Incident Response - 7 Tips on what you could do when you have an Incident

Here, the author refers to the Buffer site hack but, offers a few tips on incident response


According to the article:- 

For most incidents, the initial response should be some flavor of the following steps:

1. Understand, as quickly as possible, that you have an incident, and communicate this to internal and external shareholders. Obviously the decision about exactly who are the stakeholders is highly variable, depending on an incredibly long list of considerations – I wouldn't recommend everyone go public – in many cases that is exactly what not to do. But if the cat is out of the bag (that is, say, if a half-million of your customers are now advertising diet pills in their social media timelines), this decision may have been made for you.
2. Understand, as quickly as possible, the initial scope of the incident (much of what you learn and assume in these early hours will be wrong, but you should work hard to get the most complete sense of what is happening and what systems are affected — you'll be coming back to this step repeatedly).
3. Once you have a scope, devise a plan to, in this order, stop the bleeding, secure what you have, and re-assess the scope and breadth of the incident.
4. Develop an understanding of your available resources as mapped to the plan you've just made, determine the Deltas between what you have and what you need. This requires a brutally honest self-assessment, and almost certainly must be something you've considered in advance; you can develop this awareness after the fact, but you're increasing exponentially the cost of the incident response — put another way, every dollar you spend doing this work in advance is worth $5 when the defecation hits the ventilation.
5. Work with partners to fill the gaps between what you have and what you need. Rapidly.
6. Repeat the last four steps until you feel you have positive control.
7. Continue to communicate what you know, when you know it, to appropriate and appropriately growing groups of stakeholders. Don't make promises you can't keep or statements not based on fact, but don't shut up until you have facts if stakeholders are visibly or audibly nervous. "We have had a security incident that we understand has affected ____________, and with our staff and partners we are working quickly to determine the extent of the damage and we will report back regularly with progress," is much better than not saying anything and allowing speculation to fester.

The link below has more information:-

http://www.csoonline.com/article/2134108/emergency-preparedness/incident-response-matters.html

Disaster Recovery Preparedness - In a disastrous state.

3 in 4 companies at risk, failing to prepare for Disaster Recovery

According to the article:- 

(When Disaster Strikes)

• More than one-third (36%)of organizations lost one or more critical applications, VMs, or critical data files for hours at a time over the past year, while nearly one in five companies have lost one or more critical applications over a period of days. 
• Even more alarming, one in four respondents said that they had lost most or all of a datacenter for hours or even days!
• Reported losses from outages ranged from a few thousand dollars to millions of dollars with nearly 20% indicating losses of more than $50,000 to over $5 million

(How about the plan)

• More than 60% of those who took the survey do not have a fully documented DR plan and another 40% admitted 
• The DR plan they currently have did not prove very useful when it was called on to respond to their worst disaster recovery event or scenario
• When companies do test their DR plans, the results are most disturbing. More than 65% do not pass their own tests!

Full Report here:

http://drbenchmark.org/wp-content/uploads/2014/02/ANNUAL_REPORT-DRPBenchmark_Survey_Results_2014_report.pdf

Incident Response - 5 Useful Tips

Organizations spend money on Prevention and Detection but most fail in IR.

So, IR has always been one of my favorite topics.

According to the article:- 

TIPS:

1. Know your target data
2. Document plans for various scenarios
3. Establish a base of operations
4. Nominate a single point of contact
5. Update and maintain

Incident response is something that is developed and something that changes with the organization over time.

"So they spend all this time, and all this training, and all this education that they've got, and all the money that they invested in parameter defense, and even internal defenses, but they didn't spend a dime on incident response.

Incident response tends to be, in most cases, an ad-hoc thing that's put together as needed; it's almost like a volunteer fire department. The only difference is that the volunteer fire department is properly trained, they have the right processes, [and] they have the right tools."

Unless plans were developed and tested beforehand, then these common problems show themselves at the worst possible time; during an actual incident.

