MGT553: Cyber Incident Management

Overview

In Section 1 we will focus on understanding the incident, gathering information from different groups and standardizing the language. To assist in this, we will remind ourselves of some of the common terms to optimize communications. From there we will define what the Incident Management (IM) group will seek to achieve, so we can state and focus on our objectives. This is important as retaining focus can be hard when it gets super busy.

With the objectives defined we then turn to initial tasks and delegating those to the team; this is to give us some breathing space to plan the next steps. Our initial tasking output will be based on one of the core tools in the Cyber Incident Response Tool Kit (CIMTK) the "IM Starting Grid". This detailed list of Yes/No questions outputs a list of core IM tasks that aide rapid response. By identifying these tasks early, concurrent activity can be initiated for both support teams (Incident Response (IR), Information Technology (IT), Human Resources (HR), Legal etc.) and the IM team. As IM is totally dependent upon a good team, we will assess team composition and what different groups need to contribute to the mission. Finally, we dig into communication and how to interact with different stakeholders. Tracking activity, tasks, and communications is a big theme throughout this course.

Exercises

• Reviewing the initial incident briefing
• The incident management starting grid
• Setting the objectives for the IM team
• Crisis communications: briefing the executives

Topics

Initial Information Gathering

• Using common language
• Understanding the attack
• IR Frameworks, OODA loops and non-Zero-sum games
• Scoping your initial tasks

Defining your Objectives

• What are typical objectives in IR/IM?
• Mapping attacks to business impacts

Building and Managing our Team

• Managing people to create productive teams
• Recognizing Stress
• Battle rhythm and burnout

Building our Communications Plan

• Communications planning
• Communicating with Execs, teams, and 3rd parties
• Communicating with Executives
• Communicating with Law Enforcement
• Communicating with Customers
• Communicating with Journalists
• Tracking the message

Overview

After reviewing Section 1, we conclude the communications topic by looking at communications with the attackers. While you may have no plans to pay any ransom, by entering into dialogue with attackers, you can gain time to fix issues the attackers have uncovered, discovered, or could leak. While controversial and possibly contrary to your own beliefs, it is important to understand options are available to the organization. We will cover how attacker dialogue may occur and what factors will influence the response options and process.

We will look at what incident information should be tracked and options or ways to achieve that. We review both commonly available products as well as bespoke options (including those for on prem and cloud hosted solutions).

Getting into the remediation of the network and data damage, we have a large section on categorizing the damage the attackers have inflicted and then mapping to the necessitated remediation work that will need to be prioritized and tracked to ensure that all possible vulnerabilities have been removed. A much-overlooked aspect, we discuss secrets that are included in stolen data and systems and consider how this might affect our future operations.

In the reporting and documenting of the case, we review some of the outputs from the IM process. While a solid IR report is always useful, we will cover what aspects could be added to expand it to cover IM. This is important as the direction of the Incident Response is often mandated by Incident Management, so linking the two into one report makes for a more structured reading while outsourcing some aspects to others.

In planning the closure of the incident, we discover what remediation and vulnerability closure tasks should be moved to non-incident mainstream projects and what reflection meetings should be held to ensure root causes are captured and lessons are identified and tracked.

In developing the wider team, we examine some of the training you can give those outside of the regular IR and IM staff to improve their awareness of issues and to help smooth future incidents. To assist this, we explore tabletop exercises and how you make them. We then both build one as a lab and close out the section by running one.

Exercises

• Dealing with the attackers
• Drafting a public statement
• Crisis communications: briefing the team
• Prioritizing the data and system remediation planning
• Running an example tabletop exercise

Topics

Talking to or working with, the attackers

• Understanding what results the attackers are trying to achieve
• Choosing a communications medium
• Attacker media and comms methods
• Proxies, trusted 3rd parties and attacker reputation
• Trying to control the narrative
• Understanding what the attackers have
• Options and impacts
• The cost of doing nothing
• Is paying the attackers really an option?

Tracking the Incident, tasks, people and progress

• Review of the functions we might want to include in our IM solution
• Incident Trackers and what they can look like
• Evidence management
• Task and work tracking
• Building the right solution for the organisation
• Using Google Docs as an emergency IM Platform

Remediation of network and data damage

• Types of Remediation system & data
• Tracking the remediation
• CIMTK: CC Systems and users impacted
• Categorizing exposed assets
• Identifying who owns the data
• Documenting and notifying impacted parties - Counter Compromise Activities

Reporting and documenting the case

• When do you start the report?
• Types of reports
• What goes in the report?
• Graphics are great!
• Getting input, support and consensus
• Control and access to the reports

Planning the closure of the Incident

• Reviewing the task and key objectives
• What is BAU for the impacted teams?
• What's the team up to?
• Running a FRCA
• Handing things over to others
• Breaking up the team

Developing the wider team

• Why train others?
• Training the wider organization
• Planning enterprise-wide training
• Developing and running Cyber Incident Exercises

Summary and closure