-: The incident response team.
So when we create the incident response team,
we have to think about who we want to put onto this team.
And members can either be
permanent members or temporary members.
The core team is gonna consist of
cybersecurity professions whose full job it is
to conduct incident response.
They have a lot of experience in this,
and that experience is gonna help your team
become more efficient and well-trained.
Temporary members of the team, though,
are brought in for specific situations.
For example, if I respond to an incident response
as part of the CSIRT or as the manager of the CSIRT team,
and I find that this
attack vector was something like a SQL inject,
I may want to go and bring some expertise in
from a Database Administrator,
and make them part of my team temporarily.
That's the idea here when we have those temporary members.
They bring something specific
to this particular situation.
Now, smaller organizations,
they will have a CSIRT team as well,
but they may not have them full-time.
So instead of it being a full-time
incident response team on standby,
it may be some of your System Administrators,
some of your Database Administrators
and other people throughout your organization
who are kind of tapped on the shoulder
when an incident comes up,
and they are part-time members of this CSIRT.
They're still permanent members,
but we don't have enough work for them
to do this full-time.
So they have this as a collateral duty
or an additional role
in addition to their normal job functions.
Now, what does management do for the CSIRT?
Well, management has an active role
inside an incident response,
as well as in dealing with the CSIRT team.
They have to ensure that the team
has adequate funding, resources, personnel
and experience to conduct their incident response.
And they have to make those critical business decisions.
So if I'm in the middle of doing an incident response,
and I go "Hey, we found the issue,
"it's this e-commerce server over here
"and we need to take it offline,"
well, as the Incident Response Lead,
I don't make that decision.
I need to go back to management
and let them make that key critical decision of
do we allow this infected host or server to stay online
and stop business functions if I take it offline?
Those are the decisions that have to be made by management.
They're also going to be the ones who communicate with legal
and the news media to figure out
what are we gonna talk about
in terms of our incident, because guess what?
The newspapers are gonna wanna know
about the incident that you're having,
especially if you're a big brand name company.
And then their job also is to
talk with the key stakeholders.
This can be the C-Suite,
such as the CIO, the CSO and the CEO,
or it can be stockholders,
or other managers throughout the organization.
Again,
by having management there,
they can take care of some of that burden
so that the incident response team
can focus on what they need to do,
which is recovering from the incident.
So, who is on the CSIRT team?
Well, we've already talked about the fact
that there's a leader.
This is a skilled Incident Responder.
For instance, I've led up CSIRT teams in the past.
We also are going to bring in subject matter experts.
These are people who are knowledgeable in a particular area.
So if I'm dealing with a Linux intrusion,
I wanna make sure I bring Red Hat administrators
and Linux administrators into the discussion.
If I'm dealing with databases,
I want a MySQL person or a Microsoft SQL person.
If I am dealing with Windows servers,
I need to have system administrators.
Those are the experts that I wanna bring in
and integrate into my team.
I also have IT support staff,
because a lot of the things that we do in an incident
is maneuvering our network
by shutting down servers,
replacing servers, restoring from backups,
cleaning up after an incident,
and that requires IT support staff.
We're also gonna have legal counsel.
Now, the legal counsel may not be
embedded on the team full-time,
but they are somebody that we can talk to.
If you're a large enough organization,
you'll have lawyers on staff.
If not, again, the manager's role
is to get legal counsel involved,
so they would get an attorney on retainer
to advise us on what legally we can and cannot do
as we move forward.
We also wanna make sure we have human resource staff.
And this is one that we can use some of the time,
but not necessarily all of the time.
If we're dealing with an incident
that had to do with an insider or an employee,
we then would have to have human resources involved
to make sure that we're following the right regulations
to collect the information
and fire that employee if needed.
We also, the last one we want,
is public relations and marketing staff,
because, again as I said last time,
the media is going to be involved most likely,
especially if you're a big company.
If you're a Target, a Home Depot, a Walmart,
that's gonna make the news.
And so how are we gonna convey this message
to the public through the news media?
That's where public relations and marketing
is gonna help us out
as part of this incident response.
