-: Incident containment.
So at this point, we have figured out there's a problem
we've taken an image of the drive
and we're doing analysis for the forensic piece of it.
Okay, let's move on beyond that.
Now let's go back to our incident response.
In our incident response, we have to contain the incident
and want to do this as quickly as possible.
We have to isolate the issue.
We have to stop the spread of this incident.
Think about it this way.
If you got really sick and you've gotten the flu,
should you go to work?
No, you should stay home because if you go to work
you can spread that sickness to everybody else at work.
Instead if you stay home, you quarantine yourself,
you contain that incident.
You go through the issues, you clean up the mess,
you get yourself fixed up
and then go back to work when you're done.
It's the same thing here in the cyber world.
If we get a computer that gets an infection,
do you wanna let it stay talking to the rest of the network?
Well probably not, but here's where the trick comes in.
You have some containment considerations
and some of those things are that containment is not perfect
it's not pretty, it's quick, it's dirty.
If we get an incident that says,
"Hey, your fileserver is infected."
Do I immediately cut it off line?
Well maybe or maybe not.
We have to make an educated guess
and based on our risk analysis
of what that business loss of functionality is
versus the risk of putting the rest the business to
because let's say I took that fileserver offline,
it's gonna be offline for a month.
Would all business operations stop?
Well if so, you may wanna just leave that fileserver on
even though it's infected.
These are the choices you have to make.
You have to decide when is the right time
to take it offline and when is containment the right answer.
You have to do that by coordinating with your stakeholders
and the stakeholders in this case
are gonna be either the C suite level management
or the other director heads.
Because if you're in IT security,
you're not necessarily the focus of the business.
You're there to provide functionality
to the rest of the business.
Let's say I was a store where I made clothing.
I'm a clothing store.
If I'm selling clothing, the cyber security part of it
is not the main business driver,
it's a support to the business.
And so I need to make the decision of
well it's black Friday, should I take down
all of the cash register systems
and shut the business off of the next week
when we clean up the mess?
Probably not, this is the most profitable time of year.
Let's hold off until after January first,
then we can take it offline for a month, right?
And so you'll make that risk decision
based on profits, business impact and functionality.
Those are some of the containment considerations
because it's not just the cyber answer.
Now, one of the ways you can get containment
is what's called segmentation.
And this is kinda how you can work through the problem.
So in the case I just gave of the retail store,
you can't shut down for Christmas,
you can't shut down until New Year's,
we've got to slow the infection.
How do we do that?
Well, we do segmentation.
This is a proactive strategy, this can prevent the spread
from one part of the network to another.
So in the case of this sample network
I have three subnetworks
based off of switch one, two and three.
And the router in the center's acting as a firewall.
And so this router will actually prevent switch one
and the two computers there from talking to switch two
and the two computers over there,
or down to switch three and the simple machines down there.
So therefore if the student machine off of switch one
on the far left of the graph gets infected
it can only infect the other machine in its subnet
which is student colleague,
based on the rules we set up in our router.
This is how we can do segmentation,
it will end up so that only piece of the network get broken
and that will limit the spread and the functionality
of the malware or the bad things that could be happening.
Now the second thing we can look at is isolation
and removal of bad parts.
So in the case of student,
again we use that as our infected machine,
I can just remove it directly from the network completely
and if I remove it from the network,
that is gonna disconnect the PC,
it's gonna disconnect the attacker
and it's gonna stop the spread of the attack.
But I lose all the business functionality
that that machine was giving me.
If it's just one person workstation, it's not a big deal.
If it's one of our big servers, it may be a big deal.
The second thing we can do is we can look at isolation.
And isolation is not necessarily the same as removable.
As removal we took the machine offline
and turned it off completely,
with isolation we'll actually pull it out of the network
but still give it a direct route out to the Internet.
And so it can still function on the Internet
and still do it's performed job
whether that was processing credit cards
or managing orders or whatever it was,
but it's not gonna be able to talk
to the rest of our internal network anymore.
It isolates it from the internal network.
Now in my business and where I work at,
I have never done a direct isolation.
Never had a reason to do it.
For us, we'll either do segmentation or removal.
But isolation is an option
that if you're taking the CSA plus exam
you do have to consider.
Now, what is your objective in containment?
Well your whole objective in containment
is to limit the damage to the organization.
So you do this through risk analysis
of is it worse to take it offline
or is it worse to leave it on
where the spread can continue to happen?
You need to provide incident handlers
an opportunity to collect the evidence
and repair the issue that they need
but you also don't wanna give the attacker
more time to do more damage.
And so this is all a trade-off of speed versus precision.
You wanna maintain and operate your services
for your customers to use
but you also don't want the bad guy to keep attacking you
and doing bad things.
So as you go through, there's no right or wrong answer
it's hard choices that you have to make
with the stakeholders as you decide
what's the way to go forward.
And the last thing I wanna talk about
in this particular lesson is identifying the attackers.
Should you identify the attacker?
Do you need to identify the attacker?
Well, that depends on your business.
Let's go back to the retail store.
I'm running a clothing store.
I had gotten attacked.
What is my big concern?
Is it finding out who did it?
Well no.
I don't care who did it, I just want it to stop.
I wanna stop the bleeding, I wanna stop the attack.
So all I really care about is stopping the attack.
Because here's the thing,
it can take a long long time to identify the person
and lots of resources.
The attackers cover their tracks well and identifying them
can take so much time and so much money.
And you as a business care about that?
Well, probably not.
Your goal is to get back online
and minimize business impact.
But if you are law-enforcement,
they have a different view.
They're not in the business of making money.
They're in the business of catching bad guys.
And so if you bring law-enforcement in,
they may care about digging in deep
and finding out who actually attacked you
so they can put those people in jail.
Now do you as a business care about that?
Maybe or maybe not.
Again this is a risk analysis business analysis decision.
Talk with management, figure out what you wanna do.
Is this something where you're required
to bring in law-enforcement
or do you just wanna handle it internally?
Some things will be automatically
escalated to law-enforcement,
other things you can handle internally
and just get cleaned up, deal of the incident
and move on with your company's life.