --> 00:00:18,690 but some of the most common are things like data integrity, 10 10 00:00:18,690 --> 00:00:20,610 system process criticality, 11 11 00:00:20,610 --> 00:00:22,620 downtime, economic, 12 12 00:00:22,620 --> 00:00:24,960 data correlation, reverse engineering, 13 13 00:00:24,960 --> 00:00:27,480 recovery time and detection time. 14 14 00:00:27,480 --> 00:00:29,760 Let's take a look at each of those in this lesson. 15 15 00:00:29,760 --> 00:00:31,860 First, we have data integrity. 16 16 00:00:31,860 --> 00:00:34,110 This is any incident where the data is modified 17 17 00:00:34,110 --> 00:00:35,760 or loses integrity. 18 18 00:00:35,760 --> 00:00:38,310 I like to think about this as my checking account. 19 19 00:00:38,310 --> 00:00:40,770 If my checking account has a thousand dollars in it 20 20 00:00:40,770 --> 00:00:42,360 and somebody went in and modified that 21 21 00:00:42,360 --> 00:00:44,490 and made it say that I had $10 in it, 22 22 00:00:44,490 --> 00:00:46,950 that would be a modification of the data integrity 23 23 00:00:46,950 --> 00:00:48,630 of my checking account balance. 24 24 00:00:48,630 --> 00:00:49,500 That would make me upset 25 25 00:00:49,500 --> 00:00:51,480 because I just lost a bunch of money, right? 26 26 00:00:51,480 --> 00:00:52,830 And so, that is the issue here 27 27 00:00:52,830 --> 00:00:54,480 when you start dealing with data integrity. 28 28 00:00:54,480 --> 00:00:56,040 If you can't trust the data, 29 29 00:00:56,040 --> 00:00:58,530 that is going to be an incident of this type. 30 30 00:00:58,530 --> 00:01:01,320 Second, we have system process criticality. 31 31 00:01:01,320 --> 00:01:03,000 Now, this is an incident that disrupts 32 32 00:01:03,000 --> 00:01:05,610 or threatens a mission essential business function. 33 33 00:01:05,610 --> 00:01:08,910 So in my company, one of our essential business functions 34 34 00:01:08,910 --> 00:01:11,940 is being able to deliver training to you, our students. 35 35 00:01:11,940 --> 00:01:14,010 If somebody took down our video server, 36 36 00:01:14,010 --> 00:01:16,800 that doesn't necessarily cost us money initially, 37 37 00:01:16,800 --> 00:01:18,150 but the longer it's down, 38 38 00:01:18,150 --> 00:01:21,570 it's going to cost us more money and a lot of upset customers. 39 39 00:01:21,570 --> 00:01:23,400 That is a system process criticality. 40 40 00:01:23,400 --> 00:01:24,570 It disrupts or threatens 41 41 00:01:24,570 --> 00:01:26,550 our mission essential business function, 42 42 00:01:26,550 --> 00:01:29,610 which for us is delivering training to you. 43 43 00:01:29,610 --> 00:01:31,380 Next we have downtime 44 44 00:01:31,380 --> 00:01:32,640 And downtime is an incident 45 45 00:01:32,640 --> 00:01:35,760 that degrades or interrupts the availability of an asset, 46 46 00:01:35,760 --> 00:01:37,950 system or business process. 47 47 00:01:37,950 --> 00:01:40,050 Now, there's lots of ways to create downtime. 48 48 00:01:40,050 --> 00:01:41,460 It can be a technical thing 49 49 00:01:41,460 --> 00:01:43,830 such as your system is going to be overrun 50 50 00:01:43,830 --> 00:01:45,690 by denial of service attack. 51 51 00:01:45,690 --> 00:01:47,820 Or it can be a non-technical thing. 52 52 00:01:47,820 --> 00:01:50,400 For example, let's say you call up an airline 53 53 00:01:50,400 --> 00:01:51,900 and you have a lot of people 54 54 00:01:51,900 --> 00:01:54,600 who start calling that airline all at the same time. 55 55 00:01:54,600 --> 00:01:56,940 Well, that can create a very long queue 56 56 00:01:56,940 --> 00:01:58,980 for you to get to a customer service agent. 57 57 00:01:58,980 --> 00:02:00,630 And if there's an excessively long queue 58 58 00:02:00,630 --> 00:02:02,280 like four or five hours, 59 59 00:02:02,280 --> 00:02:04,230 that essentially is going to be downtime 60 60 00:02:04,230 --> 00:02:06,660 and that is going to make that system be interrupted 61 61 00:02:06,660 --> 00:02:08,670 because there is not the availability of agents 62 62 00:02:08,670 --> 00:02:10,320 to support your call. 63 63 00:02:10,320 --> 00:02:12,660 This, again, will be going against the business process 64 64 00:02:12,660 --> 00:02:16,050 as opposed to going against a particular asset or system. 