A recent study found that for organizations who have an incident response (IR) plan in place, the average cost of a breach was $1.23 million less than for organizations that didn’t have a plan in place. By planning ahead with layered defenses and an IR plan, quickly analyzing and containing breaches, and taking a coordinated approach to remediation, you allow yourself the best chance to limit the damage and get back up and running.
Attackers see opportunity during global incidents. It doesn’t matter if it’s an earthquake or tsunami, attackers can use these worldwide events to springboard their campaigns. And they’re capitalizing on the COVID-19 pandemic. According to the FBI, cyber-crime cases have increased by as much as 300% since the start of the pandemic. Prior to COVID-19, the FBI’s Internet Crime Complaint Center (IC3) received 1,000 complaints a day. Now it’s receiving between 3,000 and 4,000 per day.
When an incident occurs, every moment counts. Too often, in those crucial moments, it’s easy for companies to make mistakes if they don’t have a plan in place for identifying, containing, and remediating the threat. Here’s a look at how to approach incident response , as well as how to prevent incidents in the first place.
Three Things To Do in the Immediate Aftermath of a Cyber Attack
There are three important actions to take after learning of a potential breach:
1. Scope the Attack
One of the most common mistakes after an incident is to immediately rebuild your environment using your backups. It may seem like a quick path to recovery, but in the end, it’ll cost you more time and headaches.
If you rebuild before you know how the threat actor got into your system in the first place, you’re back at square one. The same security flaws are still available to the attacker, even after all the hours you spent rebuilding the environment. For example, if attackers get into your virtual servers and you simply rebuild them, they’ll still have access and can lock you out of your entire environment.
If you don’t fully scope the attack, you’ll have no idea how to defend against it. You need to understand: How did the attackers get into your environment? How are they exerting control? What have they already done? Are they still in your environment? Don’t fix anything until you know which vulnerabilities were exploited.
2. Craft and Execute a Remediation Plan
Now that you understand what an attacker is doing, what access they have, and how they’re moving laterally, you can craft a remediation plan that expels them from your environment and fixes your vulnerabilities.
To make sure there are no loose ends and you cut the attacker out of your environment entirely, this needs to be a coordinated effort, with all actions completed at the same time on the same date.
That could mean changing all passwords. It could mean rebuilding a server. Whatever steps you take, you must do them at the same time. By denying access all at once, you prevent the attacker from adapting and maintaining control.
With a remediation plan, all parties involved know their roles, understand their assignments, and are working on the same timeline.
3. Cleanup and Rebuild
Once you’ve closed off the attacker’s entry point and locked them out of your environment, it’s time to rebuild. This can be a time-consuming step, but since you’ve already identified and remediated your vulnerabilities, you ensure you only have to rebuild once.
Take note of any lessons learned from the incident and what you can improve, whether it’s adding new security tools, scheduling user training, or hiring for new skills you need on your team. Continue regular testing and scenario training and take steps to prevent the next attack.
How To Prepare for An Attack Before It Hits
The quicker you react and respond to an incident, the less damage your data, devices, and network will incur. Of course, it helps to take preventative measures as well. Here are some tips for getting in front of an attack before it happens:
1. Form an Incident Response Plan and Practice Scenarios
Your IR plan should outline the actions your team will take in the minutes, hours, and days following an incident. How will they confirm a suspected incident is real? What are everyone’s roles and responsibilities once you’ve identified an incident?
Practice this plan. Run different scenarios to train your employees, from common ransomware to facing multiple attackers at the same time. Update, adjust, and reevaluate your IR plan as the cybersecurity landscape evolves.
2. Install a Layered Defense
The risk of human error – employees accidentally clicking on phishing emails – is high, so you want to make sure you’re restricting an attacker’s access to the rest of your environment. That starts with a layered defense.
Limit domain administrator credentials across your entire environment. Remove local administrator privileges from users’ endpoints whenever possible. Do not allow individuals to assign local admin rights to groups of users on end-user desktops.
Make sure you have multi-factor authentication (MFA) in place on all accounts, especially executives. Keep remote desktop protocol (RDP) from being exposed to the Internet unless you’re using remote desktop gateway servers.
Keep your eye on the endpoint. Endpoint detection and response (EDR) tools provide an additional layer of security by using machine learning threat detection modules targeting fileless attacks, suspicious one-line commands, and malicious application behavior. They act as a second line of defense, alerting you in real time of potential problems and helping you address sophisticated attacks.
Don’t ignore prevention. A next-generation antivirus (NGAV) that utilizes machine learning technologies (as opposed to easily bypassed signature-based technologies) will reduce the workload on your staff and better utilize your EDR systems. By preventing the majority of attacks from happening, an NGAV frees up the security team to search for more advanced persistent threats.
3. Work with a Seasoned Partner
If you lack the resources or experience to stay on top of security, consider bringing in an experienced partner. Choose an organization that has a history of handling everything from ransomware to advanced persistent threats. It should employ individuals with diverse backgrounds, including forensics and programming, who are up to date on the current climate and understand the ins and outs of the cybersecurity landscape.
Selecting your IR partner early enables you to research and make the best decision as opposed to working with the first partner to answer the phone. Then, by placing your security in the hands of seasoned professionals, your organization can focus on what it does best while feeling confident your environment is protected.
Editor’s note: this article originally appeared on the SHI Blog.