"What IT gets right is that they know their infrastructure. They know where their data of value is, they know ingress points [and] they know egress points. It's their network, they understand how it works. What they get wrong is they don't use the working knowledge that they have of the network to understand how and incident would occur," 

One of the often repeated problems with incident response is that organizations rarely understand those who are attacking them, what the attacker is looking for, and how they are trying to get it.

Knowing all the routes and access points to the critical data is a must, so that when something happens you can accurately flag the incident and deal with it appropriately.

No matter how good the plan is, it never survives its first real test. Make sure there is an after action report made, and that any mistakes, problems, or failures are learned from. Adjust plans and policies as needed

The link below has more information:-

http://www.csoonline.com/article/2133834/business-continuity/understanding-incident-response-5-tips-to-make-ir-work-for-you.html

20 Famous Hacks - Vendors and some are in security business

Since, yesterday's hack is old news today , our Brain seem to forget those that happened day-before yesterday.

This slideshow should remind us that

1. Security vendors don't "Walk the walk"
2. Our information stored by (any) vendors are always at risk.

So, let's be cautious and store less data and keep them encrypted (don't lose the keys)

Slideshow Link:

http://www.csoonline.com/article/2130206/malware-cybercrime/144786-20-infamous-hacker-security-vendor-break-ins.html

Free Software - to Address top 4 critical controls and Prevent 85% of cyber-attacks

It is called "Qualys Top 4"

Try it because:

1. Free
2. Nothing to Install on your systems

According to the article:- 

Qualys Top 4 is a free tool that builds on the popular QualysGuard Cloud Platform, and enables customers to scan their environments to determine whether or not Windows PCs have effectively implemented the top four security controls:  

1. Application Whitelisting—only allowing approved software to run
2. Application Patching—keeping applications, plug-ins and other software up to date
3. OS Patching—keeping operating systems current with the latest fixes
4. Minimizing Administrative Privileges—preventing malicious software from making silent changes

The link below has more information:-

http://www.csoonline.com/article/2137149/network-security/avoid-85-percent-of-cyber-attacks-with-free-tool-from-qualys.html

Would you believe this - NSS Labs claims IE better than other browsers in Malware detection

Fact is stranger than fiction

According to the article:- 

Microsoft's combination of application reputation technology and URL filtering gave Internet Explorer a malware block rate that blew pass Google Chrome, Mozilla Firefox and Apple Safari.

The latest tests from NSS Labs showed IE with a 99.9 percent block rate for what the security tester calls socially engineered malware (SEM). Chrome had a rate of 70.7 percent while Firefox and Safari hovered around 4 percent.

Microsoft and Google use a combination of application reputation technology and URL filtering in detecting malware. The difference is Microsoft relies more on URL filtering, while Google does the opposite

NSS Labs also tested three leading browsers from China. The Liebao Browser, developed by anti-virus vendor Kingsoft, came in second behind IE with a block rate of 85.1 percent.

Liebao surpassing Chrome is unexpected because most browser makers have turned toward application reputation, also called content-agnostic malware protection (CAMP), because it is believed to be the most effective.

The link below has more information:-

http://www.csoonline.com/article/2138463/data-protection/ie-easily-beats-chrome-firefox-safari-in-malware-detection.html#tk.rss_applicationsecurity

eBay ProStore vulnerability related to credit card took more than a month to fix.

Is that the fastest turn around time?

Particularly when this flaw is detected by an outsider.

According to the article:- 

Mark Litchfield, an infosec pro at Securatary, told us he discovered a flaw in eBay-owned ProStores that not only opened the door to store account hijackers, but also leaked "full access to all their customers PII [Personally identifiable information] as well as their full credit information in clear text."

"Like the gostorego vulnerability (also eBay), we could shop for free by giving ourselves store credit or gift cards or created our own orders for free," Litchfield told The Reg.

Securatary said it had reported the problem to eBay on 11 February but it was only fixed on 20 March. 

The link below has more information:-

http://www.theregister.co.uk/2014/04/01/ebay_stores_vuln/