65 65 00:02:16,050 --> 00:02:17,760 Next, we have economic. 66 66 00:02:17,760 --> 00:02:18,870 When we look at our categories, 67 67 00:02:18,870 --> 00:02:21,330 we also have to consider the economics of things. 68 68 00:02:21,330 --> 00:02:22,680 This is when an incident creates 69 69 00:02:22,680 --> 00:02:24,840 a short-term or long-term cost. 70 70 00:02:24,840 --> 00:02:26,610 As I mentioned in the last lesson, 71 71 00:02:26,610 --> 00:02:29,460 it can cost hundreds of thousands of dollars per hour 72 72 00:02:29,460 --> 00:02:31,110 when there's downtime on a system. 73 73 00:02:31,110 --> 00:02:32,820 So even though you have downtime, 74 74 00:02:32,820 --> 00:02:34,980 there is the physical downtime associated with it, 75 75 00:02:34,980 --> 00:02:37,680 there's also an economic cost to that as well. 76 76 00:02:37,680 --> 00:02:39,120 If I went and hacked your system 77 77 00:02:39,120 --> 00:02:41,280 and destroyed your data on a server, 78 78 00:02:41,280 --> 00:02:42,690 that might cause downtime, 79 79 00:02:42,690 --> 00:02:43,530 but even if it didn't, 80 80 00:02:43,530 --> 00:02:45,600 it's still going to have an economic cost to you 81 81 00:02:45,600 --> 00:02:47,220 because you have to recover that data 82 82 00:02:47,220 --> 00:02:48,810 and that requires contractors 83 83 00:02:48,810 --> 00:02:50,730 or employees spending valuable time 84 84 00:02:50,730 --> 00:02:53,490 to bring that stuff back to the way it was. 85 85 00:02:53,490 --> 00:02:55,650 Next, we have data correlation. 86 86 00:02:55,650 --> 00:02:57,480 Now data correlation is an incident 87 87 00:02:57,480 --> 00:02:59,760 that's linked to a specific TTP 88 88 00:02:59,760 --> 00:03:01,860 or tactics techniques and procedures 89 89 00:03:01,860 --> 00:03:05,490 of known adversary groups with extensive capabilities. 90 90 00:03:05,490 --> 00:03:08,160 So if I'm looking at a particular indicator or compromise 91 91 00:03:08,160 --> 00:03:10,920 inside my seam based on an alert that fired, 92 92 00:03:10,920 --> 00:03:13,710 and I say that that thing has been known to happen 93 93 00:03:13,710 --> 00:03:16,920 with APT28, which is a nation state actor, 94 94 00:03:16,920 --> 00:03:18,720 that would have the hair on the back of my neck 95 95 00:03:18,720 --> 00:03:20,190 standing up a little bit more. 96 96 00:03:20,190 --> 00:03:21,690 That's going to have a higher priority 97 97 00:03:21,690 --> 00:03:23,670 because that is a well-known actor 98 98 00:03:23,670 --> 00:03:25,230 that has a lot of capabilities. 99 99 00:03:25,230 --> 00:03:26,670 And so, I need to really be thinking 100 100 00:03:26,670 --> 00:03:28,950 how I'm going to get them out of my network. 101 101 00:03:28,950 --> 00:03:31,380 The next one we have is reverse engineering. 102 102 00:03:31,380 --> 00:03:34,080 This is any incident which the capabilities of the malware 103 103 00:03:34,080 --> 00:03:36,720 are discovered to be linked to an adversary group. 104 104 00:03:36,720 --> 00:03:39,390 So again, if you have some kind of malware in your system 105 105 00:03:39,390 --> 00:03:41,130 and as you're reverse engineering it, 106 106 00:03:41,130 --> 00:03:44,073 you're able to determine this goes with APT XYZ, 107 107 00:03:45,360 --> 00:03:47,820 that tells you this is an advanced persistent threat, 108 108 00:03:47,820 --> 00:03:50,670 it's a nation state or a large criminal organization 109 109 00:03:50,670 --> 00:03:52,950 and now it's going to be more significant 110 110 00:03:52,950 --> 00:03:55,620 than somebody who's just simply stumbled onto your system 111 111 00:03:55,620 --> 00:03:56,970 because they're a script kiddie. 112 112 00:03:56,970 --> 00:03:58,650 So these are the kind of things you want to think about 113 113 00:03:58,650 --> 00:04:00,450 as you're doing your categories. 