Update on Cyber Security - newyorkfed.org · 5/20/2015 · Questions & Answers . Internal FR. 24 ....
Transcript of Update on Cyber Security - newyorkfed.org · 5/20/2015 · Questions & Answers . Internal FR. 24 ....
May 20, 2015
Update on Cyber Security ORMIA Specialized Course
Yow Lian Tay and Robert Tracey Jr
Agenda 1. Introduction to Cyber Security 2. Cyber Security resources 3. Anatomy of a data breach 4. Cyber Security incident response 5. Why audit the Cyber Security incident response plan? 6. Items to look for during the audit 7. Question & Answer
Inte
rnal
FR
2 Ask yourself:
What topics do I need to pay attention to?
Incidents can occur in countless ways, so it is infeasible to develop step-by-step instructions for handling every incident. This presentation is intended to provide focus areas for your consideration.
What is Cyber Security?
Inte
rnal
FR
3
VS
Protection from Unauthorized Modification
Protection from Unauthorized Access
Protection from Disruptions in Access
Cyber Security – Present Day
Inte
rnal
FR
4
Advanced Persistent Threat (APT) • Threats in the past were one-off ‘hackers’, ‘spammers’, and ‘script kiddies’. • Now: Advanced Persistent Threat (APT): • State-sponsored cyber espionage and sabotage • Organized Crime / For Profit Groups • Anonymous / Hacktivists
Situational Awareness • Risk Assessments can never be static – as threats are increasingly more dynamic. • Understanding of the environment is critical to adequate risk identification.
Skills Gap • Information Security professionals are in increasingly high demand. • Threat actors devote exorbitant time and resources to carrying out attacks – this
requires an equal and opposite defense response that cannot be accomplished by automated tools alone.
Emerging Risks
Inte
rnal
FR
5
• Internetworked hardware with standard and non-
standard operating systems. • Includes sensitive devices such as security cameras,
environmental system controllers, and certain medical devices.
• Requires specialized (vendor) knowledge to maintain security.
Internet of Things
• Crimeware is malware specifically used to
acquire confidential information including bank accounts and passwords.
• Ransomware is malware that locks down a user’s machine and demands a payment for unlocking it.
• Doxxing is a practice of obtaining and disseminating PII on individuals through internet research
Crimeware, Ransomware & Doxxing
Emerging Risks
Inte
rnal
FR
6
• Malware that dumps data stored in memory. • Such data is normally unencrypted. • Common threat for POS systems and ATMs as
sensitive payment card information is utilized
RAM Scraping
• Insider threat is the risk of employees and
contractors to the security of information through inadvertent and intentional means.
• Third party threat is the risk of vendors and contractors interfacing with the internal network and potentially compromising information security.
Insider and Third Party Threat
Cyber Security Resources
Inte
rnal
FR
7
ISACA Cybersecurity Nexus (CSX) • Thought leadership, training, and certification. • http://www.isaca.org/cyber/pages/default.aspx
Verizon Data Breach Investigations Report • Overall trends and emerging risks. • http://www.verizonenterprise.com/DBIR/2015/
SANS – Critical Security Controls • 20 critical controls for the most common attacks • https://www.sans.org/critical-security-controls/
NIST – Cybersecurity Framework • Detailed standards for Cybersecurity Programs • http://www.nist.gov/cyberframework/
Anatomy of a Data Breach
Inte
rnal
FR
8
• Disclaimer: This scenario is purely fictional. Any similarity to actual events
is merely coincidental. • Despite being fiction, this hypothetical example is based on actual risks in
the environment that cyber security teams must be prepared for. • Hackers from a well-funded criminal organization compromise a third party
vendor to a major banking institution…
Scenario - Background
An Opportunity Appears…
Anatomy of a Data Breach
Inte
rnal
FR
9
• Because the bank has a devoted protestor following (like all big banks), it
isn’t hard to induce hacktivists to launch a significant DDoS attack. • It was also trivial for the criminal organization to obtain names of employees
of the bank from LinkedIn and set up a spear-phishing scam.
