UNCLASSIFIED CYBER INCIDENT RESPONSE CONSIDERATIONS Jerry Eastman Cyber

UNCLASSIFIED CYBER INCIDENT RESPONSE CONSIDERATIONS Jerry Eastman, Cyber Analyst UNCLASSIFIED

UNCLASSIFIED When Does Cyber Incident Response Begin? “Dig your well before you’re thirsty” • Seth Godin UNCLASSIFIED

WHAT IS A CYBER INCIDENT? • Those cyber related issues that are not desired or expected and have the potential to have a negative impact on the organization. • Internal • External • Unkonwn • What is the difference between an incident and an event? • Impact • Potential Impact

WHO SHOULD BE IN CHARGE OF INCIDENT RESPONSE? • What does in charge mean? • Determine COA? • Determine severity? • Authorize expenses? • Authorize impact to different business units?

WHO SHOULD BE INVOLVED WITH INCIDENT RESPONSE? • IT – duh • What part of IT? • Legal? • HR? • Finance? • CEO? • Law Enforcement? • Risk Management? • Other

OTHER CONSIDERATIONS? • COOP / Business Continuity? • Dependencies? • Reputation? • Liability? • Insurance? • Regulatory? • Law/ordinances?

COMMUNICATIONS • What is the goal of communicating? • Who is doing the talking? • Who is listening? • What are they saying? • What are they not saying? • Threat Information Sharing?

UNCLASSIFIED THE BIG PICTURE UNCLASSIFIED

UNCLASSIFIED So Ph Vi oto d M eo s, ap s, s CYBER INFORMATION ur ce Da iv ch Da ta Ar er Oth cy en Ag ata D ed ta UNCLASSIFIED

UNCLASSIFIED CYBER INTELLIGENCE Source Data Archived Photos, Videos, Maps • • Data is verified Gaps are identified Analysis brings pieces together Picture is formed Other Agency Data UNCLASSIFIED

WRAP IT UP • Invite the right folks to the party. • Don’t get caught in the “It’s an IT issue” trap. • Consider broader implications. • It should evolve with the organization. • Resources