-: Incident classification.
Now when we have an incident
the first thing we want to do is classify that incident,
and we do this based on its threat and its severity.
We want to do this so that we can compare
this current incident against the past incidents
and the future incidents that we may have
at our corporation.
This is going to allow us to aid in our personnel's ability
to understand the threat, understand the severity,
and understand the incident
that they are currently working on and how we can prevent it
from happening again in the future.
When we classify our threats
we do this based on 10 different methods
of attack that was used.
So generally each incident is going to have one
or several of these threats.
It could be something like an external or removable media,
which may have been somebody dropped a
USB thumb stick in your parking lot,
somebody picked it up, plugged it into a computer
and inside of that there was malware.
So if they use remove media to get in
that's a remove media threat.
When we look at attrition
this is when somebody is doing something
like a denial of service attack
or a distributed denial of service attack
or a brute force attack against your passwords.
They're trying to break in by
using a limited key space
and get their way into the system
or denying or degrading your resources.
When we look at web this is going to be
anything that's using a web based application to get in.
So if somebody is attacking your eCommerce server
that could be a web attack.
Email is something that uses email as its penetration method
and that could be sending a malicious attachment
or some kind of a spoofed email,
and speaking of spoofing we get to impersonation.
This attack is when somebody replaces something benign
with something malicious.
So if you're doing something like spoofing,
an SQL inject, or other things like that
that would be considered impersonation.
Improper usage on the other hand
is anything that's going to violate
your acceptable use program or acceptable use policies.
So for example, if you're using a
peer to peer download program
that's against most organizations
acceptable use policies and that would be in violation
and bring a threat to your network.
You have a loss or a theft of equipment
if you lose something like a CD or a laptop
that would fall into this category
and then you have unknown.
If you don't know where else it fits
it kind of goes into this unknown bucket,
because you haven't figured out what the root threat was,
but you still know you have an incident.
Most things will start out in the unknown category
and then move into one of these other categories.
Other is when an attack comes from a known origin,
but it doesn't quite fit in any of these other
categories that we've talked about
and then the last one is a newer one called
an advanced persistent threat or APT.
We've talked about this in other classes, but in here
we're going to talk about advanced persistent threat
is that it's not a category under the NIST protocol.
So if you look in the incident handling guide
800-61 you're not going to find APT,
but it is something that's prevalent today.
These are people who are funded,
very highly funded either through nation states,
organized crime or other sources
and they have highly skilled and sophisticated attacks.
They can break into your network
and sit there dormant for three months,
six months, a year before they take advantage of you
and often they will break in using zero-day vulnerabilities
and other ways that are not easily detectable
by you and your organization.
APTs are a sever threat these days
and something you have to be looking for all of the time.
Now when we look at severity
there are several areas that we have to consider
and the first one is the scope of the impact.
This is the degree of impairment that the incident
is going to cause your organization
and the effort that's required for you to
recover from this incident.
So if it's a very large scope of impact
that means that it had a big effect on your organization
and costs you lots of time and lots of money, right.
This can have a functional impact,
an economic impact, or a recoverability impact.
Functionally is the degree of impairment
to your organization.
Economic is the amount of financial loss to the organization
and recoverability is the amount of time lost.
All of this feeds into that scope of impact.
Now when we look at this we can look at
each of them separately and individually,
and coming again from that 800-61 tables
from the special publication for NIST
you'll find that these are found.
You'll see that there's the functional impact,
which again is the degree of impairment.
It can be none, low, medium or high,
and I will tell you if you're studying for the CSA+ exam
you do not need to memorize these tables.
Just knowing the fact that there is a scope of impact
is enough for the exam,
but I want you to understand these tables
from an incident responder perspective.
There could be no effect.
Somebody can break into your network
and not do anything bad.
They could just sit there, right, that is a none effect.
Now if we have a high effect that would be something where
they have done a distributed denial of service attack
and your web servers are offline.
That has a major effect to your organization.
Now when we look at economic impact
we're talking about money here.
How much does it cost you organization?
If there was no financial loss expected it would be none.
If it's a high it might be a million dollars or more.
If it's low it might be $25,000 or less.
Now these numbers are not set in stone.
This does not come from the NIST publication.
In fact economic impact is not even covered
by the NIST publication and the reason is
NIST is a government organization
and so they don't focus on dollars and cents
like a corporation would, but in your corporation
you're going to have some level of
impact to categorize these.
Are they low, medium, high or no impact?
And those dollar values are going to depend,
because if you're in a Fortune 500 company
you might be able to afford a $100,000 loss,
but if you're in a small business that could
cripple your organization,
and so that $100,000 may only be a medium
for IBM, but it can be a catastrophic thing
for, you know, Beyond Training Solutions.
So when you look at those type of things
you have to look at what it is for your organization.
Now when we talk about recoverability
we're talking about the time lost,
how long did it take you to go from that denial of service
back to full operations.
So if we look at this this is regular,
supplemented, extended, or not recoverable.
So if it's a regular
the time to recover is predictable
and easy with your existing resources,
whether that's people or machines.
Supplemented means it took a little bit longer,
but nothing too bad, we can over come.
Extended means you're down for maybe weeks or months, right.
It's unpredictable, you don't know how long
it's going to take,
and it's a really bad thing for your organization.
Not recoverable.
This would be something that just is completely destroyed.
For instance,
where would this take place in the cyber world?
Well if somebody got into a SCADA system
and they were able to get into a pump
and they over speed the pump
and it physically destroyed the pump,
it was not recoverable.
You have to buy a whole new pump to get it back online.
That is something that would be a real threat
if you're in a factory or a manufacturing setting
not so much if you're in a IT organization,
but it is something you have to consider
and so the NIST tables do consider
recoverability impact and time
as they look across the organizations.
Now when we look at severity we also look at
the types of data that we're dealing with.
The type of data involved in the incident
effects the the classification of the severity
and when we talk about the information impact
this is the degree that the information
has been compromised during the incident.
So if we look at this from the government side
they have information impact
and they look at if from none,
privacy breach, proprietary breach,
and integrity loss.
None means there was no data that was stolen,
changed, deleted, or otherwise compromised.
Privacy breach means that the
PII or personal identifiable information
was stole, exfiltrated, changed, or modified.
Proprietary breach means somebody has stolen
unclassified proprietary information,
maybe that was building plans or something of that nature
and that information was stolen, lost, changed, or modified.
Then integrity loss is anytime sensitive
or proprietary data was changed or deleted.
Now that's on the government side.
On the private side
this one again is not in the NIST tables,
but it's one I'm giving you
is what you would do if you are on the corporate side.
You may have none, there's no information that was taken.
You have regulated information.
So if you fall in under the GLBA, Sarbanes-Oxley,
HIPPA, FERPA, or any of those other requirements
and you lose protected information
that might go under this category.
You have intellectual property breach.
Let's say my competitors stole my source code
that would be an intellectual property breach, right.
Confidentiality breach.
What if they stole confidential information,
such as our financial information
or integrity loss.
That's when they start modifying and changing those files.
Again, I've modified the information impact
from the government side to the private side
just to give you something to base it on
when you start building your incident response plans.
And that's the idea of incident classification.
You do it based on threat
and severity in each of these categories.
(electric music)