In this lesson,
we'll discuss incident response training and testing.
Now, when it comes to training and testing,
many people think that they are the same thing,
but in the world of incident response,
they are different.
First, we have training.
Training is education
to ensure employees and staff understand your processes,
procedures, and priorities during an incident response.
By conducting training, you're going to make sure
that your people are ready to respond
when something bad happens.
Training should be provided to all employees
with a relevant perspective
and focus based on their needs
because not everyone is going to get the same training.
For example, if you're a first responder,
you need training in a technical capacity.
What are the procedures that you're going to follow?
How are you going to re-image a machine?
How do you remove malware?
How do you change configuration settings?
All of that stuff is part of your responding training.
Now, if you're a manager or executive,
you're going to have different training requirements.
You're going to be focused more on risk versus reward.
You'll focus more on managerial decision making
and communication across your organization
and outside the organization
with law enforcement and media as well.
Our end users also need to be trained though.
Our end users should be trained
on the way to report
if they suspect an incident is occurring.
For instance, as an end user,
if I opened up my email
and I see a phishing campaign,
how do I report that to the service desk?
If I went and clicked on one of those links,
I'm going to need remedial training
to know how to identify that in the future
and make sure that I don't fall for that again.
This is the idea of your end user training.
They need training on how to be a better user
and how to prevent incidents
from occurring in the first place.
Now, when you're providing training,
one of the things you want to make sure you're capturing
is lessons learned from the previous incidents,
and you want to make sure you bring those back up
during the training
because when you have lessons learned,
that means that something went wrong in the past
and how can we do better in the future
is by training those people
on the lessons that we've learned.
If we just write down those lessons learned
and nobody reads them again,
then nobody gets training on it,
and then we're going to be doomed to repeat those things again.
And so we want to ensure that we're preventing that.
Remember, when you're doing training,
it's not just about technical skills here.
You also need to include soft skills
in relationship building within your teams,
because that's important as well
if you really want a high functioning
cybersecurity incident response team.
Now, let's take a look at testing.
Testing is the practical exercise
of incident response procedures.
With training,
we're going to teach you what to do.
In testing,
we're going to make sure you know how to do it.
Now, when you're dealing with testing,
we'll often conduct a test
to simulate a significant incident.
Now, the challenge is doing this is very costly
and it can become a complexity.
For example, I've been involved
with a lot of testing over the years.
One such test was a full scale exercise
that showed exactly what we would do
in the event if we had a large scale data breach.
Now, this went across multiple sites around the world
and it cost us hundreds of thousands of dollars to do so,
but it made sure everyone knew what they were doing
and that they could actually go through those actions
and get a bad actor out of our systems.
Now, when you're designing your test,
you can do it in one of three major ways.
The first is a tabletop,
the second is a penetration test,
and the third is a full scale exercise of simulation.
Now, when we're dealing with a tabletop exercise
or a TTX, this is an exercise
that uses an incident response scenario
against a framework of controls or a red team.
Now, the reason we call it a tabletop exercise
is because we're actually doing it on our tabletop
and we're not physically doing it in our networks.
In a tabletop,
we might gather experts around the table
and we'll start presenting scenarios.
For instance, if I was leading the tabletop,
we would say, hey, you have an indication of data breach
occurring in this data breach server.
What would you do?
And the defenders would start saying what they would do,
and each would take turns,
almost like their role playing
on what they would do in this particular scenario.
Now, the benefit of doing a tabletop
is that it's a lot less expensive
than a full-blown exercise,
but there are some negatives due to the fact
that you can't really get the hands-on experience
because you're not physically doing the things
on the keyboard
and making actions happen on the network.
So it's really more of a theoretical exercise.
Now, another way you can do this is you can break up people
into red teams and blue teams.
Now, the red teams are the attackers
and the blue teams are the defenders.
So you can actually take turns
by saying, okay, here's the blue team scenario.
This is what you detect, what do you do?
And then based on what they say,
the red team says, okay, then we would do X, Y, and Z.
Then the blue team will say, well, we will see this
and respond in A, B, and C, way.
And then they'll go back and forth several rounds
to initiate attack,
and defend against attack go back and forth
until we can see what the effects are.
The benefits of doing a red team
versus blue team type of scenario
is that you're going to get live people thinking through
both the attacker side and the defender side
to help come up with a better solution
in how to configure
and better manage those controls to protect your network.
Now, another way you can do this
is by actually getting people on the network.
This is done through a penetration test.
Now, a penetration test occurs
when a red team attempts to conduct an intrusion
into the network
by using a specific scenario
based on threat modeling.
Now, this is an important concept here
when we're talking about penetration tests,
because we're not just doing something against the network
to see what we can do to get in.
We have a specific goal in mind.
So if my goal is to go after the database,
I'm not going to throw
a distributed denial of service attack at you.
That wouldn't be a valid pen test.
So instead, we have specific scenario
based on the threat modeling,
meaning we know what a regular adversary would do,
and we're going to base our actions on that.
Now, when you're dealing with a penetration test,
you always have to agree on a clear methodology
and rules of engagement
before that penetration test is performed.
This is critically important
because there are rules to these things.
As I said, I'm not just going to throw
a distributed denial of service attack at you
because that would probably be
against the rules of engagement.
Now, if they're in my rules of engagement,
then it'll be all fair game,
but in most cases, that's not going to be in there.
Some popular penetration tests and tools
and operating systems you might see in real world
are things like Metasploit, Cobalt Strike,
Kali Linux, ParrotOS and Commando OS.
As a cyber security professional
working as a network defender,
if you ever see these tools
or operating systems on your network,
you should be thinking about the fact
that they are penetration testing tools,
which could be used as part of a penetration test
or even worse, by an attacker
because most of these are open source tools
that anyone could download and use.
The final area we need to discuss in terms of training
and testing for incident response
is the use of a simulation.
A simulation exercise is designed
to go beyond theoretical tabletop discussions
and involve realistic hands-on scenarios
that mimic actual incidents.
These exercises provide a comprehensive view
of how well your incident response teams
can execute their roles
in a controlled yet authentic environment.
Simulation exercises can range
from relatively simple scenarios
such as responding to simulated phishing attacks
or ransomware infection
to complex scenarios
that involve multi-stage attacks,
data breaches in coordination
with external parties like law enforcement
or public relations team.
The goal of these simulations
is to assess not only your technical skills,
but also the ability
to make sound decisions under pressure
and effectively communicate within
and outside the organization.
When conducting simulations,
it's essential to align them
with your organization's threat landscape
and risk profile.
Simulations should challenge your incident response teams
to think critically, adapt to evolving situations
and coordinate their efforts seamlessly.
These exercises are invaluable
for identifying gaps in your incident response plan,
improving coordination between teams
and ensuring that everyone understands their roles
during a real incident.
By regularly incorporating simulation exercises
into your incident response training and testing program,
you can better prepare your organization
to respond effectively
to a wide range of cybersecurity incidents.
So remember, training and testing are used
to create a more robust incident response framework
that can help your organization stay resilient
in the face of evolving threats.
Training is the educational process
that equips employees and staff
with the knowledge and skills needed to understand
and respond effectively to incidents
by focusing on processes, procedures, and priorities.
Testing involves practical exercises
that assess an individual or team's ability
to execute incident response procedures
to ensure that they can apply their training effectively
in real world scenarios.
Simulation on the other hand
refers to realistic hands-on exercises
that replicate actual incident response scenarios
and provide comprehensive assessment
of a incident response team's capabilities,
decision making skills,
and communication under controlled conditions.