operationalizing incident response - cdm media › kansas_city_summit_rsa...cultivate threat...

OPERATIONALIZING INCIDENT RESPONSEDeveloping Threat Detection

and Response Capabilities

If you think technology can solve your security problems,

then you don't understand the problems and you don't

understand the technology. - Bruce Schneier

You can't defend. You can't prevent. The only thing you

can do is detect and respond.- Bruce Schneier

Hacking for profit

Profit at people’s expense

Focus on people- Shane Harsch

PICTURE, IF YOU WILL…

Security Patrol Broken Window Record & Assess Report & Escalate

Police

Investigate

Brief Leadership Follow Trail Schrodinger’s

Why Not Cyber?

AGENDA

▪ Business-Driven Security Lifecycle

▪ Operational Roles of Incident Response (IR)

▪ Why Hunting Matters

▪ Content

▪ How IR Differs from Security Operations

▪ Next Steps

Shane Harsch MBA, GCIA, GCIH, GCED, CTIA, CISSP

Field CTO, RSA Risk & Cybersecurity Practice

SANS Instructor

shane.harsch@rsa.com

Certain factors decrease or increase cost of breach

• Cost is per capita per compromised record.

• Average breach cost is $141 per capita.

IR Program w/Analytics directly addresses three key factors

• Enables an Incident Response Team

• Provides comprehensive security analytics

• Mitigates the risk of notifying too quickly

• These three factors could reduce cost by $31.60 (22%)

IMPACT OF 20 FACTORS ON COST OF DATA BREACH2017 Cost of a Data Breach: Ponemon

Business Objectives

Risk Alignment

Threat Priorities

Content Intelligence

Analytics

Incident Response

Defense-in-Depth

Metrics

RSA BUSINESS-DRIVENSECURITY LIFECYCLE

Detection & Response

Measure Risk

Control Security Defense-in-Depth

Threat Intel

Packets

Endpoint Forensics

Asset Criticality

Risk Register

Vulnerability Management

Patch Management

Perimeter Defense

Endpoint Protection

Network Segmentation

Identity (auth and governance)

Processes & Procedures

OPERATIONAL ROLES OF INCIDENT RESPONSE

Threats

What threats are of concern?

What data feeds provide necessary information?

Which threat records are valid?

Content

What is the logic necessary to identify threats?

Which tools are required to identify threats?

What are the rules/parsers/alerts required?

Playbook

Validate tuned alerts

Execute standard procedures

Escalate if Playbook does not identify remediation

Hunting

90% Proactive investigations

10% Playbook escalations

Inform Threat of new findings

Incident Response

Threat

Content

Playbooks

Hunting

1. Business Defines Risks

▪ Create Risk Register with Threats and Critical Assets.

2. Threat Intel Defines Controls and Priorities

▪ Align Controls to mitigate controllable Threats.

▪ Cultivate Threat Intelligence for remaining Threat Priorities.

3. Establish IR Plan around your Threat Priorities

▪ Develop Use Cases for your Threat Priorities.

4. Operationalize Incident Handling

▪ Combine your Use Cases into Playbooks.

5. Hunt for Anomalies that exist outside your Playbooks.

6. Commit to Continuous Improvement

▪ Review incidents quarterly and critical incidents directly.

▪ Exercise playbooks through Simulation/TTX for readiness.

▪ Assess resilience to threats with Gap Analysis.

PRINCIPLES OF

THREAT DETECTION

WHY HUNTING MATTERS

DWELL TIME

Active Threat

Critical Asset

Threat Hunting

DWELL TIMEDefense-

in-Depth

Prevented?

Security

Operations

Playbook

Detected?

Incident

Response

Victim Company

Recon Server

C2 Server

Perimeter

ANATOMY OF A RANSOMWARE ATTACK

HOW DO WE EVOLVE A SOC INTO AN ASOC?

CONTENTOF DOOM

But what kind of content?

Compliance OperationsDetection &

Response

Objective

Interface

Content

WHAT DATA DO WE NEEDCONTENTBY

BUSINESSCASE

In the ransomware

example, we

needed packets

and endpoint data

to detect the

attack.