Setting up a Distraction
Anatomy of a Data Breach
Inte
rnal
FR
10
• While it takes several hours, the Incident Response Team blocks the DDoS
attackers and brings back up the public website. • They also deal with many angry employees that unfortunately fell for the
phishing emails and need to change all of their passwords.
Incident Response
The Incident Response Team
1. Resolve public website outage to satisfy customers
2. Remediate effects of the spear-phishing scam.
Anatomy of a Data Breach
Inte
rnal
FR
11
• The Intranet Customer Page was never fully secured because it was believed
to be generally safe from external attacks. • Using vulnerabilities in the programming language and the use of a
privileged database connection within the scripts, the hackers successfully compressed and exfiltrated the customer database.
Successful Exfiltration…
Scenario Recap
Inte
rnal
FR
12
Attacks are not always in isolation. • A sophisticated attacker uses multiple channels of attack. • DDoS Attacks and Phishing are easy to perform but hard to resist.
Logging Everything is Insufficient • Trained technicians need to review and remediate logs timely • Security logs should never be purged – data storage is cheap.
Internally-Facing Applications are still a Security Risk • Just because it isn’t public facing doesn’t mean it can’t be broken
into. Controls should apply to all systems with sensitive data.
Third Party / Outsourced Service Providers • Accounts and interfaces to third parties should face high scrutiny. • Many recent breaches were through third-party channels.
Anatomy of a Data Breach
Inte
rnal
FR
13
• While it takes several hours, the Incident Response Team blocks the DDoS
attackers and brings back up the public website. • They also deal with many angry employees that unfortunately fell for the
phishing emails and need to change all of their passwords.
Incident Response
The Incident Response Team
1. Resolve public website outage to satisfy customers
2. Remediate effects of the spear-phishing scam.
Incident Response
Inte
rnal
FR
14
Ask yourself: • Did your IR team obtain management
support & buy-in? • Are roles & responsibilities defined in
the IR plan? Success Metrics? • What about communication?
• Don’t over communicate! • Has there been a validation of the IR
plan? • Don’t just plan it, practice it!
What is an Incident Response Team (IRT)? • A selected and well-trained group of people whose purpose is to promptly and
correctly handle an incident so that it can be quickly contained, investigated, and recovered.
• They must be people that can drop what they’re doing (or re-delegate their duties) and have the authority to make decisions and take actions.
Incident Response Plan • Identifies the organizational approach to
handling security incidents • Brings needed resources together in an
organized manner to deal with an adverse event
• Aides investigations, preservation of evidence, and determination of how it occurred and how to mitigate against recurrence
• Is adaptable and flexible • Speeds response and recovery efforts
Typical Cyber Security Incident Response
Inte
rnal
FR
15
NIST SP 800-61r2 - COMPUTER SECURITY INCIDENT HANDLING GUIDE
Ask yourself: Does your IR plan cover these
phases?
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Why audit the Cyber Security Incident Response?
In conducting the audit, the auditor should be seeking answers to the following four questions: 1. Has the organization adequately assessed its cyber security incident
response needs? 2. Has the organization's cyber security incident response program been
designed to meet those needs? 3. As the organization changes and evolves, is the effectiveness of the
cyber security incident response plan maintained? 4. In the aftermath of a critical incident, will the cyber security incident
response plan work as intended? Benefits to the organization: • Ensures that the plan contains accurate and current information • Allows the incident response process to be assessed and fine-tuned • Identifies potential issues in advance; before the breach occurs • Should a breach subsequently occur, it allows the process to operate
more efficiently
Inte
rnal
FR
16 Ask yourself: How supportive is Bank’s
Management of such an audit? Critical Security Control #18: Incident Response and Management
Items to look for during the audit
Inte
rnal
FR
17
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Items to look for during the audit
Inte
rnal
FR
18
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Preparation 1. Verify creation of an incident response policy and plan 2. Were procedures for performing incident handling and reporting
developed? 3. Has guidelines for communicating with outside parties regarding incidents
been established? 4. Was a team structure and staffing model selected? 5. Has relationships and lines of communication between the incident
response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies) developed?
