Computer und IT

Cyber Breach Response That Actually Works

YOU WILL BE BREACHED—THE ONLY QUESTION IS WHETHER YOU'LL BE READYA cyber breach could cost your organization millions of dollars—in 2019, the average cost of a cyber breach for companies was $3.9M, a figure that is increasing 20-30% annually. But effective planning can lessen the impact and duration of an inevitable cyberattack. Cyber Breach Response That Actually Works provides a business-focused methodology that will allow you to address the aftermath of a cyber breach and reduce its impact to your enterprise.This book goes beyond step-by-step instructions for technical staff, focusing on big-picture planning and strategy that makes the most business impact. Inside, you’ll learn what drives cyber incident response and how to build effective incident response capabilities. Expert author Andrew Gorecki delivers a vendor-agnostic approach based on his experience with Fortune 500 organizations.* Understand the evolving threat landscape and learn how to address tactical and strategic challenges to build a comprehensive and cohesive cyber breach response program* Discover how incident response fits within your overall information security program, including a look at risk management* Build a capable incident response team and create an actionable incident response plan to prepare for cyberattacks and minimize their impact to your organization* Effectively investigate small and large-scale incidents and recover faster by leveraging proven industry practices* Navigate legal issues impacting incident response, including laws and regulations, criminal cases and civil litigation, and types of evidence and their admissibility in courtIn addition to its valuable breadth of discussion on incident response from a business strategy perspective, Cyber Breach Response That Actually Works offers information on key technology considerations to aid you in building an effective capability and accelerating investigations to ensure your organization can continue business operations during significant cyber events.ANDREW GORECKI is a cybersecurity professional with experience across various IT and cybersecurity disciplines, including engineering, operations, and incident response. Originally from Europe, he provided consulting services across various industry sectors in the U.S., the UK, and other European countries. At the time of writing, he manages a team of incident response consultants within the X-Force IRIS competency of IBM Security where he leads investigations into large-scale breaches for Fortune 500 organizations, delivers proactive incident response services, and provides executive-level consulting on building and optimizing incident response programs. Foreword xxiiiIntroduction xxvCHAPTER 1 UNDERSTANDING THE BIGGER PICTURE 1Evolving Threat Landscape 2Identifying Threat Actors 2Cyberattack Lifecycle 4Cyberattack Preparation Framework 5Cyberattack Execution Framework 6Defining Cyber Breach Response 8Events, Alerts, Observations, Incidents, and Breaches 9Events 9Alerts 9Observations 10Incidents 10Breaches 11What is Cyber Breach Response? 12Identifying Drivers for Cyber Breach Response 13Risk Management 13Conducting Risk Management 13Risk Assessment Process 14Managing Residual Risk 17Cyber Threat Intelligence 18What is Cyber Threat Intelligence? 18Importance of Cyber Threat Intelligence 19Laws and Regulations 20Compliance Considerations 20Compliance Requirements for Cyber Breach Response 21Changing Business Objectives 22Incorporating Cyber Breach Response into aCybersecurity Program 23Strategic Planning 23Designing a Program 24Implementing Program Components 25Program Operations 26Continual Improvement 27Strategy Development 27Strategic Assessment 28Gap Analysis 28Maturity Assessment 30Strategy Definition 32Vision and Mission Statement 32Goals and Objectives 33Establishing Requirements 33Defining a Target Operating Model 35Developing a Business Case and Executive Alignment 35Strategy Execution 37Enacting an Incident Response Policy 37Assigning an Incident Response Team 38Creating an Incident Response Plan 38Documenting Legal Requirements 38Roadmap Development 39Governance 40Establishing Policies 40Enterprise Security Policy 