Wednesday, May 31 2023

We went through the whole CRP life cycle splitting it up into stages to better understand the steps taken in order to recover from security incidents. The apparent thing in all the steps is that someone must actually do it. The security staff in charge of the CRP life cycle process are Information Security professionals in the field of cyber security that have expert knowledge of Information Systems and are able to realize what exactly is going on when an alert triggers. Some companies have few Information security personnel and are limited in their response process. Other companies are increasingly outsourcing their cyber response capabilities to third party Security Operation Centers (SOC).

Cyber Security Response Plan

A SOC team is a centralized department that deals with all security related issues. It can be built in-house or it can be outsourced. There are some companies that choose the hybrid of these two possibilities due to monetary costs related to outsourcing most of its security operations.

An in-house SOC is an internal department in the company that deals with all security policies and procedures, tools, threats and incidents. The main people in the SOC are information Security Analysists that keep an eye on all the detection systems a company has in place. The SOC usually has a Senior Information Security Analyst and a SOC manager to make sure things are running smoothly and that junior analysts are getting the right training in order to be able to detect more sophisticated threats.

An outsourced SOC is a team of experts hired to watch over the company’s security systems and defend the company’s network from all types of attacks. This service is expensive but nonetheless, more and more companies choose this option as it reliefs them of finding the right staff to do the job and insuring the staff stay for a longer period of time. The demand for cyber security experts is very high as finding them is difficult due to the shortage in the workforce. This is an increasing problem globally and hence the salaries of cyber security experts are very high. This in turn creates a bigger overturn of security staff and companies struggle keeping them from leaving the company for a better offer.

To showcase how the entire process works, an example of an incident would do well. Imagine an employee opened a phishing email with an invoice attachment. The employee opens the attachment and triggers a virus. The virus spreads to a few computers in the office before an intrusion detection system triggers an alert. Junior Security analyst would immediately start investigating the alert to determine if it is a false positive or an actual incident. The Analyst would look for the originating hostname, inspect the process tree to determine what happened and in some cases talk to the employee that was sitting at the infected computer. If the analyst determines this is an actual attack, he or she would escalate the incident to a higher-level security analyst.

Since the incident has been identified, the staff would work together with the IT department to contain the spread of malware. Network containing all the machines and monitoring the network is usually the best options to ensure complete containment.

After examining the process tree to determine which process directly triggered the alert from the system, the security analyst can determine the root cause analysis and if needed, talk to the employee that was sitting behind the initially infected computer.

Wiping the infected machines clean and backing them up would eradicate and threat actors and recover the system for further use. In this particular example, lessons learned from the incident are that employees’ awareness of security is low and that they should undergo a Security awareness Training program.

In the past few years, it was determined that most of the cyber incidents occur from employees being tricked into opening malicious emails. Some reports estimate the number to be in the 70 % range which makes almost two thirds of all cyber-attacks. If we consider that human factor is the weakest link in any security system, we shouldn’t find the 70 % number so shocking. Malicious hackers do not want to spend months trying to exploit a certain perimeter device of a company such as a next-generation firewall, so instead just crafts a malicious email and sends it to a large number of employees in the company.

Because of this rise in phishing attacks, companies have started training their employees about the dangers of unknown emails. Almost every major company has a comprehensive Security Awareness Training program in place to decrease the number of employees that fall victim to such emails. The program usually comprises of some type of instructional videos combined with quizzes at the end to test the employee on lessons learned. The videos usually focus on red flags in the emails such as: unknown emails with emphasized urgency they have, urgent invoices that need to be paid with attachments, spoofed links in emails that lead employees to fake login pages etc.

Previous

Maze Ransomware Attack on a leading MNC

Next

Cyber Security Jobs

Check Also

Widget

Don’t Miss

Cloudburst Technologies Raises $3 million in Seed Funding

Julia Bischoff

Cloudburst Technologies, a monitoring and threat intelligence provider, announced that they raised $3 million in their seed investment round. Investments were led by Strategic Cyber Ventures with participation from Coinbase Ventures and Bloccelerate. Cloudburst Technologies specifically provides tools aimed at tracking and combating fraud in the cryptocurrency market. Investigators can do so without relying on […]

Two people collaborating over a computer by Desola Lanre-Ologun

Cyber Deals: Cloudburst, HUB Security, and Soucepass

Julia Bischoff

Cybersecurity venture funding activity and mergers and acquisitions: This week’s most sizable deals included AI powered security service providers and computing platforms. Funding Threat solutions provider for cryptocurrency Cloudburst Technologies raised $3 million in the seed funding round led by Strategic Cyber Ventures in order to help build on their current technology. HUB Security, a […]

Cyber Executive Moves: Vimeo, IntelePeer, National Cybersecurity Center, and More

Julia Bischoff

Former Tesla CISO joins Vimeo, NCC welcomes new board members, and Greenway Health hires new CISO. Video sharing platform Vimeo welcomes Mark Carter as their first chief information security officer. Carter has a variety of experience in the industry including serving as chief information security officer at Tesla.    Greenway Health, a health services software […]

NetBox Labs Raises $20 Million in Series A To Drive Open Source Transformation of Networking Industry

SecureDisruptions

NetBox Labs, an open source network management and automation startup, announced it has raised $20 million in Series A funding. Flybridge Capital is leading the investment with participation from GGV Capital, Grafana Labs CEO Raj Dutt, Mango Capital, Salesforce Ventures, Two Sigma Ventures, IBM, the Founder Collective, and Entrée Capital. As part of the round, […]

Fivecast Completes $20M Series A Raise With New US and Existing Australian Venture Investors

SecureDisruptions

US-based cybersecurity venture capital firm Ten Eleven leads funding, joining existing backers in CSIRO’s Main Sequence and South Australian Venture Capital Fund Australian open-source intelligence software company, Fivecast, has closed its Series A funding round with almost $20 million (AU$30m) raised to fuel its expansion and service contracts in key markets, including Five Eyes nations, […]

Push Security Raises $15M and Launches New Visibility and Employee-Powered Tools to Help Enterprises Scale SaaS Security

SecureDisruptions

LONDON–(BUSINESS WIRE)–Push Security, a SaaS security company, has raised $15M in Series A funding. GV (Google Ventures) led the funding with participation from Decibel and notable angels, including Dug Song, co-founder and former CEO at Duo Security, and Tray.io co-founder and CEO Rich Waldron. GV General Partner Karim Faris and Jon Oberheide, co-founder and former […]