Auditing

Reporting

Device Admin

Dashboards

Alerts

Security Logs

Netflow

Threat Hunting

Event DB

Queries

Context Logs

Netflow

Packets

Endpoint

CRITICAL CONTENT: CORE ELEMENTS

Context from LogsWho, where, when, and which resources accessed.

Trajectory from NetflowNetflow maps an attack’s lateral movement in your environment.

Evidence from PacketsPackets show IoCs for delivery, c2, and patterns of activity.

Proof from EndpointsEndpoint data show IoCs for exploitation, installation, and actions.

Enterprise

Visibility

Critical: FW, DNS, DHCP, AD, Proxy, VPN

OPERATIONS AND RESPONSE

Preparation

Roles & Responsibilities

Communications Plan

IR Workflow

Detection & Analysis

Incident Classification

Use Case Methodology

▪ Incident Prioritization

▪ Response Procedures

Identify Remediation Plan

Containment, Eradication

& Recovery

Execute Remediation Plan

Evidence Handling

Execute Remediation Plan

Recovery

Post-Incident Activity

After Action Report & Lessons Learned

CIRTIncident Response

SOCSecurity Operations

IR and SOC share the effort

NIST 800-61r2 Incident Response Lifecycle

NEXT STEPS

HOW DO WE REALIZE THESE

OBJECTIVES…TOMORROW?

• Understand your key Business-drivers today

• Create a Risk Register and identify your Critical Assets

• Gather information to Prioritize Threats

• Use Business-Driven Security Lifecycle to map organization

• Review the Principles of Threat Detection and Response to

determine how you might add these capabilities today.

CONDUCT A SELF-ASSESSMENTCURRENT STATE

• Egress Filtering: deny dns except from internal DNS

• Force all internal DNS requests to your DNS servers

• Give your threat analysts the ability to add domains

• Automate Malware & c2 domain feeds

• Sinkhole malware and c2 domains to alert SOC (not CIRT)

*Research by Infoblox and BlueCat Networks

TAKE CONTROL OF DNSDNS

Around 95% of

malware families

use DNS for c2*

MALWARE & C2 DOMAIN FEEDS

• http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

• http://www.malwaredomainlist.com/hostslist/hosts.txt

• http://malc0de.com/bl/ZONES

• http://mirror1.malwaredomains.com/files/justdomains

• https://isc.sans.edu/feeds/suspiciousdomains_High.txt

• http://osint.bambenekconsulting.com/feeds/dga-feed-high.csv

And many more…

Business Objectives

Risk Alignment

Threat Priorities

Analytics

Incident Response

Defense-in-Depth

Metrics

STAFFING

Detect & Respond

Measure Risk

Control Security Defense-in-Depth

Threat Intel

Packets

Endpoint Forensics

Asset Criticality

Risk Register

Vulnerability Management

Patch Management

Perimeter Defense

Endpoint Protection

Network Segmentation

Identity (auth and governance)

Processes & Procedures

Incident Response

Security Administration

Retainer

CIRT STAFF

Threats

What threats are of concern?

What data feeds provide necessary information?

Which threat records are valid?

Content

What is the logic necessary to identify threats?

Which tools are required to identify threats?

What are the rules/parsers/alerts required?

Playbooks/Triage

Validate tuned alerts

Execute standard procedures

Escalate if Playbook does not identify remediation

Hunting

90% Proactive investigations

10% Playbook escalations

Inform Threat of new findings

Incident Response

Threat Intel

Content

Playbooks/Triage

Hunting

24x7: 6-7

8x5: 2-3 but…

Incident Response

DISRUPT THE KILL CHAINSTART HUNTING

The internet is hard

and so can you

• Hunt for common indicators

• Prioritize critical assets

• Map vulnerabilities to exploits

• Map your controls

• Understand your capabilities

• Gap Analysis and Roadmap

• Threat Intelligence Program Roadmap

• Incident Response Plan

• Tactical Playbook Development

• Incident Response Retainer

• Controlled Attack and Response Exercises

• Tabletop Exercises

WORK WITH SOMEONE WHO HAS DONE THIS BEFORE

GET HELP

Find the right combination of internal, MSSP, MDR, Retainer, and

ACD services that makes sense for you and your threat priorities.

