Cyber Disaster Recovery Planning for the Inevitable 2004

n Today, survival of the business also depends on survival of the information infrastructure Firewalls, proxies, access controls n VPNs, encryption, authentication n Growing regulation n SOX n HIPPA n GLBA n CA Breach Law n n Planning ahead insures against catastrophe © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Overview n n n Traditional disaster recovery (D/R) planning is formal and tested regularly Cyber-D/R planning is less mature, but more necessary today Cyber-D/R requires quick reaction and different skill sets: e. g. , computer forensics Growing trend toward prosecution Critical infrastructure protection requires better Cyber-D/R planning and response capability © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

“Traditional” disaster recovery n Business impact analysis Determine functional areas critical to the business n Identify critical computer systems and applications n Determine disaster recovery budget n n Formal disaster recovery plan Disaster declaration criteria and procedures n Hot-site and cold-site arrangements n Staff response / call-out plans n Recovery procedures n n Annual testing © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

“Cyber” disaster recovery n Business impact analysis n n Focusing on impact of “electronic” disasters such as computer security breaches, instead of “natural” disasters Computer Security Incident Response Plan n Similar in structure to disaster recovery plan Incident declaration criteria and procedures n Staff response / call-out plans n Recovery procedures n Restore operations “in-place, ” not at hot-site n Focus on forensic approach n Quarterly testing n © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

An observation… n n n ISS responded to as many intrusion incidents in Q 4 -03 alone as it did all of 2003. 75% of the cases have requested forensic evidence considerations for prosecution. These incidents were all different, but they have had recurring themes which make them easier to prepare for. © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

What happened? n These incidents were not caused by “natural” disasters like fire, flood, or earthquake n n A “traditional” disaster recovery plan would not have been sufficient But the potential effects were the same Ability to conduct business was impacted n Reputation could have been damaged n Financial loss could have occurred n Loss of customers n © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

The need for good and timely information During a natural disaster, information is made available to us by television, radio, and government sources n During a cyber-disaster, we are almost always limited to the information we can obtain for ourselves n Planning and response are improved when we know ahead of time how these attacks work and how we can defend against them n © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Obtaining good and timely information n n n Do you have skills in-house to stay on top of threats and vulnerabilities? Does your staff respond to attacks frequently enough to keep their skills sharp? Do you have ( and follow) escalation, notification and handling procedures? What is the value of a second opinion when you think you’re under attack? Can you conduct a forensic investigation without contaminating evidence? What are your regulatory requirements? © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Information Security Lifecycle How well are we protected, now and in the future? Given what we have, how do we handle security incidents? © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems. What can we add or change to improve our security? Put all this in place without impacting users

Goals of an Incident Response n n n n Gain control of any upcoming security problems Facilitate centralized reporting of incidents Coordinate response to incidents Raise security awareness of users Provide a clearinghouse of relevant computer security information Promote security policies Provide liaisons to legal and criminal investigative groups both inside and outside the company © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Response • Detection: Analysis of incident data to determine the source of the incident, its cause (program error, human error, or deliberate action), and its effects; • Containment: Preventing the effects of the incident from spreading to other computer systems and computer communications networks in your organization; • Eradication: Stopping the incident at the source and/or protecting your computer systems and computer communications networks from the effects of the incident; • Recovery: Restoration of the affected computer systems and computer communications networks to normal operation; and • Risk Reoccurrence Mitigation: Making sure that your computer systems and computer communications networks are protected from future occurrences of the incident. © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Preparedness • Security Best Practices (ISO 17799) Incident Preparedness • Roles and Responsibilities • Technology • Education/Awareness • Scenario Testing & Validation Confidentiality Integrity Availability © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Assess Existing Controls & Procedures ISO 17799 Best Practices… n n n Information Security Policy Incident Response and Preparedness Authentication & Access Control Information Ownership and Classification Change Control Auditable Information Security Management Network Management Vulnerability Management & Policy Compliance Threat Management Life Cycle Security Performance Monitoring (Quality) © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Assess Infrastructure n Network Perimeter and Penetration Analysis (determines current exposure to circumventing perimeter controls) Internet Connectivity (e. g. , firewalls, routers) n Business to Business connectivity n Remote Access n n Vulnerability and Risk Analysis (determines current risks and exposure within the organization) n Qualitative and Quantitative Analysis: n Network Exposures n Host Exposures n Database Security n Network Architecture n Best Practices (ISO 17799) n Regulatory Requirements © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Define the Desired Security State n Define existing and future business requirements relative to information security n Balance business objectives, risks and best practices such as ISO 17799 n Define controls and their benefits relative to roles, responsibilities and associated risks n Identify residual risks n Define the requirements for a proactive, integrated strategic security infrastructure © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Perform a GAP Analysis Desired Security State (DSS) Current Security State © 2004 Internet