41Issue-Specific Policies 41Identifying Key Stakeholders 42Executive Leadership 42Project Steering Committee 42Chief Information Security Officer 43Stakeholders with Interest in Cyber Breach Response 43Business Alignment 44Continual Improvement 44Necessity to Determine if the Program is Effective 45Changing Threat Landscape 45Changing Business Objectives 45Summary 46Notes 47CHAPTER 2 BUILDING A CYBERSECURITY INCIDENT RESPONSE TEAM 51Defining a CSIRT 51CSIRT History 52The Role of a CSIRT in the Enterprise 52Defining Incident Response Competencies and Functions 55Proactive Functions 55Developing and Maintaining Procedures 56Conducting Incident Response Exercises 56Assisting with Vulnerability Identification 57Deploying, Developing, and Tuning Tools 58Implementing Lessons Learned 59Reactive Functions 59Digital Forensics and Incident Response 59Cyber Threat Intelligence 60Malware Analysis 60Incident Management 61Creating an Incident Response Team 61Creating an Incident Response Mission Statement 62Choosing a Team Model 62Centralized Team Model 63Distributed Team Model 64Hybrid Team Model 65An Integrated Team 66Organizing an Incident Response Team 66Tiered Model 66Competency Model 68Hiring and Training Personnel 69Technical Skills 69Soft Skills 71Pros and Cons of Security Certifications 72Conducting Effective Interviews 73Retaining Incident Response Talent 74Establishing Authority 75Full Authority 75Shared Authority 76Indirect Authority 76No Authority 76Introducing an Incident Response Team to the Enterprise 77Enacting a CSIRT 78Defining a Coordination Model 78Communication Flow 80Incident Officer 80Incident Manager 81Assigning Roles and Responsibilities 82Business Functions 82Human Resources 82Corporate Communications 83Corporate Security 83Finance 84Other Business Functions 85Legal and Compliance 85Legal Counsel 85Compliance Functions 86Information Technology Functions 87Technical Groups 87Disaster Recovery 88Outsourcing Partners and Vendors 89Senior Management 89Working with Outsourcing Partners 90Outsourcing Considerations 91Proven Track Record of Success 91Offered Services and Capabilities 91Global Support 92Skills and Experience 92Outsourcing Costs and Pricing Models 92Establishing Successful Relationships with Vendors 93Summary 94Notes 95CHAPTER 3 TECHNOLOGY CONSIDERATIONS IN CYBER BREACH INVESTIGATIONS 97Sourcing Technology 98Comparing Commercial vs. Open Source Tools 98Commercial Tools 98Open Source Software 98Other Considerations 99Developing In-House Software Tools 100Procuring Hardware 101Acquiring Forensic Data 102Forensic Acquisition 102Order of Volatility 103Disk Imaging 103System Memory Acquisition 105Tool Considerations 106Forensic Acquisition Use Cases 107Live Response 108Live Response Considerations 109Live Response Tools 109Live Response Use Cases 112Incident Response Investigations in Virtualized Environments 113Traditional Virtualization 115Cloud Computing 115Forensic Acquisition 115Log Management in Cloud Computing Environments 117Leveraging Network Data in Investigations 118Firewall Logs and Network Flows 118Proxy Servers and Web Gateways 120Full-Packet Capture 120Identifying Forensic Evidence in Enterprise Technology Services 123Domain Name System 123Dynamic Host Confi guration Protocol 125Web Servers 125Databases 126Security Tools 127Intrusion Detection and Prevention Systems 127Web Application Firewalls 127Data Loss Prevention Systems 128Antivirus Software 128Endpoint Detection and Response 129Honeypots and Honeynets 129Log Management 130What is Logging? 130What is Log Management? 132Log Management Lifecycle 133Collection and Storage 134Agent-Based vs. Agentless Collection 134Log Management Architectures 135Managing Logs with a SIEM 137What is SIEM? 138SIEM Considerations 139Summary 140Notes 141CHAPTER 4 CRAFTING AN INCIDENT RESPONSE PLAN 143Incident Response Lifecycle 143Preparing for an Incident 144Detecting and Analyzing Incidents 145Detection and Triage 146Analyzing Incidents 146Containment, Eradication, and Recovery 147Containing a Breach 147Eradicating a Threat Actor 148Recovering Business Operations 149Post-Incident Activities 149Understanding Incident Management 150Identifying Process Components 151Defining a Process 151Process Controls 153Process Enablers 