Shane Harsch MBA, GCIA, GCIH, GCED, CISSP, CTIA

SANS Instructor

Thank You

WORKSHOP EXERCISES

S E C U R I T Y AR C H I T E C T U R E

▪ Log Analysis/Management

▪ Perimeter (FW, NIPS, Proxy, etc.)

▪ Network Monitoring (Malware, NIDS)

▪ Network Segmentation

▪ Host Monitoring (HIDS, Forensics)

▪ Host Protection (AV, Malware, HIPS)

▪ Vulnerability Scanning

▪ Patch Management

▪ Identity Management/Workflow Automation

▪ Encryption

UNDERSTAND YOUR CURRENT STATE

B U S I N E S S AL I G N M E N T & P R O C E S S E S

▪ Current IR Plan

▪ Relation to Business IR Plan

▪ Escalation Plan

▪ Incident Tracking

▪ Post-Incident Review

▪ 24x7 vs 8x5

▪ Metrics Requirements for IR

▪ Critical Asset Prioritization

▪ Alignment with eGRC

▪ Current Staffing for CIRT vs. SOC

▪ Number of Incidents per day/week

The analysis of an adversary's intent, opportunity, and capability to do harm is known as cyber threat intelligence.

- SANS

• What attacks are likely to target which critical assets?

• How might an attack succeed in your environment?

• What content contains key Indicators of Compromise (IoCs)?

• How do you analyze your content to detect these IoCs?

• How do you gather, store, handle, vet, and share threat intel?

• What sources of threat intel do you require?

• How is that intel parsed and normalized?

• How are your threat priorities integrated into controls, playbooks, and hunting?

WHAT IS THREAT INTELLIGENCE?THREAT INTEL

START WITH FIRST TWO STAGES OF IR

PREPARATION

▪Roles & Responsibilities

▪Communications Plan

▪ IR Workflow

DETECTION & ANALYSIS

▪ Incident Classification

▪Use Case Methodology− Incident Prioritization

− Response Procedures

▪ Identify Remediation PlanNIST 800-61r2 Incident Response Lifecycle

ROLES & RESPONSIBILITIES: RACI

R – Responsible: Person or role responsible for

actually doing or completing the item

A - Accountable : Person or role responsible for

ensuring that the item is completed

C – Consulted: Person or role whose subject

matter expertise is required in order to complete

the item

I – Informed: Person or role that needs to be kept

informed of the status of item completion

RACI Chart

Incident Response

Analyst

Security

Manager

End-UserHelp

Identify Potentially

Malicious Event R R C A

Malicious traffic

“Hunting”R A

Collect & Document

supporting logs R R A

Preliminary Validation R R A

Dispatch to Desktop

Support R R R A I I

Lessons learned and

reportingR R A

Analyze Network Traffic R

Analyze Malware

Sample R A

Analyze Host Machine R A

Document Investigation

Analysis I R A

Create/update L2

checklists I R A

KPI and Security

Operations Team

effectiveness

Remediation Execution I I A C R

Security Ops Team

Policy creation & reviewI C R

Define how you will communicate status and conclusion with an understanding of your

audience.

▪ Example Internal

− The IS Helpdesk currently performs end user notifications via email or phone call. The IR Team

performs as an advisory role to the IS Helpdesk team when end user notification regarding security

incidents or other security communications are required. If an incident involves a server compromise,

the IR Team may communicate with the respective team directly in order to expedite the containment

and remediation of the incident.

▪ Example External

− As determined on a case by case basis, the IR Team may work in an advisory role to the executive

team regarding external communication of security incidents. All external communications will be

performed by the team designated by the Executive Breach Response Plan during security incidents.

KEEP ALL STAKEHOLDERS INFORMED

COMMUNICATIONS PLAN

COMMUNICATIONS SECURITY PLAN

SAMPLE INTERNAL PLAN

• Non-confidential communication does not need to be encrypted.

• If confidential information is being sent internally (customer or otherwise), ensure that any attachments are encrypted and the email itself is encrypted if any confidential information is contained in the body of the email.