Incident Alert! Incident Preparedness Alarm • Technology (e. g. , Firewalls, ID) • Management Process (HR) • System Administration Staff • End Users (Internal, External) • News Agencies • Hackers • Internet Service Provider © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Reporting Incident Preparedness Alarm Report & Notification Communicate • Technology (email, pager, etc. ) • Help Desk (Trouble Ticket) • Call-Out Process © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Investigation Incident Preparedness Alarm Report & Notification Preliminary Investigation Is It Real? • Activity Logs • Preliminary Interview and Check • Policy Violation • Technology © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Decision and Resources Incident Preparedness Alarm Is It Real? Report & Notification Preliminary Investigation • Emergency Declaration Decision and Resources • Incident Coordinator/Team • Course of action • Technical • Legal © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Response Take Action Incident Preparedness Alarm Report & Notification Preliminary Investigation Decision and Resources Response • In depth Investigation Ø Detailed Interviews and Forensics • Containment Ø Connectivity (Off, Routing, etc. ) Ø Sever Trust among Systems Ø Disable Applications Ø Sandbox Ø Honeypot Ø Remote Access • Legal Ø Public Relations Ø Human Resources Ø Law Enforcement Ø Prosecution • Customer/Employee Notification © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Recovery Incident Preparedness Alarm Report & Notification Preliminary Investigation Decision and Resources Response Recovery © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems. Fix & Go On • Eradication Ø Trojans, Root kits, Bogus Accounts • Operations Restoration Ø Backups, Cleanup Ø Disaster Recovery • Mitigate Reoccurrence Risk Ø Technology Ø Policy and Procedures

Incident Recovery Incident Preparedness Improvement/Quality Alarm • Documentation Report & Notification Preliminary Investigation L Lessons Learned Decision and Resources Response Recovery © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems. • Update Incident Response Process • Financial Impact Analysis • Staff Needs • Budget Needs • Quality in Information Security

CSIRP C omputer S ecurity I ncident R esponse P lan © 2004 Internet

Components of a CSIRP n n n n Charter Incident Definition and Declaration Team Make Up Response Procedures Preplanned Response Procedures Sample Press Release CSIRT Contact Information © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Charter n n n Mission Scope Organizational & Team Structure Information Flow Services (Reactive and Proactive) © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Incident Definition/Declaration n Severity n Response Teams n D/R Relationship n © 2004 Internet

Team Makeup CSIRT Officer and Manager n CSIRT Decision Pool n © 2004 Internet

Incident Response Team Computer Incident Response Team CISO CIRT Coordinator Vendor Augment Emergency Response Service UNIX Ops Business Security Officer Business Unit A Business Security Officer Business Unit B Technology Manager NT Operations Internet Ops UNIX Ops NT Operations © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems. VP Human Resources Legal Council Technology Infrastructure Public Relations Internet Ops Disaster Recovery

Roles and Responsibilities should be defined: Communication Protocol Coordination Who will be the ultimate decision maker. n Who will monitor the monitors. n n © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Centralized Incident Reporting n A central point of contact must be created Hotline n Email address (ers@mycompany. com) n n Centralized reporting is vital to the effectiveness of a company’s ERS initiative Consolidation n Correlation n Statistics on size, nature and extent of security problems n © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

Response Procedures Alert Phase n Triage Phase n Recovery Phase n Maintenance Phase n

Preplanned Response Procedures Virus Response n Past Incidents n n Lessons Learned © 2004

Sample Press Release Plan on word getting out n Then be really happy if

CSIRT Contact Information n Call out lists and alternates © 2004 Internet Security Systems.

ISS Jeopardy n Asses/Design/Deploy/Manage/Educate What is the Information Security Life Cycle © 2004 Internet

ISS Jeopardy n Detect/Contain/Eradicate/Recover/Mitigate Reoccurrence What are the Goals of Incident Response © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.

ISS Jeopardy n This Item Sets The Charter, Roles and Procedures for Incident Response What is a Computer Security Incident Response Plan © 2004 Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.