Now, can you outsource the CSIRT team
or do you have to have it in house?
Because all of these people,
this is a lot of money you're spending
for something that may happen in the future
and probably will.
Well, there is a lot of third-party companies out there
that will offer incident response services.
You can retain a third-party,
and that will give you instant capability
without the daily resourcing requirements.
I don't have to have these people on the payroll every day,
I just pay for it when I need it.
So that's good, but that way is also very expensive.
For example,
Microsoft has the Microsoft Incident Response Team, or MIRT.
But they are a very expensive team,
but they're very good at what they do.
So if your large company has an issue,
you can call up Microsoft,
they will deploy a team of experts in
to help you recover from an incident.
You need to ensure that your organization is comfortable
with the third-party's guaranteed response time
because they're not there.
If I'm calling Microsoft,
they might have to fly in from Washington,
whereas I might be in New York.
And that's a six hour flight
once you even give them the phone call.
And that's time that the incident is ongoing.
Those are some of the things you have to weigh
when you decide "am I gonna do this inside my house,
"or am I gonna outsource this
"to another third party?"
And then the other thing you have to worry about is
agreeing on the scope of work to be performed.
What is it that the outsourced contractor
is gonna do for you,
and what do you have to do yourself?
It may be the analysis work that you outsource,
but the actual remediation actions,
taking servers offline, rebuilding servers,
would be done by your own IT staff.
And those lines have to be defined
when you start writing these contracts
when you start deciding to outsource your CSIRT.
What is the scope of control for a CSIRT?
There's a lot of questions you have to ask
when you're running into an incident.
The first one is,
what is gonna trigger the activation of a CSIRT?
If we get one phishing email
are we gonna call off an incident response?
Well, if nobody clicked the link,
it doesn't really matter.
We just delete the email and move on.
Those are the kind of questions you have to ask.
What is the minimum to trigger off the activation?
Who's allowed to call off the activation?
Can your first line help desk employee do it,
or do you need management approval?
Because again, once you light off an incident response
and you start calling in the CSIRT,
things start getting expensive
because you're bringing all those man hours
against this problem.
Do they respond to all parts of the incident
and all parts of the organization,
or just specific ones?
You might have a CSIRT that only focuses on
your e-commerce side of your business,
and they wouldn't touch your internal networks.
That may be the way you do it.
Or you have one team that covers everything.
Again, these are things that your organization
is gonna have to define.
Can your CSIRT talk to law enforcement?
Or, can they talk to the media?
Again, you may want everything to go through your lawyer,
you may want everything to go through public relations,
or you may want the CSIRT lead talking to the media.
Again, that's a choice that your company
is going to have to make.
Generally, they're gonna say
they don't want the CSIRT team talking to legal
or to the media.
They want somebody who is the face of the brand
like the CEO to come out and make those conversations.
But again, it's something that you guys have to decide
in your organization.
And then how would the CSIRT escalate an issue?
So let's say I went in to look at an e-commerce server,
a database server that we thought was attacked,
and I find out that not only was that server attacked,
but 10 other servers were attacked.
How do I get more support and more resources
and escalate this further?
Do I just go back to the CEO or the CIO or the CSO?
Well, maybe.
It all depends on how you want to set up
your incident response plan.
And so again, these are questions you should ask yourself
as you're drafting an incident response plan.
Now, we have this team put together.
We've gotten all the experts in.
How do we keep their skills sharp?
Well, you test them.
We have to make sure that our incident response plans
have been tested
to make sure that they're gonna be effective.
Because if it just sits on the shelf
and nobody ever uses it,
it's not gonna be effective.
You have to ensure that your teams are trained
and ready for an incident response,
and the best way to do that
is by going through walkthroughs
and going through your policies, your procedures
and your playbooks,
or taking it a step further and actually doing
penetration tests on you using Red Teams
and having your incident responders called away
to find those Red Teams and respond to them.
If you combine them with the penetration test,
this is very effective
and can simulate a real attack,
and it really gives your teams
a lot of practice,
and gets them sharp and ready to go
for the real thing when it does occur.