• Use an out-of-band form of communication to ensure that the recipient can open any attachments that were sent. Do not include any decryption keys/passwords in the body of the email, even if the email itself is encrypted. Out-of-band communications include:

• Text messages

• Voice calls

• Meeting in person

• In the event of a breach, communications should be assumed to be compromised. Internal email and internal chat communications should not be used to discuss the incident.

SAMPLE EXTERNAL PLAN

• Verify that the email address is the intended audience to receive the email.

• If an email is sent in error, immediately send an email to the unintended recipient informing them to delete the email.

• Never transmit confidential information unencrypted

• Never transmit confidential information to personal email addresses.

WORKFLOW – HIGH LEVEL

CONTAINMENT, ERADICATION, AND RECOVERY

IDENTIFY REMEDIATION PATH

▪ Document and close out incident for IR Team

WORKING WITH THE SOC

▪ Communicate to Operations Team for Remediation

− Understand and structure communications to provide information in the best format for consumption

▪ Operations Responsible/Accountable for Last Three Stages of IR

− Containment

− Eradication

− Recovery

If your hunters are working on containment, eradication, and recovery, they aren’t hunting.

FRAMEWORK FOR INCIDENT RESPONSE

Preparation

▪ Roles & Responsibilities

▪ Communications Plan

▪ Workflow

Detection & Analysis

▪ Incident Classification

▪ Use Case Methodology

▪ Incident Prioritization

▪ Identify Remediation Plan

Containment

▪ Execute Remediation Plan

▪ Evidence Handling

Eradication & Recovery

▪ Execute Remediation Plan

▪ Recovery

Post-Incident Review

▪ After Action Report & Lessons Learned

CIRTIncident Response

SOCSecurity Operations

Operationalizing the Framework is Critical

ADDITIONAL INFO

TYING IT ALL TOGETHER

RSA NETWITNESS PLATFORM

ACCELERATED THREAT

DETECTION FROM THE

ENDPOINT TO THE CLOUD

FORCE MULTIPLIER FOR SECURITY

ANALYSTS & INCIDENT RESPONDERS

A BUSINESS-DRIVEN SECURITY

APPROACH, PROVIDING BUSINESS

CONTEXT

INTELLIGENCE-DRIVEN SOC

ADVANCED CYBER DEFENSE

RAPID PROGRAM DEVELOPMENT

Cyber Gap Analysis

Incident Response Plan

Cyber Use Cases

Cyber Threat Intelligence

Roadmap

RSA IR Retainer

▪ Gap analysis with prioritized

roadmap recommendations

▪ IR Plan

▪ Incident Walkthrough Exercise

▪ Hunting Services and Retainer

▪ Review of current capabilities

▪ Roadmap of critical requirements

▪ Four levels (bronze, silver, gold, platinum)

▪ Live response capabale (with RSA NetWitness)

▪ Up to 3 hour SLA

Threat

Detection &

Response

Structured business-driven

solutions to quickly establish

strategy and operations.

Delivers business outcomes

to remediate Organizational

impact and deliver rapid

time-to-value

Customizable packaging with

tailored scope of effort

and accelerated access to

battle-tested security experts

INCIDENT RESPONSE

▪ Technology agnostic

▪ Develop Monitoring Use Cases

RSA CONTROLLED ATTACK & RESPONSE EXERCISE (CARE)

• Capture the flag exercise

• Designed with customer input

• Simulates sophisticated actor

• Based on existing toolset/technical controls

Threat

Detection

Threat

Response

• Focused on the IR process & procedures

• Bonus points for accelerated response

• Based on existing IR Plan/operational model

• Review of up to 10 process documents and artifacts

• Conduct up to 6 interviews (1 hour)

• Observation of the incident response routine

• Develop 3 attack scenarios, including “capture flags”

• Execute the 3 attack scenarios over a 2 day period

• Assess capabilities throughout the incident handling lifecycle

• Conduct a basic Knowledge Transfer for recommendations

• Deliverables

• Design Report

• Findings Report

• Executive Presentation

RSA CONTROLLED ATTACK AND RESPONSE EXERCISE

ACD SERVICES

PS-BAS-CON-CARE

5 WEEKS( 3 T R I P S I N C L U D E D )

4-hour TTX for up to 10 executive participants,

with a scenario defined by the results of RSA’s CARE.

