A data breach itself is the second worst possible event which can occur in an organization; the mismanagement of the communication about the response is the worst.” This observation comes from Exabeam chief security strategist Steve Moore, who has tracked criminal and nation-state adversaries and led the largest healthcare breach response in history. Moore added that the time spent on a breach, including audit, regulatory and litigation support can last not months but years.A data breach itself is the second worst possible event which can occur in an organization; the mismanagement of the communication about the response is the worst.” This observation comes from Exabeam chief security strategist Steve Moore, who has tracked criminal and nation-state adversaries and led the largest healthcare breach response in history. Moore added that the time spent on a breach, including audit, regulatory and litigation support can last not months but years.
1. Freeze everything
Take affected devices offline but do not shut them down or make any changes just yet. The goal here is to stop any ongoing activity by limiting communication to and from the impacted systems but not commit any action which might erase clues, contaminate evidence or otherwise inadvertently aid the attacker.
In the case of virtual machines or other systems you can snapshot, I recommend doing so now so that you will have a recorded version of the system at the time the breach was occurring. You can analyze the snapshot later in an offline state.
2. Ensure auditing and logging is ongoing
Ensuring that existing system auditing remains intact and has been operational will be one of the most useful steps you can take to determine the scope of the breach and devise remediation methods. If auditing has been disabled (to cover someone’s trail for instance), restore it before proceeding; it will also assist in establishing whether breach activity is ongoing and when the breach can be safely determined to have concluded.
3. Change passwords or lock credentials
Changing passwords or locking credentials is a common tactic in preparing to investigate a data breach since it will help ensure the cessation of said breach if it is ongoing, and data breaches commonly rely on compromised passwords and credentials. Make sure to apply this step to all involved accounts, whether confirmed or suspected.
4. Determine the impact
Now the investigation starts. Figure out what happened here; what information was accessed, what systems were compromised, and which accounts may have been utilized. You’ll need the logs referenced in the prior step, as well as the tools discussed in step number two. Determine and establish the scope of the breach to formulate how to solve it.
5. Determine how it happened
It’s not enough to remediate a data breach based on impact alone; you have to determine root cause or you may simply be slapping a temporary band-aid on the situation. Did someone erroneously give out their password? Was a system not patched for a particular vulnerability? Did someone plug an unauthorized laptop into the company network which then subjected the organization to malware? Or did an employee simply leave their unencrypted mobile device in a taxi cab and was then subjected to blackmail?
Moore advised: “One thing that often gets missed: if your organization is being targeted it’s not uncommon for multiple adversary groups to attack without awareness of one another. This could include attacking directly, via supply chain, partners, subsidiaries, or contracted help.”
6. Determine what needs to be done
Now comes the step where you build out your remedy to seal the hull of the ship from the iceberg damage, so to speak. Establish whether you need to remotely wipe a stolen mobile device, update software, change network firewall rules, segregate subnets, run antimalware scans, increase logging and alerting or some other technical steps, get these planned out. Then enact them immediately.
7. Communicate the details to the appropriate internal personnel
It’s not just technical steps you need to worry about. There’s also the communication and notification process. Who do have to involve to let them know the breach occurred, how it occurred, what details were involved, and what has to be done? You may need to talk to legal, PR, the HR department, customer service or some other stakeholding group which needs to be involved in the post-breach cleanup.
8. Make public announcements and prepare for responses
This is never going to be the most fun of these steps, but quite likely it will be up to someone to make a public announcement, perhaps in the form of a press conference, series of emails, social media announcements, website announcements or any other form of communication which exists between the company and the outside world.
Make sure to describe what the organization has done to remedy the breach, what it intends to do in the future, and what (if any) steps customers should take to protect themselves, such as by changing passwords, contacting credit card companies or placing fraud alerts.
If possible, establish a hotline or name a specific group/contact information to address customer concerns regarding this breach so they can answer questions and provide guidance.
After the breach
There are a couple of things you must do to engage in reinforcement after the dust has begun to settle, if you want to ensure you won’t find yourself back in the same place.
Identify areas for improvement
Every data breach occurs through some sort of gap – a gap in training, awareness, security measures, technological capabilities or some other point of entry. Figure out where the gaps occurred so you can fill them in, likely with increased education and heightened compliance requirements, then apply these as needed.
Work on preventing the next breach
Focus on efforts to help reduce the risk of a re-occurrence. Improve patching mechanisms if exploited vulnerabilities were the source of the breach. Mandate encryption if company information was stolen from a micro-SD card in an Android tablet. Utilize improved authentication methods (2-factor authentication is highly recommend) where required. Consider other elements which can help your company’s chances in the future and apply them as necessary.
For more information on solutions for running your businesses’ technology more efficiently, visit our website or contact Megan Meisner at mmeisner@launchpadonline.com or 813 448-7100 x210.
This was originally posted by Scott Matteson for TechRepublic.