Items to look for during the audit
Inte
rnal
FR
19
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Detection and Analysis 1.Determine the detection and analysis capabilities. Does it consider:
• Attack vectors, signs & sources of an incident (precursor vs. indicator) • Correlation of information & events (Security Incident & Event Management
(SIEM) tools) • Profiling Networks and Systems to understanding Normal Behaviors • Employ additional tools to collect additional data
2. Determine if mechanisms/channels to document the incident. • Status, summary, related incidents, actions taken, chain of custody, impact
assessments, next steps, etc. 3. Incident prioritization & severity - functional, informational & recoverability 4. Timely and sufficient notification
Items to look for during the audit
Inte
rnal
FR
20
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Preparation Detection
& Analysis
Communication & Coordination
Containment and Recovery 1. Are there procedures to acquire, preserve, secure, and document evidence? 2. Verify if there are steps to contain & eradicate the incident. Was there consideration for:
• Identifying and mitigating all vulnerabilities that were exploited. • Removing malware, inappropriate materials, and other components. • Isolating components to avoid spread.
3. Has steps been established to recover from the incident? 4. Is there confirmation that the affected systems are functioning normally upon recovery? 5. Is there a need to implement additional monitoring to look for future related activity?
Items to look for during the audit
Inte
rnal
FR
21
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Post-Incident Activity 1.For high severity incidents, was there a follow-up report? 2. Was a lessons learned meeting held? 3. Rehearsing (table-top testing) and awareness 4. Evidence retention – considerations for prosecution
Items to look for during the audit
Inte
rnal
FR
22
Preparation Post
Incident Activity
Containment, Eradication
& Recovery
Detection &
Analysis
Communication & Coordination
Communication & Coordination 1. Is there an established communication channel? 2. Has a communication frequency been defined? 3. Have responsibilities been defined? 4. Have the relevant internal stakeholders been identified for
notifications? 5. Does your organization share information with outside parties?
(Internet Service Provider, Law Enforcement Agencies, Software & Support Vendors, media)
Effective Practices
Inte
rnal
FR
23
1. Acquire tools and resources that may be of value during incident handling. 2. Subscribe to threat intelligence services (free & paid). 3. Establish mechanisms for internal and external parties to report incidents. 4. Require a baseline level of logging and auditing on all systems, and a higher baseline level on all
critical systems. 5. Profile networks and systems to understand the normal behaviors of networks, systems, and
applications. 6. Consult with the legal department before initiating any coordination efforts. 7. Perform incident information sharing throughout the incident response life cycle. 8. Attempt to automate as much of the information sharing process as possible. 9. Balance the benefits of information sharing with the drawbacks of sharing sensitive information 10.Prioritize handling of the incidents based on the relevant factors. 11.Include provisions regarding incident reporting in the organization’s incident response policy. 12.Obtain system snapshots through full forensic disk images, not file system backups. 13.Start recording all information as soon as the team suspects that an incident has occurred. 14.Share as much of the appropriate incident information as possible with other organizations. 15.Safeguard incident data. 16.Follow established procedures for evidence gathering and handling. 17.Create a log retention policy. 18.Maintain and use a knowledge base of information. 19.Hold lessons learned meetings after major incidents. 20.Plan incident coordination with external parties.
Ask yourself: Are we doing any
of these?
Questions & Answers
Inte
rnal
FR
24
Additional Resources: • NIST National Checklist Program (NCP) • NIST Special Publications 800-61 Rev 2 – Computer Security Incident Handling
Guide • Center for Internet Security (CIS) Best Practices • COBIT= Deliver & Support DS8 Manage Service Desk and Incidents • ITIL = Service Operation 4.1.5 • ISO 27002 = 13.0 Information Security Incident Management, 14.0 Business
Continuity Management • NIST SP 800-61 = Incident Response guide
Consider what you’ve
learned & share it.