• Assess capabilities throughout the incident response

• Identify common response difficulties and areas for process

and communication improvement

• Conduct a basic Knowledge Transfer for recommendations

• Deliverables

• Findings Report

• Executive Presentation

RSA EXECUTIVE TABLETOP FOR CAREACD SERVICES

PS-BAS-CON-ACD10

2 WEEKS( 1 T R I P I N C L U D E D )

Business Objectives

Risk Alignment

Threat Priorities

Analytics

Incident Response

Defense-in-Depth

Metrics

RSA BUSINESS-DRIVEN SECURITYSOLUTIONS

Defense-in-Depth

44RSA CYBER ANALYTICS PLATFORM

RSA PORTFOLIO

RSA RISK AND CYBERSECURITY

PRACTICE

650+ C Y B E R S E C U R I T Y E X P E R T S

A C R O S S 24 C O U N T R I E S

L A B SR S A

A D V A N C E D

C Y B E R

D E F E N S E

P R A C T I C E

D E T E C T I O N

R E S P O N S E

P R A C T I C ER S A

I N C I D E N T

R E S P O N S E

P R A C T I C E

R S A R I S K

M A N A G E M E N T

P R A C T I C E

R S A R I S K

I D E N T I T Y

A S S U R A N C E

P R A C T I C E

U N I V E R S I T Y

R S A P R O D U C T

A N D C U S T O M E R

S U P P O R T

RSA CYBERSECURITY EXPERIENCE

RAPID PROGRAM ASSESSMENT

Cyber Gap Analysis

Executive Tabletop

Cyber Use Cases

Controlled Attack and

Response Exercise (CARE)

Expert-On-Demand

▪ Gap analysis with prioritized

roadmap recommendaitons

▪ Scenario driven by CARE results

▪ 4-hour executive-focused exercise

▪ Findings Report & Recommendations

▪ Technology agnostic

▪ Develop Monitoring Use Cases

▪ Assessment of live response process

▪ Assessment of live response tools

▪ Report card across multiple eval points

▪ Duration Based offer of 10, 20, 40 & 60 Days

▪ Flexible service offerings

Threat

Detection &

Response

Structured business-driven

solutions to quickly establish

strategy and operations.

time-to-value

INCIDENT RESPONSE

NSA ACCREDITED

• One of 14 companies accredited by the NSA

−NSA Cyber Incident Response Accreditation

BENEFITS OF AN IR RETAINER - REAL-WORLD RESPONSE EFFORTS

Hour 0 – Customer Identified Potential Incident & contacted RSA IR Retainer

Hotline

Hour 1 – RSA IR familiarity w/ customer’s environment, capabilities, available

toolsets & data sources due to Retainer onboarding process. Immediate

assistance with Triage and Data Collection recommendations

Hour 3 – Preliminary Analysis completed, confirmation of targeted attack

against customer environment

Hour 16 – Ongoing analysis, 60% of Attacker Infrastructure identified

Hour 24 – Multiple RSA IR resources engaged to assist with targeted attack

Investigation

Confirmation of Incident and fully engaged within hours

*Expedited Investigative Timeline – Remediation completed within 2 weeks

Hour 0 – Customer Identified Potential Incident & contacted RSA

Incident Response via email

Hour 3 – Initial incident scoping call and discussion with RSA IR.

Contract discussion, recommendations for collection of preliminary

data analysis

Hour 24 – Customer coordinated availability of resources familiar

with environment for scoping of Endpoint & Network visibility

required for investigation. Availability of preliminary data for initial

review, inconclusive data sources

Hour 36 – Shipment of technology to support Incident Response

Effort

Hour 48 – Implementation of Instrumentation to provide necessary

Endpoint & Network visibility

Hour 72 – Multiple RSA IR resources engaged to assist with

investigation of potential incident

Retainer Customer Non-Retainer Customer

IR RETAINERS

Bronze Silver Gold PlatinumDuration 1 Year 1 Year 1 Year 1 Year

Effort Estimate (hrs.) 24 66 120 242

SLA: Initial Response 8 6 3 3

SLA: Initial Analysis 24 24 12 12

SLA: On-site Analysis 72 48 24 24

Use of unused hours N/A ✓ ✓ ✓

Deliverables Preliminary Analysis Report Preliminary Analysis Report Preliminary Analysis

