Instructor: Post-incident activities. 2 2
Our final phase of an incident response 3 3
is to conduct our post-incident activities. 4 4
This is going to occur once the attack 5 5
or immediate threat has been neutralized 6 6
and the system has been restored to secure operation. 7 7
So once we've done all that, we are back in business. 8 8
Everything is hunky dory and we're back to normal, 9 9
but there's still some things we need to do, 10 10
and this is where post-incident activity comes into play. 11 11
We're going to analyze the incident and responses to identify 12 12
whether the procedures or systems could have been improved. 13 13
Now, as part of our post-incident activities, 14 14
we have three main areas 15 15
that we're going to consider in this lesson. 16 16
We have report writing, 17 17
incident summary reports, and evidence retention. 18 18
First, let's talk about report writing. 19 19
Report writing is an essential analyst skill, 20 20
and it's used to communicate information 21 21
about the incident to a wide variety of stakeholders. 22 22
Now, when you're making these reports 23 23
you want to make sure you're clearly marking them 24 24
for the intended audience, 25 25
because depending on who you're writing it for, 26 26
that is either going to have different classification levels 27 27
or different audiences who have different needs. 28 28
For example, if I work for the government, 29 29
and I'm talking about something that happened 30 30
on a top secret system, 31 31
that report needs to be marked Top Secret, 32 32
to make sure only cleared people can read that report. 33 33
Additionally, if I'm in a business organization, 34 34
I might write a report for the technical audience 35 35
and one for leadership, 36 36
and those are going to be very different reports. 37 37
When I write one for my senior leadership, 38 38
I'm going to create an Executive Summary. 39 39
This is a shorter report that has different sections on it 40 40
for things like our problem statement, 41 41
our observations, our conclusions, and our recommendations. 42 42
Inside this executive summary, 43 43
it usually is just going to be a handful of pages. 44 44
These are going to have a lot of charts and graphs in there. 45 45
They're going to have a lot of bullets 46 46
that bring out the key information, 47 47
because they don't need 48 48
all the technical details of the incident. 49 49
They need to know what was the business impact, 50 50
and how can we prevent this from happening again. 51 51
Generally, if you have an incident 52 52
you have some kind of a deficiency, right? 53 53
Somebody was able to break into your systems. 54 54
So in your executive summary, 55 55
you should tell them how they broke in 56 56
and what you need to stop that from happening again. 57 57
That may be a higher budget, more people, 58 58
or some other type of resource that you just don't have. 59 59
And so asking for those things 60 60
as part of your executive summary 61 61
is an important thing to do. 62 62
Next we have an Incident Summary Report, 63 63
and this is a report written for a specific audience 64 64
with key information about the incident for their use. 65 65
Now, these incident summary reports are going to contain 66 66
information about how the incident occurred, 67 67
how it could have been prevented in the future, 68 68
the impact and damage on the systems, 69 69
and any lessons learned. 70 70
Now, I know this sounds a lot like 71 71
the executive summary I just mentioned, 72 72
so what's the difference? 73 73
Well, the executive summary is one type 74 74
of incident summary report, but there's many others. 75 75
For instance, if you're working with public relations 76 76
you're going to have to write a report for them 77 77
with the key details they need to be able to release that 78 78
to the media and the public at large. 79 79
That would be one incident summary report. 80 80
Now, if I'm working, working with the system administrators 81 81
on how they can prevent this from happening in the future, 82 82
I might have a different incident summary report 83 83
written in a very high tech language 84 84
so they know all the different configurations 85 85
that were wrong, 86 86
and what they can do to prevent this in the future. 87 87
So again, it goes back to knowing who your audience is 88 88
and getting the right report for the right people. 89 89
The third thing we need to talk about here 90 90
is Evidence Retention. 91 91
Now, evidence retention is the preservation of evidence 92 92
based upon the required time period 93 93
defined by regulations 94 94
if there's a legal or regulatory impact 95 95
that's caused by the incident. 96 96
For example, if you want to be able to go after the attacker 97 97
who got into your network 98 98
and you want to prosecute that person, 99 99
you're going to need to retain the evidence. 100 100
This is important because all of that evidence 101 101
is going to have to be retained until all the legal actions 102 102
including any appeals, have been completed. 103 103
When you're dealing with cases where prosecution is desired, 104 104
you can expect that you're going to have to retain 105 105
that evidence for several years. 106 106
This is a big deal. 107 107
Now, why is it a big deal? 108 108
Well, because that retention is going to cost you money. 109 109
It's going to cost you resources, 110 110
and so you have to be able to weigh that 111 111
as part of your evidence retention. 112 112
Now, every organization has the ability 113 113
to set its own period in their data retention policy. 114 114
And as you think about your data retention, 115 115
you are free to set it any way you want, 116 116
but in some cases, your organization will have 117 117
additional requirements that are set forth by law. 118 118
For example, if you're a publicly traded company, 119 119
you might fall into the requirements 120 120
of Sarbanes Oxley here in the United States. 121 121
Now, in general most organizations 122 122
will set a minimum retention period of at least six months, 123 123
but some of these other laws and regulations 124 124
may require you to hold that data for several years 125 125
as part of that law and regulation. 126 126
So make sure you're dealing with your legal team as well 127 127
when you're developing your data retention policies. 128 128
Now, another factor you have to consider is cost. 129 129
I said it costs a lot of money to retain this evidence. 130 130
Now, it would be great for us to be able to retain 131 131
all the data and evidence for an unlimited duration of time, 132 132
but that is simply not practical. 133 133
The more stuff you retain. 134 134
the more hard drive space or server space 135 135
or cloud storage space you are going to need, 136 136
and all of that represents 137 137
additional cost to your organization. 138 138
Thankfully, the price 139 139
of storage continues to decrease exponentially over time. 140 140
For example, my company uses an online backup solution 141 141
that provides us with unlimited storage 142 142
for a fixed annual fee. 143 143
Using an offsite storage solution like this 144 144
can be a great option for you to consider. 145 145
The other concern with cost occurs 146 146
when some of your hardware has to be collected 147 147
as evidence during a response. 148 148
For example, if one of your servers 149 149
is collected as evidence for a case headed to prosecution, 150 150
you may not get it back for two or three years. 151 151
In this case, you're going to have to replace that server 152 152
in order to fully recover your operations, 153 153
and this could cost you tens of thousands of dollars 154 154
depending on the scale of your incident. 155 155
And therefore, it's important for you to consider 156 156
that your organization has to address this 157 157
in their budgeting for a potential incident response 158 158
in the future.