1 1 00:00:00,090 --> 00:00:00,960 In this lesson, 2 2 00:00:00,960 --> 00:00:03,491 we're going to discuss a root cause analysis. 3 3 00:00:03,491 --> 00:00:06,480 Now, a root cause analysis is a systematic process 4 4 00:00:06,480 --> 00:00:08,970 to identify the initial source of the incident 5 5 00:00:08,970 --> 00:00:11,160 and how to prevent it from occurring again. 6 6 00:00:11,160 --> 00:00:13,170 This analysis is usually going to occur 7 7 00:00:13,170 --> 00:00:15,270 using a four-step process. 8 8 00:00:15,270 --> 00:00:17,970 First, we define and scope the incident. 9 9 00:00:17,970 --> 00:00:20,550 Second, we determine the causal relationships 10 10 00:00:20,550 --> 00:00:22,290 that led to that incident. 11 11 00:00:22,290 --> 00:00:25,050 Third, we identify an effective solution. 12 12 00:00:25,050 --> 00:00:27,720 And fourth, we implement and track the solution 13 13 00:00:27,720 --> 00:00:30,210 to ensure the incident is fully resolved. 14 14 00:00:30,210 --> 00:00:32,670 So let's go through a quick example. 15 15 00:00:32,670 --> 00:00:34,350 Let's say you had a malware infection 16 16 00:00:34,350 --> 00:00:36,000 inside your organization. 17 17 00:00:36,000 --> 00:00:37,620 First, you need to determine 18 18 00:00:37,620 --> 00:00:40,230 the initial cause and scope of that instant. 19 19 00:00:40,230 --> 00:00:41,910 Maybe it was caused because malware 20 20 00:00:41,910 --> 00:00:44,160 was introduced into your network because somebody plugged in 21 21 00:00:44,160 --> 00:00:46,230 a USB thumb drive into their workstation, 22 22 00:00:46,230 --> 00:00:48,870 or they clicked on a link in a spearfishing campaign, 23 23 00:00:48,870 --> 00:00:51,150 or they visited a malicious website. 24 24 00:00:51,150 --> 00:00:53,400 Now, whatever the initial attack vector was, 25 25 00:00:53,400 --> 00:00:55,050 our goal is to identify that 26 26 00:00:55,050 --> 00:00:57,150 so we can prevent it from happening again. 27 27 00:00:57,150 --> 00:00:58,770 If somebody caused this incident to occur 28 28 00:00:58,770 --> 00:01:01,260 by plugging a thumb drive that was infected with malware, 29 29 00:01:01,260 --> 00:01:03,300 there's a couple ways we can prevent this. 30 30 00:01:03,300 --> 00:01:06,060 One way is that we can ensure that all of our workstations 31 31 00:01:06,060 --> 00:01:08,872 have the latest version of antivirus installed on them. 32 32 00:01:08,872 --> 00:01:12,930 This way, anytime you insert a disc, a CD, a DVD, 33 33 00:01:12,930 --> 00:01:15,630 download a file, or plug in the USB thumb drive, 34 34 00:01:15,630 --> 00:01:18,180 it's going to be scanned for viruses and other malware 35 35 00:01:18,180 --> 00:01:20,820 before allowing you to read from that device. 36 36 00:01:20,820 --> 00:01:22,050 Another thing you might do 37 37 00:01:22,050 --> 00:01:24,900 is you might prevent the data transfer from USB devices, 38 38 00:01:24,900 --> 00:01:27,000 like thumb drives and external hard drives, 39 39 00:01:27,000 --> 00:01:30,150 for all the users on your enterprise network in the future. 40 40 00:01:30,150 --> 00:01:32,100 This will be another great way to stop data 41 41 00:01:32,100 --> 00:01:35,490 from getting from this infected device onto the system. 42 42 00:01:35,490 --> 00:01:36,630 Now, in addition to that, 43 43 00:01:36,630 --> 00:01:39,390 we might also find out that this particular piece of malware 44 44 00:01:39,390 --> 00:01:41,910 was only effective against certain types of machines 45 45 00:01:41,910 --> 00:01:43,830 that were running a certain version of Windows 46 46 00:01:43,830 --> 00:01:45,990 or were missing some kind of a security patch. 47 47 00:01:45,990 --> 00:01:48,540 And in those cases, we would identify that weakness 48 48 00:01:48,540 --> 00:01:51,150 and then we would create a solution to identify those things 49 49 00:01:51,150 --> 00:01:52,920 such as upgrading the version of Windows 50 50 00:01:52,920 --> 00:01:54,504 or installing the security patches 51 51 00:01:54,504 --> 00:01:57,180 that would protect us from this vulnerability. 52 52 00:01:57,180 --> 00:01:58,950 So now that we've gathered this information, 53 53 00:01:58,950 --> 00:02:00,870 we have defined and scoped our incident, 54 54 00:02:00,870 --> 00:02:02,760 we should know how many machines have been affected, 55 55 00:02:02,760 --> 00:02:05,130 and how many users have been infected by this incident, 56 56 00:02:05,130 --> 00:02:07,350 and what operational impacts that has. 57 57 00:02:07,350 --> 00:02:08,760 Then we go and we determine 58 58 00:02:08,760 --> 00:02:11,130 the causal relationships that led to the incident. 59 59 00:02:11,130 --> 00:02:12,000 In this case, 60 60 00:02:12,000 --> 00:02:14,880 somebody installed malware using a USB thumb drive. 