Instructor: Containment. 2 2
In this lesson, 3 3
we are going to talk about containment, 4 4
which is our next step in the incident response phases. 5 5
Now, rapid containment in an incident response 6 6
is really important, 7 7
because if we don't contain things quickly, 8 8
the adversary can get into our network 9 9
and start pivoting around 10 10
and laterally spreading across the network 11 11
and cause more damage. 12 12
When we talk about containment, 13 13
our job here is to limit the scope and magnitude 14 14
of the incident 15 15
by securing data and limiting the impact 16 16
to the business operations and our customers. 17 17
Now, there are five key steps for conducting containment. 18 18
First, we want to ensure the safety and security 19 19
of all of our personnel. 20 20
This is always going to be the first concern 21 21
for management and executives 22 22
because we can't replace people 23 23
but we can replace data and technology. 24 24
Second, we want to prevent an ongoing intrusion 25 25
or data breach. 26 26
Now that we know our people are safe, 27 27
we want to protect our information 28 28
and we want to stop any ongoing intrusions 29 29
to prevent them from further exfiltrating data. 30 30
The third thing we want to do is identify 31 31
if the intrusion is the primary or secondary attack. 32 32
Sometimes as you detect something, 33 33
you think you found the main cause, 34 34
but you didn't. 35 35
You found the secondary attack, 36 36
and then you have to go back 37 37
and find out how they initially get in 38 38
and what other things are they doing. 39 39
For example, if you see 40 40
that they've gotten into your network 41 41
and they're exfiltrating unimportant data, 42 42
is that really the attack they were going for? 43 43
Or were they using that 44 44
as a way to hide their true intentions 45 45
of going after some important data store instead? 46 46
Fourth, we want to avoid alerting the attacker 47 47
that the attack has been discovered. 48 48
Now, this is important 49 49
because some attackers, when they're discovered, 50 50
will actually destroy your systems. 51 51
There is one APT 52 52
that is known for doing what we call burning down the house. 53 53
If they're discovered, they will actually go 54 54
and start formatting all your systems 55 55
and destroying everything. 56 56
This is burning down the house, 57 57
and we don't want them to do that to our systems. 58 58
So we don't want to tip our hand 59 59
and let the adversary know that we've detected them. 60 60
Instead, we want to make sure we've cut off their ability 61 61
to do any harm to us 62 62
before they figure out that we know they're there. 63 63
And then fifth, we want to preserve any forensic evidence 64 64
of the intrusion and attack 65 65
because that evidence could be useful 66 66
for law enforcement and for other things. 67 67
Now notice, these five steps are in priority order. 68 68
We want to make sure we are safe. 69 69
We stop the ongoing breach, 70 70
we identify the primary or secondary attack 71 71
and then we want to avoid alerting the attacker, 72 72
and finally, preserving evidence is our last thing. 73 73
Now, as we go forward 74 74
and we start thinking about containment, 75 75
there's really two categories of containment we can do. 76 76
There is isolation and segmentation. 77 77
Now, when we talk about isolation, 78 78
this is a mitigation strategy 79 79
that involves removing an effective component 80 80
from whatever larger environment it's a part of. 81 81
So if I have a server and I think it's been compromised, 82 82
I can physically take it out of the environment 83 83
and cut it off. 84 84
That way, the attacker can't access it 85 85
but neither can my employees. 86 86
Now, when you're doing this, 87 87
you need to ensure that there is no longer an interface 88 88
between the affected component 89 89
and your production network or the internet. 90 90
One of the most common ways of doing this 91 91
is by creating an air gap. 92 92
You can do this by turning off a switch port 93 93
or unplugging the cable directly from the switch port 94 94
because this will make sure 95 95
that nobody can talk to that device anymore. 96 96
Now, creating an air gap is the least stealthy option though 97 97
and it will reduce your opportunities 98 98
to analyze the attack or the malware 99 99
because you are essentially cutting off 100 100
the connection completely. 101 101
So should you use isolation? 102 102
Well, if you have a high enough priority 103 103
that can really do some damage, 104 104
you may want to isolate immediately 105 105
to prevent that damage from spreading. 106 106
Now, another way to do isolation 107 107
besides unplugging the network cable 108 108
is you can actually take away the permissions 109 109
from an account or a service. 110 110
For example, 111 111
if somebody has compromised your administrator account, 112 112
you can go in and disable that account. 113 113
That, again, is an isolation mechanism. 114 114
Now, the other way we can do things 115 115
is we can use segmentation. 116 116
Now, segmentation is a mitigation strategy 117 117
that achieves isolation of a host or group of hosts 118 118
using network technologies and architecture. 119 119
Segmentation is going to use VLANs, routing and subnets, 120 120
and firewall ACLs 121 121
to prevent communications outside the protected segment. 122 122
Now, this is also sometimes termed as sandboxing. 123 123
Sandboxing is a security mechanism 124 124
for separating a system 125 125
from other critical system resources and programs. 126 126
This often can be used to test malware 127 127
or other harmful applications 128 128
without subjecting the rest of the network to the attack. 129 129
Again, this is a form of segmentation. 130 130
This can be accomplished during an instant response 131 131
by redirecting all of your attackers activity 132 132
to a workstation 133 133
that can then be used to gather evidence and information 134 134
about the attacker's methods. 135 135
So when we do this, 136 136
we actually can have 137 137
something like a honeypot, for instance, 138 138
and if we think there is some attacker 139 139
from the internet trying to access us, 140 140
we can use things like a proxy 141 141
to proxy the information either into the LAN honeypot 142 142
or the DMZ honeypot, 143 143
and that way, we can research what this person is doing. 144 144
This type of segmentation is often used 145 145
by security researchers 146 146
as they start creating honeypots and honeynets 147 147
that are designed to be attacked by hackers. 148 148
This way, they can capture their techniques 149 149
and create indicators of compromise 150 150
for us to add to our detection systems. 151 151
If you plan to use sandboxing as a technique in this way 152 152
during an instant response, 153 153
you need to consult your organization's legal counsel though 154 154
to ensure you're not breaking any laws when doing so 155 155
because laws do vary from place to place. 156 156
Some countries consider setting these type of honeypots up 157 157
in a law enforcement activity as entrapment, 158 158
and it wouldn't be allowed. 159 159
So you have to consider that and work with your legal team. 160 160
Now, when you do this segmentation or sandboxing, 161 161
you can reroute the adversary traffic 162 162
as part of a deception defensive capability, 163 163
something like a honeypot as we were just talking about. 164 164
Now, again, I want you to consult 165 165
with your senior leadership 166 166
whenever you have plans for doing isolation or segmentation 167 167
as part of your containment strategy. 168 168
Now, one of these two is what you're going to have to do 169 169
but which one you're going to do is going to depend 170 170
on senior leadership. 171 171
This is because there are a lot of factors 172 172
that we discussed here, 173 173
and these are only really scratching the surface. 174 174
You always want to consider the impact to the business 175 175
and the risk you're taking 176 176
by choosing one strategy over another 177 177
for your overall containment strategy 178 178
during the incident response. 179 179
Now, this will have larger business impacts as well 180 180
and so you always need to make sure 181 181
you're consulting senior leadership 182 182
and provide them with your recommendations 183 183
based on your technical expertise, 184 184
and then they can make a decision 185 185
based on their business experience.