The Luck Factor In Incident Response

When malware passes through the perimeter and internal network controls, it’s going to land on something. That something is most often some sort of endpoint whether a server or user machine. 

Malware that lands on an endpoint as a result of a broad blind attack, the attacker most likely won’t know what machine it’s on, what privileges it has, or where it can easily laterally move. For some destructive attacks, this isn’t important but for many attackers, establishing basic information is.

The Gift Of Post Data Breach Optics

As cyber professionals, our job is to think about preventing breaches. We have controls that have put in place. We measure the efficacy of those controls. And we have a backlog of work that remains to be done. 

 

During an incident, we work to respond to the incident. If that incident rises to the level of a data breach, we work within the context of an enterprise crisis action team to contain every aspect of that breach, technical and non-technical.

But how often do you think about what happens post-breach after the exhausted response team has gone home?  By this, I mean the regulators. Depending on your industry and location, you'll likely have state and/or federal regulators knocking on your door.

Never Waste A Good Cyber Emergency

It has finally happened. Some sort of cyber emergency. In your organization. Perhaps an emergency happening right now to someone that is reading this post.

The wise security practitioner will have already prepared their executive team for the eventuality of a large incident that pushes the limits of the team to contain.  No matter the level of your cyber maturity, you’ve been doing all of the right things.  Educating execs about your program. Clearly articulating your focus areas and gaps. Training the team. Your program is chugging forward. And then the emergency occurs.

It happens every day. All of us are due to have a really bad day at some point.  

The Seven Incident Response Leadership Sins

 All incident response is not good incident response.  

The quality of a response to a cyber security incident is determined by the team's leader.  That might be you or someone that reports to you directly or indirectly. 

I've compiled a list of seven incident response leadership sins to help guide and evaluate whoever that is.