61 61 00:02:14,880 --> 00:02:18,360 So we need to identify effective solutions to stop that, 62 62 00:02:18,360 --> 00:02:19,650 and we came up with a handful here 63 63 00:02:19,650 --> 00:02:21,360 as we just went through this example, 64 64 00:02:21,360 --> 00:02:24,180 things like adding antivirus, or preventing data 65 65 00:02:24,180 --> 00:02:26,700 from being read from a USB mass storage device, 66 66 00:02:26,700 --> 00:02:28,860 or installing a newer version of Windows, 67 67 00:02:28,860 --> 00:02:30,630 or an updated security patch 68 68 00:02:30,630 --> 00:02:32,580 for that particular vulnerability. 69 69 00:02:32,580 --> 00:02:34,110 And then this brings us to the fourth step, 70 70 00:02:34,110 --> 00:02:36,030 which is to implement and track the solutions 71 71 00:02:36,030 --> 00:02:38,220 to ensure the incident fully handled. 72 72 00:02:38,220 --> 00:02:40,950 Now in this case, we might have had a single system 73 73 00:02:40,950 --> 00:02:44,130 that was infected by the piece of malware on the USB device. 74 74 00:02:44,130 --> 00:02:46,140 So we've identified what it was, 75 75 00:02:46,140 --> 00:02:48,570 we determined the relationship that led to the incident, 76 76 00:02:48,570 --> 00:02:51,210 and we've identified a couple of effective solutions. 77 77 00:02:51,210 --> 00:02:53,130 In this case, I'm going to want to go ahead 78 78 00:02:53,130 --> 00:02:55,380 and ensure that I block mass storage devices 79 79 00:02:55,380 --> 00:02:57,930 from being read on that user's system, and I want to ensure 80 80 00:02:57,930 --> 00:03:00,900 their antivirus and anti-malware solution is up to date. 81 81 00:03:00,900 --> 00:03:04,050 And now I need to implement and track those action items. 82 82 00:03:04,050 --> 00:03:06,390 In this case, I would tell my system administrators, 83 83 00:03:06,390 --> 00:03:08,010 through a change management process, 84 84 00:03:08,010 --> 00:03:10,860 to install the registry change that will prevent USB devices 85 85 00:03:10,860 --> 00:03:12,660 from being read on that machine, 86 86 00:03:12,660 --> 00:03:14,340 and making sure that it is part 87 87 00:03:14,340 --> 00:03:16,830 of our asset management and change management process, 88 88 00:03:16,830 --> 00:03:18,570 that machine has been updated 89 89 00:03:18,570 --> 00:03:19,800 to the latest version of Windows 90 90 00:03:19,800 --> 00:03:21,900 and has the latest security patches. 91 91 00:03:21,900 --> 00:03:23,160 By doing all of these things, 92 92 00:03:23,160 --> 00:03:24,780 we have now contained this incident, 93 93 00:03:24,780 --> 00:03:26,190 and figured out the root cause, 94 94 00:03:26,190 --> 00:03:28,110 and stopped it from happening again. 95 95 00:03:28,110 --> 00:03:30,141 Now, I like to take this one step further, though. 96 96 00:03:30,141 --> 00:03:33,060 Because we identified it on this single machine, 97 97 00:03:33,060 --> 00:03:34,830 we also want to look across the network 98 98 00:03:34,830 --> 00:03:36,150 and see if there's any other machines 99 99 00:03:36,150 --> 00:03:38,190 that could have been affected as well. 100 100 00:03:38,190 --> 00:03:40,590 For example, if we figured out that the reason 101 101 00:03:40,590 --> 00:03:42,780 that this piece of malware was able to be installed 102 102 00:03:42,780 --> 00:03:45,630 is because you're running Windows 10 instead of Windows 11, 103 103 00:03:45,630 --> 00:03:47,820 we then want to look at the rest of the network and say, 104 104 00:03:47,820 --> 00:03:50,310 how many other Windows 10 machines do I have? 105 105 00:03:50,310 --> 00:03:51,480 If there's a lot of them, 106 106 00:03:51,480 --> 00:03:53,430 it may be a very large solution for us 107 107 00:03:53,430 --> 00:03:56,040 to upgrade all those systems to Windows 11 108 108 00:03:56,040 --> 00:03:58,980 and prevent this vulnerability from being exploited again. 109 109 00:03:58,980 --> 00:04:01,860 That's the real benefit of doing a root cause analysis. 110 110 00:04:01,860 --> 00:04:03,960 You need to figure out what caused the incident 111 111 00:04:03,960 --> 00:04:05,511 and then see how many other things 112 112 00:04:05,511 --> 00:04:08,040 across your network or across your organization 113 113 00:04:08,040 --> 00:04:10,830 are going to have the same type of feature sets 114 114 00:04:10,830 --> 00:04:13,830 that could then be vulnerable to the same types of attacks. 115 115 00:04:13,830 --> 00:04:15,000 And that's really the big benefit 116 116 00:04:15,000 --> 00:04:16,500 of doing a root cause analysis, 117 117 00:04:16,500 --> 00:04:18,180 is by identifying all those other machines 118 118 00:04:18,180 --> 00:04:19,830 that are vulnerable to the same thing, 119 119 00:04:19,830 --> 00:04:21,513 we can prevent future attacks.