155Process Interfaces 155Roles and Responsibilities 158Service Levels 159Incident Management Workfl ow 160Sources of Incident Notifi cations 160Incident Classifi cation and Documentation 162Incident Categorization 163Severity Assignment 163Capturing Incident Information 167Incident Escalations 169Hierarchical Escalations 169Functional Escalation 169Creating and Managing Tasks 169Major Incidents 170Incident Closure 171Crafting an Incident Response Playbook 171Playbook Overview 171Identifying Workfl ow Components 173Detection 173Analysis 174Containment and Eradication 176Recovery 176Other Workflow Components 177Post-Incident Evaluation 177Vulnerability Management 177Purpose and Objectives 178Vulnerability Management Lifecycle 178Integrating Vulnerability Management and Risk Management 180Lessons Learned 180Lessons-Learned Process Components 181Conducting a Lessons-Learned Meeting 183Continual Improvement 184Continual Improvement Principles 184The Deming Cycle 184DIKW Hierarchy 185The Seven-Step Improvement Process 187Step 1: Define a Vision for Improvement 188Step 2: Define Metrics 188Step 3: Collect Data 189Step 4: Process Data 190Step 5: Analyze Information 191Step 6: Assess Findings and Create Plan 191Step 7: Implement the plan 192Summary 192Notes 193CHAPTER 5 INVESTIGATING AND REMEDIATING CYBER BREACHES 195Investigating Incidents 196Determine Objectives 197Acquire and Preserve Data 198Perform Analysis 200Contain and Eradicate 202Conducting Analysis 202Digital Forensics 203Digital Forensics Disciplines 203Timeline Analysis 205Other Considerations in Digital Forensics 206Cyber Threat Intelligence 207Cyber Threat Intelligence Lifecycle 208Identifying Attacker Activity with Cyber Threat Intelligence 209Categorizing Indicators 212Malware Analysis 214Classifying Malware 214Static Analysis 216Dynamic Analysis 217Malware Analysis and Cyber Threat Intelligence 217Threat Hunting 218Prerequisites to Threat Hunting 218Threat Hunting Lifecycle 219Reporting 221Evidence Types 223System Artifacts 223Persistent Artifacts 223Volatile Artifacts 225Network Artifacts 226Security Alerts 227Remediating Incidents 228Remediation Process 229Establishing a Remediation Team 230Remediation Lead 231Remediation Owner 232Remediation Planning 233Business Considerations 233Technology Considerations 234Logistics 235Assessing Readiness 235Consequences of Alerting the Attacker 236Developing an Execution Plan 237Containment and Eradication 238Containment 238Eradication 239Monitoring for Attacker Activity 240Summary 241Notes 242CHAPTER 6 LEGAL AND REGULATORY CONSIDERATIONS IN CYBER BREACH RESPONSE 243Understanding Breaches from a Legal Perspective 244Laws, Regulations, and Standards 244United States 245European Union 246Standards 246Materiality in Financial Disclosure 247Cyber Attribution 248Motive, Opportunity, Means 248Attributing a Cyber Attack 249Engaging Law Enforcement 251Cyber Insurance 252Collecting Digital Evidence 252What is Digital Evidence? 253Digital Evidence Lifecycle 253Information Governance 254Identification 254Preservation 255Collection 255Processing 255Reviewing 256Analysis 256Production 257Presentation 258Admissibility of Digital Evidence 258Federal Rules of Evidence 258Types of Evidence 260Direct Evidence 260Circumstantial Evidence 260Admission of Digital Evidence in Court 261Evidence Rules 261Hearsay Rule 261Business Records Exemption Rule 262Best Evidence 262Working with Legal Counsel 263Attorney-Client Privilege 263Attorney Work-Product 264Non-testifying Expert Privilege 264Litigation Hold 265Establishing a Chain of Custody 265What is a Chain of Custody? 266Establishing a Defensible Protocol 266Traditional Forensic Acquisition 267Live Response and Logical Acquisition 268Documenting a Defensible Protocol 269Documentation 269Accuracy 270Auditability and Reproducibility 270Collection Methods 270Data Privacy and Cyber Breach Investigations 271What is Data Privacy? 271Handling Personal Data During Investigations 272Enacting a Policy to Support Investigations 272Cyber Breach Investigations and GDPR 273Data Processing and Cyber Breach Investigations 274Establishing a Lawful Basis for the Processing of Personal Data 275Territorial Transfer of Personal Data 276Summary 277Notes 278Index 281

28,99 €