Narrator: In this lesson, 2 2
we're going to discuss a root cause analysis. 3 3
Now, a root cause analysis is a systematic process 4 4
to identify the initial source of the incident 5 5
and how to prevent it from occurring again. 6 6
This analysis is usually going to occur 7 7
using a four-step process. 8 8
First, we define and scope the incident. 9 9
Second, we determine the causal relationships 10 10
that led to that incident. 11 11
Third, we identify an effective solution. 12 12
And fourth, we implement and track the solution 13 13
to ensure the incident is fully resolved. 14 14
So let's go through a quick example. 15 15
Let's say you had a malware infection 16 16
inside your organization. 17 17
First, you need to determine 18 18
the initial cause and scope of that instant. 19 19
Maybe it was caused because malware 20 20
was introduced into your network because somebody plugged in 21 21
a USB thumb drive into their workstation, 22 22
or they clicked on a link in a spearfishing campaign, 23 23
or they visited a malicious website. 24 24
Now, whatever the initial attack vector was, 25 25
our goal is to identify that 26 26
so we can prevent it from happening again. 27 27
If somebody caused this incident to occur 28 28
by plugging a thumb drive that was infected with malware, 29 29
there's a couple ways we can prevent this. 30 30
One way is that we can ensure that all of our workstations 31 31
have the latest version of antivirus installed on them. 32 32
This way, anytime you insert a disc, a CD, a DVD, 33 33
download a file, or plug in the USB thumb drive, 34 34
it's going to be scanned for viruses and other malware 35 35
before allowing you to read from that device. 36 36
Another thing you might do 37 37
is you might prevent the data transfer from USB devices, 38 38
like thumb drives and external hard drives, 39 39
for all the users on your enterprise network in the future. 40 40
This will be another great way to stop data 41 41
from getting from this infected device onto the system. 42 42
Now, in addition to that, 43 43
we might also find out that this particular piece of malware 44 44
was only effective against certain types of machines 45 45
that were running a certain version of Windows 46 46
or were missing some kind of a security patch. 47 47
And in those cases, we would identify that weakness 48 48
and then we would create a solution to identify those things 49 49
such as upgrading the version of Windows 50 50
or installing the security patches 51 51
that would protect us from this vulnerability. 52 52
So now that we've gathered this information, 53 53
we have defined and scoped our incident, 54 54
we should know how many machines have been affected, 55 55
and how many users have been infected by this incident, 56 56
and what operational impacts that has. 57 57
Then we go and we determine 58 58
the causal relationships that led to the incident. 59 59
In this case, 60 60
somebody installed malware using a USB thumb drive. 61 61
So we need to identify effective solutions to stop that, 62 62
and we came up with a handful here 63 63
as we just went through this example, 64 64
things like adding antivirus, or preventing data 65 65
from being read from a USB mass storage device, 66 66
or installing a newer version of Windows, 67 67
or an updated security patch 68 68
for that particular vulnerability. 69 69
And then this brings us to the fourth step, 70 70
which is to implement and track the solutions 71 71
to ensure the incident fully handled. 72 72
Now in this case, we might have had a single system 73 73
that was infected by the piece of malware on the USB device. 74 74
So we've identified what it was, 75 75
we determined the relationship that led to the incident, 76 76
and we've identified a couple of effective solutions. 77 77
In this case, I'm going to want to go ahead 78 78
and ensure that I block mass storage devices 79 79
from being read on that user's system, and I want to ensure 80 80
their antivirus and anti-malware solution is up to date. 81 81
And now I need to implement and track those action items. 82 82
In this case, I would tell my system administrators, 83 83
through a change management process, 84 84
to install the registry change that will prevent USB devices 85 85
from being read on that machine, 86 86
and making sure that it is part 87 87
of our asset management and change management process, 88 88
that machine has been updated 89 89
to the latest version of Windows 90 90
and has the latest security patches. 91 91
By doing all of these things, 92 92
we have now contained this incident, 93 93
and figured out the root cause, 94 94
and stopped it from happening again. 95 95
Now, I like to take this one step further, though. 96 96
Because we identified it on this single machine, 97 97
we also want to look across the network 98 98
and see if there's any other machines 99 99
that could have been affected as well. 100 100
For example, if we figured out that the reason 101 101
that this piece of malware was able to be installed 102 102
is because you're running Windows 10 instead of Windows 11, 103 103
we then want to look at the rest of the network and say, 104 104
how many other Windows 10 machines do I have? 105 105
If there's a lot of them, 106 106
it may be a very large solution for us 107 107
to upgrade all those systems to Windows 11 108 108
and prevent this vulnerability from being exploited again. 109 109
That's the real benefit of doing a root cause analysis. 110 110
You need to figure out what caused the incident 111 111
and then see how many other things 112 112
across your network or across your organization 113 113
are going to have the same type of feature sets 114 114
that could then be vulnerable to the same types of attacks. 115 115
And that's really the big benefit 116 116
of doing a root cause analysis, 117 117
is by identifying all those other machines 118 118
that are vulnerable to the same thing, 119 119
we can prevent future attacks.