-: Communication and information sharing.
So we talk about communication
and information sharing,
we're really trying to figure out how are
we going to share information
and communicate it during an incident.
Now there's two different ways that
we have to do this.
There's internal sharing and external sharing.
When we talk about internal sharing
of communications we have to understand how is
the team itself gonna communicate
between each other.
So if I'm on site and I need to reach back
to my home station, my headquarters
how am I gonna send that information?
Am I gonna do it by email?
Am I gonna do it by text?
Am I gonna do it by phone call?
These are the questions that
we have to understand
and our incident response plan should cover those
We also have to understand how is
it management gonna communicate
to other employees?
So for example lets say our corporation had
a loss of P-I-I data
or personal identifiable information.
Management is gonna wanna inform that
to its employees.
Are they gonna do that by sending
out a blanket email
or are they gonna call together a meeting
and start telling people individually?
These are the types of information we have
to understand how we're gonna communicate
as we move through the instant response.
Now when we start talking about instant response
and we talk about internal communications we have
to understand that your plan is gonna dictate how
you're gonna do that so it should
be thought out ahead of time
not during the incident.
We should also use what's called
out-of-band communication.
Now what is an out-of-band communication?
Well if your network where your email server is
has been compromised and somebody's attacked it,
you probably don't want to send an email out
to all your employees because then
the attacker can see it as well.
So you wanna use something that's out-of-band.
If your VoIP system has been compromised
you don't wanna use phones
and so I have a picture here on the screen
of a guy with a briefcase running down the hall
and we used to call that a runner
and this is actually an effective way
to have an out-of-band communication.
We can print off the reports,
we can hand them to somebody
and they can run it
down the hallway to management.
But again we don't really use that
too often these days.
Now we'll just find a third way of doing it
and something that's out-of-band.
So we'll either use voice if
the data's been compromised
or the old fashioned way of having somebody run
down the hall and tell somebody what's going on.
Those are all effective methods
of internal communication
but they won't work so well externally.
So when we talk about external communication,
we're asking how are we gonna communicate
with the outside world.
We're gonna talk about people like
law enforcement, media, the shareholder.
How are you gonna get the information to them
about your data breach
and what information are you gonna give them?
You're not gonna give them the packet captures
and the data analysis and the logs that
you're using in the internal side
but you will give
them information like press releases.
You'll give them statements
for their shareholders.
You'll give them conversations
with law enforcement and interviews.
And your instant response plan is gonna state
when and how much information you can give
to the outside world.
Now when we talk about external communication
there's lots of people we have
to communicate with.
The first one is law enforcement.
If we're dealing with an issue that has
a criminal aspect to it like
somebody who has hacked into your govern
into your servers that is
something you're gonna have to deal
with law enforcement on.
And before you talk to the law enforcement
you wanna talk to your company's attorney first.
You have to have information sharing partners
so if I was if I as corporation A was tied in
with corporation B with our networks
and I was hacked as corporation A
I need to tell corporation B that
they may have been hacked too.
And so what indications do I wanna share
with them so they could start looking
on their networks, right? Vendors.
The vendor can provide us patches
and support during an incident
but we have to communicate with them.
So if I'm using Microsoft system,
I may wanna contact Microsoft support
or Microsoft Instant Response Team.
There's other organizations that are effective
because when we have been affected there may
be evidence that others were affected.
So as I'm going through my analysis
and I start looking at it
and I see data ex filtration
and I start seeing that some
of the commands they were using
were also targeting not just my company
but maybe my friend's down the street,
I wanna be able give them the information as well
And then media or general public.
And in this case this may be mandatory depending
on what type of incident you have
and what type of information has been stolen
but it may not.
And if it's not are you gonna
volunteer the information?
Or are you gonna just give
what is minimally required by the law?
Now there are new laws that have
been coming in place that have
to do with data breaches
and they're trying to become more transparent
and trying to require people
to start telling customers
when a data breach has occurred.
But those laws have not been
finalized yet as of this recording.
So make sure you're staying up to date
on what is currently required
and what is required
per your incident response plan