Tuesday, December 6 2022

Fundamentals of every CRP is the CRP life cycle. It is a series of stages that occur with steps needed to be taken in order to make sure every aspect of the cyber incident has been examined and documented. The tricky part comes in where companies need to assess their working nature and determine what aspects of the company are most valuable in order to create the most productive CRP. If you can predict where your company is most likely to be hit, you have more chances of defending against these types of attacks along with customizing a CRP to best suit the company’s environment. Following are the defined series of steps/stages that should be included in every CRP for cyber security:

1. Preparation is the first important stage in the process of responding to a cyber incident. Common sense tells you that there must be some sort of a security system in place in order to be able to identify an incident. In other words, a structure where adequate security staff, security mechanisms/tools and knowledge of the company’s resources is vital for any kind of successful response.

2. The first stage directly connects with the second stage which is identification. Having an adequate setup is paramount to the ability to identify that an incident has occurred. This is usually where alerts from intrusion detection systems come up, web filtering gateways detect a suspicious external connection, SIEM solutions connect the dots of an attacker passing through the internal network or an endpoint solution alerting of a phishing email opened. No matter the case, quick reaction from qualified security staff is needed in order to escalate and respond to the alerts.

3. Containment is the third stage of the CRP life cycle. In order to stop further spreading of malware and damage to the network and data theft, containment of the threat actors is what is needed in order to focus on the next stage of the incident response. A good example in practice would be a complete network containment of the infected machine which means cutting all internet and intranet connections of the machine.

4. Eradication is one of the more complex stages in the incident process as it involves forensic analysis in order to determine the extent of presence of the threat actor. Security staff need to make sure that what they do in the eradication stage eliminates all presence and access of the threat actor to the system. This includes, re-imaging of machines, searching for backdoors, and most importantly, determining the root cause analysis if the incident. Depending on the root cause, eradication stage can be simplified by knowing the vector of attack that took place.

5. Recovery stage comes right after eradication. In this stage, getting the infected systems up and running again is important to decrease any potential monetary loss associated with the downtime of the infected system. In some cases, a single computer infected with a virus is not going to bring down the company, but an office with 100 employees whose computers fell victim to ransomware is a whole other story. In the later case, quick action from the security team will determine how big the loss of revenue will be.

As previously stated, lessons learned is one of the most important stages for a simple fact that it will showcase to everybody how the incident occurred and how to effectively close the attack vector that got exploited. Closing unnecessary open ports and services, implementing dual factor authentication, limiting exposure of internal resources and increasing the segmentation of the network are just some of the things that could be done in order to close the gaps.

Cyber Security Response Plan
Previous

Free preview of the 92nd Academy Award ceremonies on websites? Beware

Next

Cyber attacks in 2020: how they will affect you and how to prevent them.

Check Also

Widget

Don’t Miss

Cyber Deals: Spin Technology, CyberArk, Mesh Security

James Hu

Cybersecurity Venture Funding and Mergers: This week’s deals involved cloud security services, data privacy, and industrial cybersecurity companies. Funding Cloud cybersecurity firm Mesh Security has secured $4.5 million in venture funding. The round was led by Booster Ventures with participation from other investors. Spin Technology, a firm providing SaaS security solutions, raised $16 million in […]

Cyber Deals: Cybrary, Ping Identity, Axio Global

James Hu

Cybersecurity Venture Funding and Mergers: Key investments were made in cybersecurity training, secure enterprise browser, and risk management companies. M&A activity this week involved identity security, zero trust, and threat intelligence firms. Funding Cybrary, a cybersecurity training platform, raised $25 million in a Series C funding round. The round was led by BuildGroup and Gula […]

Cybrary Secures $25 Million in Series C Funding Round

James Hu

Cybrary, a Maryland-based cybersecurity training platform provider, raised $25 million in a Series C funding round. The round was led by BuildGroup and Gula Tech Adventures, two of its current investors. Following its $15 million Series B round announced in November 2019, this latest investment brings Cybrary’s total funding to date to $48 million. Cybrary […]

Cyber Deals: Exterro, Naoris Protocol, Cybit Sec

James Hu

Cybersecurity Venture Funding and Mergers: This week, notable funding and M&A activity involved compliance, enterprise security, and vulnerability assessment firms. Funding Exterro, a legal governance, risk, and compliance software provider, completed a strategic recapitalization valuing the firm at over $1 billion. The company, currently owned by Leeds Equity Partners, is targeting a potential 2023 initial […]

Cyber Deals: Halborn, Irideos, Anvilogic

James Hu

Cybersecurity Venture Funding and Mergers: This week, cybersecurity venture funding and M&A activity involved blockchain, artificial Intelligence, and SaaS solution providers. Many of these deals will also be funding the future of cloud security. Funding Halborn, a blockchain cybersecurity firm, raised $90 million in a Series A funding round led by Summit Partners with participation […]

Huntress acquires Curricula for $22 million

James Hu

Huntress, a cybersecurity firm providing a security management platform to small and medium sized businesses, has acquired Curricula, a security awareness training service provider, for $22 million. Curricula is a freemium SaaS company offering solutions for employee cybersecurity training. Their methods incorporate behavioral learning techniques and engaging storytelling to maximize employee engagement. Small and medium […]