Wednesday, March 29 2023

Fundamentals of every CRP is the CRP life cycle. It is a series of stages that occur with steps needed to be taken in order to make sure every aspect of the cyber incident has been examined and documented. The tricky part comes in where companies need to assess their working nature and determine what aspects of the company are most valuable in order to create the most productive CRP. If you can predict where your company is most likely to be hit, you have more chances of defending against these types of attacks along with customizing a CRP to best suit the company’s environment. Following are the defined series of steps/stages that should be included in every CRP for cyber security:

1. Preparation is the first important stage in the process of responding to a cyber incident. Common sense tells you that there must be some sort of a security system in place in order to be able to identify an incident. In other words, a structure where adequate security staff, security mechanisms/tools and knowledge of the company’s resources is vital for any kind of successful response.

2. The first stage directly connects with the second stage which is identification. Having an adequate setup is paramount to the ability to identify that an incident has occurred. This is usually where alerts from intrusion detection systems come up, web filtering gateways detect a suspicious external connection, SIEM solutions connect the dots of an attacker passing through the internal network or an endpoint solution alerting of a phishing email opened. No matter the case, quick reaction from qualified security staff is needed in order to escalate and respond to the alerts.

3. Containment is the third stage of the CRP life cycle. In order to stop further spreading of malware and damage to the network and data theft, containment of the threat actors is what is needed in order to focus on the next stage of the incident response. A good example in practice would be a complete network containment of the infected machine which means cutting all internet and intranet connections of the machine.

4. Eradication is one of the more complex stages in the incident process as it involves forensic analysis in order to determine the extent of presence of the threat actor. Security staff need to make sure that what they do in the eradication stage eliminates all presence and access of the threat actor to the system. This includes, re-imaging of machines, searching for backdoors, and most importantly, determining the root cause analysis if the incident. Depending on the root cause, eradication stage can be simplified by knowing the vector of attack that took place.

5. Recovery stage comes right after eradication. In this stage, getting the infected systems up and running again is important to decrease any potential monetary loss associated with the downtime of the infected system. In some cases, a single computer infected with a virus is not going to bring down the company, but an office with 100 employees whose computers fell victim to ransomware is a whole other story. In the later case, quick action from the security team will determine how big the loss of revenue will be.

As previously stated, lessons learned is one of the most important stages for a simple fact that it will showcase to everybody how the incident occurred and how to effectively close the attack vector that got exploited. Closing unnecessary open ports and services, implementing dual factor authentication, limiting exposure of internal resources and increasing the segmentation of the network are just some of the things that could be done in order to close the gaps.

Cyber Security Response Plan
Previous

Free preview of the 92nd Academy Award ceremonies on websites? Beware

Next

Cyber attacks in 2020: how they will affect you and how to prevent them.

Check Also

Widget

Don’t Miss

Cyber Executive Moves: Netizen, Kroll, Coalfire

Julia Bischoff

Netizen hires Joe Carr as director of cybersecurity, and Krebs Stamos Group names new chief information security officer. Netizen, a veteran-owned cybersecurity solutions provider, named Joe Carr as director of cybersecurity. Carr held many different positions before Netizen, including overseeing acquisition programs for the United States military.  Krebs Stamos Group, a technology risk insights provider, […]

Cyber Deals: Opscura, Acceldata, and Sensiguard Acquisition

Austin Boland-Ferguson

Cybersecurity venture funding activity and mergers and acquisitions: This week’s most sizable deals included emergency and healthcare security service providers. Funding Industrial control system (ICS) cybersecurity provider Opscura Inc. received $9.4 million in Series A funding, which will help the Spain-based company with US expansion. Tenable’s corporate venture capital arm led a $7 million seed […]

Cyber Executive Moves: Appgate, Trellix, Rubrik

Julia Bischoff

Appgate appoints a new CEO, Trellix hires loanDepot’s CISO, SANS Institute taps new CISO director. Secure access solutions provider Appgate appointed Leo Taddeo as chief executive officer and president. Taddeo stepped into the new role after serving as Appgate’s chief information security officer since February of 2022. The SANS Institute, a cybersecurity training company, appointed […]

Cyber Deals: Drata, Field Effect investments, and Veracode acquisition

Julia Bischoff

Cybersecurity venture funding and merger activity: This week’s largest deals were MDR and security automation investments, as MSP consolidation continues to attract corporate buyers. Funding Cork, Ireland-based, data encryption company Valutree acquired $12.8 million in their series A funding round, led by investors Molten Ventures and Ten Eleven Ventures. Funds will be used to expand […]

Cyber Deals: Spin Technology, CyberArk, Mesh Security

James Hu

Cybersecurity Venture Funding and Mergers: This week’s deals involved cloud security services, data privacy, and industrial cybersecurity companies. Funding Cloud cybersecurity firm Mesh Security has secured $4.5 million in venture funding. The round was led by Booster Ventures with participation from other investors. Spin Technology, a firm providing SaaS security solutions, raised $16 million in […]

Cyber Deals: Cybrary, Ping Identity, Axio Global

James Hu

Cybersecurity Venture Funding and Mergers: Key investments were made in cybersecurity training, secure enterprise browser, and risk management companies. M&A activity this week involved identity security, zero trust, and threat intelligence firms. Funding Cybrary, a cybersecurity training platform, raised $25 million in a Series C funding round. The round was led by BuildGroup and Gula […]