114 114 00:04:00,450 --> 00:04:02,430 Next, we have recovery time. 115 115 00:04:02,430 --> 00:04:04,260 And recovery time is an incident 116 116 00:04:04,260 --> 00:04:06,510 that requires extensive recovery time 117 117 00:04:06,510 --> 00:04:08,280 due to its scope or severity. 118 118 00:04:08,280 --> 00:04:10,560 This would mean we're going to have a higher recovery time, 119 119 00:04:10,560 --> 00:04:12,240 therefore a higher priority 120 120 00:04:12,240 --> 00:04:14,760 because that means we're going to have longer downtime, right? 121 121 00:04:14,760 --> 00:04:15,750 And more costs 122 122 00:04:15,750 --> 00:04:17,430 because the longer it takes me to recover 123 123 00:04:17,430 --> 00:04:18,840 and get back to normal, 124 124 00:04:18,840 --> 00:04:21,960 the more cost and time is going to be associated with it. 125 125 00:04:21,960 --> 00:04:24,690 And the final category we have is detection time. 126 126 00:04:24,690 --> 00:04:26,760 If you have a very high detection time, 127 127 00:04:26,760 --> 00:04:29,070 meaning it takes a long time to discover something, 128 128 00:04:29,070 --> 00:04:31,410 this incident would not be discovered quickly, 129 129 00:04:31,410 --> 00:04:33,090 making it more dangerous 130 130 00:04:33,090 --> 00:04:35,550 because if there's a bad guy in my system 131 131 00:04:35,550 --> 00:04:37,590 and they're there for a long time before I find them, 132 132 00:04:37,590 --> 00:04:40,260 they have a lot more chance to do bad things. 133 133 00:04:40,260 --> 00:04:41,430 As an instant responder, 134 134 00:04:41,430 --> 00:04:43,440 we are often racing against the clock 135 135 00:04:43,440 --> 00:04:45,510 when dealing with intrusions, incidents 136 136 00:04:45,510 --> 00:04:47,340 and possible data breaches. 137 137 00:04:47,340 --> 00:04:49,470 In fact, according to one study, 138 138 00:04:49,470 --> 00:04:51,180 only 10% of data breaches 139 139 00:04:51,180 --> 00:04:53,490 were discovered within the first hour, 140 140 00:04:53,490 --> 00:04:55,560 meaning that person was in your system 141 141 00:04:55,560 --> 00:04:57,000 for at least an hour 142 142 00:04:57,000 --> 00:05:00,210 90% of the time before they were discovered. 143 143 00:05:00,210 --> 00:05:01,830 Now, as we go further into that study, 144 144 00:05:01,830 --> 00:05:04,080 it actually shows that 20% of the incidents 145 145 00:05:04,080 --> 00:05:05,790 took days to discover 146 146 00:05:05,790 --> 00:05:08,970 and then 40% took months to discover. 147 147 00:05:08,970 --> 00:05:11,250 So almost 50% of these incidents 148 148 00:05:11,250 --> 00:05:14,220 can go on for months or years at a time 149 149 00:05:14,220 --> 00:05:15,690 before being discovered, 150 150 00:05:15,690 --> 00:05:16,740 which gives the attacker 151 151 00:05:16,740 --> 00:05:19,080 a lot of time to do things on your system. 152 152 00:05:19,080 --> 00:05:20,670 Now, why is all this important? 153 153 00:05:20,670 --> 00:05:22,920 Because nearly 40% of adversaries 154 154 00:05:22,920 --> 00:05:24,990 had successfully exfiltrated data 155 155 00:05:24,990 --> 00:05:27,420 within minutes of starting their attack. 156 156 00:05:27,420 --> 00:05:31,050 And so as I said, only 10% were found within an hour, 157 157 00:05:31,050 --> 00:05:33,720 which means 90% went longer than an hour. 158 158 00:05:33,720 --> 00:05:36,000 And so, that means 40% of the time, 159 159 00:05:36,000 --> 00:05:38,190 they are definitely going to have your information. 160 160 00:05:38,190 --> 00:05:40,590 And so, detection time is really important 161 161 00:05:40,590 --> 00:05:42,750 because the adversaries are beating the defenders 162 162 00:05:42,750 --> 00:05:44,160 a lot of the time. 163 163 00:05:44,160 --> 00:05:45,510 And so, we have to continue to work 164 164 00:05:45,510 --> 00:05:47,310 on getting our detection times down. 165 165 00:05:47,310 --> 00:05:49,590 And therefore, if you have a high detection time, 166 166 00:05:49,590 --> 00:05:51,390 you have a higher priority incident 167 167 00:05:51,390 --> 00:05:52,470 because they're going to have a chance 168 168 00:05:52,470 --> 00:05:54,020 to do a lot more damage to you.