5 Critical Steps to Handling a Security Breach
-
Upload
seculert -
Category
Technology
-
view
1.481 -
download
6
Transcript of 5 Critical Steps to Handling a Security Breach
© 2013 Seculert, All Rights Reserved
Network Compromised?
Critical Steps to Handling
a Security Breach
Which systems, services,
and devices have been compromised?
Example: Corporate
email, online customer
login page, shared
drives, etc.
© 2013 Seculert, All Rights Reserved
Does it stem from
a host on your
network,
or is it coming
from outside your
perimeter?
© 2013 Seculert, All Rights Reserved
Gather information about the command &
control servers that were
used in the attack.
Example: IP addresses,
domain names, etc.
i i
i i
© 2013 Seculert, All Rights Reserved
Determine the
nature of
the attack
Is it targeted specifically for
your company?
Your industry? At a product
or service you use?
© 2013 Seculert, All Rights Reserved
What was/is the
agenda of
the attack? etc.
Economic social
Political
© 2013 Seculert, All Rights Reserved
Prevent spreading
the attack to others and causing further
damage.
Isolate
compromised
endpoints and
assets.
© 2013 Seculert, All Rights Reserved
Can you take
your network offline?
Are you serious? That would hurt business.
ON
OFF
© 2013 Seculert, All Rights Reserved
Quarantine only the infected
servers, computers, and
devices.
Tip: In quarantine they can be examined, remedied, and brought back online.
© 2013 Seculert, All Rights Reserved
Compare pre-infection
and post-infection backups.
Start with the most
critical systems first.
010011101001011
010100001011011
101001001010100
111010010110101
000010110111110
010010101001110
100101101010000
101101101101
010011101001011
010100001011011
101001001010100
111010010110101
000010110111110
010010101001110
100101101010000
101101101101
© 2013 Seculert, All Rights Reserved
A network breach is
a considered crime - try not to destroy valuable evidence.
Tip: Make safe, stable copies of any illegal content and store on an isolated system- prevents accidental re-infection.
© 2013 Seculert, All Rights Reserved
Consult with your
corporate legal counsel.
Ensure that you have the most
up-to-date and accurate advice.
© 2013 Seculert, All Rights Reserved
Legally, you may need to
disclose the attack.
If not publicly,
than at least to those
potentially affected.
Example: customers,
partners or other
stakeholders.
© 2013 Seculert, All Rights Reserved
Decide if sharing
information at this point
is a necessary public
relations move.
There are professionals who specialize in the
field of network security breaches. Example: PR communication professionals and lawyers
© 2013 Seculert, All Rights Reserved
Before putting any server, computer,
or device back online
Check
and double check
and triple check
© 2013 Seculert, All Rights Reserved
All compromised or potentially compromised
passwords should be changed.
Tip: New passwords should incorporate
best practices for strength and security.
© 2013 Seculert, All Rights Reserved
Check for
configuration errors.
Download and install the
latest security patches.
Update network
hardware security settings.
© 2013 Seculert, All Rights Reserved
Don’t forget the
human factor.
Educate all employees on how to play an
active role in maintaining network security.
© 2013 Seculert, All Rights Reserved
Network Compromised?
Contact us here:
www.seculert.com/contact-us
Find out how Seculert
can help.
© 2013 Seculert, All Rights Reserved