Report

Preliminary Analysis Report

Incident Discovery Report

Addresses cyber security

operations challenges

time-to-value

THREAT DETECTION & RESPONSE

SERVICES PORTFOLIO

Design & ImplementationLogs & Packets Implementation | Endpoint Implementation |

Custom Log Parsers | Upgrade Planning & Execution

Custom Solution DevelopmentCustom Scripting | Custom Integrations | Custom Content |

Custom Packet Parsers | Event Source Onboarding

Ongoing Operational SupportNetWitness Residencies | Staff Augmentation |

Expert on Demand | Tuning & Optimization | Knowledge Transfer

THREAT DETECTION

& RESPONSE

Customizable service offerings

to fit unique organizational

needs and procurement models.

time-to-value

RISK MANAGEMENT

SERVICES PORTFOLIO

GRC Program StrategyRisk Management Maturity | GRC Program Strategy & Roadmap

Program Governance | Process Harmonization |

RSA Archer Suite StrategyImplementation Blueprint | Strategy & Roadmap

Optimization Assessment | Assessment Services

Hardware Sizing & Performance Health Check

Upgrade Readiness Assessment

RSA Archer Advanced Use Case Design Plan of Action & Milestone | Federal Continuous Monitoring

Federal Assessment & Authorization | Operational Risk Management

Security Incident Management | Security Operations & Breach Management

Advanced IntegrationsRSA Archer Suite API Design | RSA Ecosystem Integration

time-to-value

FRAUD AND RISK INTELLIGENCE

SERVICES PORTFOLIO

Fraud and Risk Analysis Management Program (AA)

Threat Analysis Program (WTD)Fraud Pattern Analysis| Fraud Incidence investigation | Rule Scripting

Rule Performance Optimization | Knowledge Transfer | Expert On Demand

Health check and Architecture Review

Web Threat Detection (WTD) System & Hardware Capacity Evaluation| System Performance Optimization

Resolution Design & Planning

Periodic System & Core Risk Engine Evaluation

Adaptive Authentication (AA)Deployment Review according to Best practice |

Environments Scaling | System Issues investigation |Risk Engine Performance Check

FRAUD & RISK

INTELLIGENCE

operations challenges around

Identity and Access

Management

Delivers an identity business

driven security strategy and

helps clients to identify their

risk and how to reduce it

IDENTITY ASSURANCE

SERVICES PORTFOLIOBusiness Driven Identity Journey (BDIJ)

Future State Design | Planning for an Identity Strategy

Identity Gap analysis | IAM roadmap | Identity Control Framework

Business Stakeholder meetings | Round Table sessions

IAM Strategy, Assessment & RoadmapRSA G&L specific | Business Driven Review of current deployment

Future state planning | Governance / Lifecycle roadmap

Use Case Development | IAM Plan Development

Identity Assurance Strategy, Assessment & RoadmapRSA SecurID specific | Business Driven Review of current deployment

Future state planning | SecurID roadmap

Use Case Development | Identity Assurance Plan Development

Security Readiness and StrategyCurrent State & Gap Analysis | Maturity Modeling

Various Roadmap Development

THANK YOU

Shane Harsch MBA, GCIA, GCIH, GCED, CTIA, CISSP

SANS Instructor

operationalizing incident response - cdm media › kansas_city_summit_rsa...cultivate threat...

Documents

operationalizing vmware nsx€¦ · operationalizing vmware...

operationalizing and measuring agility

operationalizing the three principles of advanced threat...

policing terrorism: a threat to community policing or just a...

19th iccrts operationalizing c2 agility · operationalizing...

sharing threat intelligence & playbooks speaker... ·...

operationalizing machine learning

operationalizing mongodb at aol

operationalizing innovation

operationalizing c2 agility

operationalizing threat intelligence · operationalizing...

structuring, enabling, operationalizing

operationalizing social media

operationalizing threat intelligence to battle persistent...

operationalizing the analytics enterprise

threat intelligence gateway - bandura cyber ·...

operationalizing your strategic plan

operationalizing jv 2010

17th iccrts operationalizing c2 agility -...

operationalizing analytics to drive value - ey - united...