What to do (and not do) in a data breach response

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.insidecounsel.com/2014/02/19/what-to-do-and-not-do-in-a-data-breach-response

The moment that you realize an intruder has broken in to your network, your
first response might be: PANIC!  But your response should be to call your
first responders -- a response team that has been preselected by you before
a crisis hits.

Inside the company, that will usually include IT, Security, and Legal, as
well as the chief information officer, chief information security officer,
and leadership from human resources and corporate communications. But that
is only part of the team; your external partners may well include forensic
experts to analyze and respond to the breach, outside counsel, your
insurer, insurance broker and coverage counsel.

Cyber insurance is valuable protection for a company trying to protect
against the risks of a data breach or privacy incident. But in the days or
weeks of first response, it is vital that your company take the correct
steps to ensure that the coverage that has been purchased will be
available, possibly including using first responders identified by your
insurers.

Here's what you should expect in a data breach incident response:

Do not power down. Your first instinct may be to shut down your network.
But this could destroy valuable, volatile data, and the loss could hamper
the investigation. In some cases, taking the affected servers or computers
offline might be reasonable. But, if possible, this determination should be
made after consultation with the incident responders and with consideration
for the impact on business operations.

A rapid response still takes time. In the first hours and days after
discovering a data breach, you may think you see little progress. But this
is not the case. Rather, the first responders are busy collecting data. To
gain an understanding of the networking environment, they will interview
key IT and network security personnel. In an active breach in particular,
they also must gain an understanding of the business, what is considered
sensitive data, and where it resides. Beyond these in-person meetings, they
will be assessing data sources and collecting large volumes of data from
firewalls, routers and switches, the Security Incident Event Manager (SIEM)
console, and servers. It could be three or more days before a picture of
the breach and its consequences begins to emerge.

Determining the breadth of attack is an iterative process. Incident
responders will run automated search tools on sections of your network and
computers on the network looking for known signatures of intruders, called
indicators of compromise (IOCs). Once an IOC, such as a piece of malware,
is identified, they will search your larger network for other instances of
that IOC in order to determine the breadth of the breach and the
remediation plan.

Remediation time depends on the complexity of the breach. Attackers often
attempt to cover their tracks by deleting files used in the exploit or
files that log network activity. They may have created new user accounts
with deep root access. If they have been in your network for a long time,
they may have built multiple backdoors for themselves. In the most
sophisticated attacks, incident responders battle the attackers in real
time. In cases like these, a data breach may take weeks or months to fully
understand and remediate. But in the more simple scenarios, the team should
know how the intruder got in, the scope of the breach, and steps for
remediation within about a week.

While all data breaches take time to resolve, forward-thinking measures can
reduce time and cost. Investing in cyber insurance is one way to do this.
Insurance plans will often cover liability for loss or breach of data and
remediation costs to respond to the breach -- including forensic
investigation, public relations, customer notification and credit
monitoring, and coverage for costs to investigate, defend and settle fines
and penalties. Long before any data breach, you should undertake a
risk-based information security assessment that identifies and prioritizes
the greatest risks facing your organization.

Because no two organizations are identical, it's unlikely that any two
companies will effectively prepare for and respond to attack in the exact
same way. Coordinating your response team with an incident response plan
will prevent confusion and ensure efficacy. If you're prepared for an
attack, it will be quicker and easier to fight one, and your chances for a
good outcome will improve.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!