Saturday, October 16 2021

Fundamentals of every CRP is the CRP life cycle. It is a series of stages that occur with steps needed to be taken in order to make sure every aspect of the cyber incident has been examined and documented. The tricky part comes in where companies need to assess their working nature and determine what aspects of the company are most valuable in order to create the most productive CRP. If you can predict where your company is most likely to be hit, you have more chances of defending against these types of attacks along with customizing a CRP to best suit the company’s environment. Following are the defined series of steps/stages that should be included in every CRP for cyber security:

1. Preparation is the first important stage in the process of responding to a cyber incident. Common sense tells you that there must be some sort of a security system in place in order to be able to identify an incident. In other words, a structure where adequate security staff, security mechanisms/tools and knowledge of the company’s resources is vital for any kind of successful response.

2. The first stage directly connects with the second stage which is identification. Having an adequate setup is paramount to the ability to identify that an incident has occurred. This is usually where alerts from intrusion detection systems come up, web filtering gateways detect a suspicious external connection, SIEM solutions connect the dots of an attacker passing through the internal network or an endpoint solution alerting of a phishing email opened. No matter the case, quick reaction from qualified security staff is needed in order to escalate and respond to the alerts.

3. Containment is the third stage of the CRP life cycle. In order to stop further spreading of malware and damage to the network and data theft, containment of the threat actors is what is needed in order to focus on the next stage of the incident response. A good example in practice would be a complete network containment of the infected machine which means cutting all internet and intranet connections of the machine.

4. Eradication is one of the more complex stages in the incident process as it involves forensic analysis in order to determine the extent of presence of the threat actor. Security staff need to make sure that what they do in the eradication stage eliminates all presence and access of the threat actor to the system. This includes, re-imaging of machines, searching for backdoors, and most importantly, determining the root cause analysis if the incident. Depending on the root cause, eradication stage can be simplified by knowing the vector of attack that took place.

5. Recovery stage comes right after eradication. In this stage, getting the infected systems up and running again is important to decrease any potential monetary loss associated with the downtime of the infected system. In some cases, a single computer infected with a virus is not going to bring down the company, but an office with 100 employees whose computers fell victim to ransomware is a whole other story. In the later case, quick action from the security team will determine how big the loss of revenue will be.

As previously stated, lessons learned is one of the most important stages for a simple fact that it will showcase to everybody how the incident occurred and how to effectively close the attack vector that got exploited. Closing unnecessary open ports and services, implementing dual factor authentication, limiting exposure of internal resources and increasing the segmentation of the network are just some of the things that could be done in order to close the gaps.

Cyber Security Response Plan
Previous

Free preview of the 92nd Academy Award ceremonies on websites? Beware

Next

Cyber attacks in 2020: how they will affect you and how to prevent them.

Check Also

Widget

Don’t Miss

Cyber Deal Update: Wiz, EVA Group, Bitglass, & appgate,

Van Michael

Massive expansion continues through acquisition and large-scale capital influx.  Wix raises additional $250 million four months after raising $120 million.  The EVA Group eye’s its seat as a top 3 in France.  Appgate sees $1 billion valuation while going public through NLW’s acquisition. Funding Israeli cybersecurity startup Wiz raises $250 million in latest round of funding at $6 billion valuation.  This […]

CYBER EXECUTIVE MOVES: TransUnion, Kovrr, JLL

Khushi Arora

TransUnion, Kovrr, and JLL nab new chief information security officers. TransUnion, a consumer credit reporting agency based in Chicago, has named Bill Shields as its chief information security officer. Shields joins the company from Visa. Kovrr, an Israel-based cyber risk modelling platform provider, nabbed Philippe Vuilleumier as a member of the company’s chief information security […]

Cyber Deal Update: Orca Security, Carnami, Excygent

Van Michael

Two Homomorphic Encryption outfits fight for superiority through competing rounds of funding. Orca Security closes $550 million in Series C.  Coalition purchases Attune for undisclosed sum.  One Identity acquires OneLogin. Funding Cloud security provider Orca Security closes latest Series C at $550 million.  This round led by Singapore based Temasek provides an updated valuation at $1.8 billion.  This move deepens […]

Cyber Executive Moves: SAIC, Corvus Insurance, Cloudentity

Khushi Arora

SAIC appoints a new CISO, Corvus Insurance gains a new president, and Cloudentity nabs a new chief executive officer with a cybersecurity background. Science Applications International Corporation (SAIC), headquartered in Virginia, has appointed Kevin Brown as its chief information security officer. Brown joins SAIC from medical device company Boston Scientific. Accenture has appointed Jackie Fendrock […]

Cyber Deal Update: Coalition, Akamai, Fireeye & McAfee

Van Michael

Massive growth through expansion and acquisition. SenseOn sees +350% growth. HUB Security buys market access to 40 countries.  Tesserent secures an influx of $25 million to fund yesterday’s acquisitions.  Symphony Technology Group announces plans to buy FireEye’s product business at $1.2 billion with intent to merge McAfee’s enterprise business. Funding In the industry’s mad rush for cybersecurity […]

Cyber DeaL Update: Sternum, Panorays, Ketch

Van Michael

Paris-based Exclusive Networks IPO filing. Latest funding fuels Panoryas’s expansion in the US. LG’s latest buyout drives inroads towards connected car security, while Jungle Disk acquires new product divisions to immediately realize +100% growth. F5’s acquisition of Threat Stack buys real-time threat detection. Funding Exclusive Networks, a Paris-based cybersecurity and cloud solutions provider, filed its […]