Your Incident Response Plan
Another layer of defence in depth is being prepared when intruders strike. "The IT model for dealing with a disruption is to get that server back online as fast as possible," says Boni. But before that happens, he adds, ask yourself how important the contents of the system are, whether intruders saw any critical data and whether the attack might be meant to distract you from the real target.
Boni does a first-level analysis. If triage determines that the incident could have a high impact, or if it appears deliberate, it may warrant a more significant response than the vast majority of intrusions that can be addressed through analysis of log files and systems profiling (for instance, he may call law enforcement, and secure affected systems and servers for evidence). "Prudent incident response means planning ahead," says Yoran of NetWitness. "People need to know how to receive and interpret various clues and deduce [what] may have occurred or may be occurring."
Communication is also critical. "Incident response is still very siloed and technology focused," says Khalid Kark, a senior analyst with Forrester Research. For serious breaches, Boni brings in a cross-functional team that includes, among others, crisis managers, internal auditors, lawyers and HR to assess the incident and determine who needs to be involved in the response. Yoran suggests interacting with public relations advisers, user communities and vendors, where necessary.
When the problem is global, the challenge escalates. "It may require interface with the local or regional staff, [which], given language, time zones and differences in operating practices, may be more difficult to coordinate, even inside an organization," says Boni. "Establishing working relationships with federal law enforcement ahead of time also helps," says Yoran. "They regularly work these issues with foreign parties."
When it's time to pick up the pieces, Alan Paller, research director with the SANS Institute, pushes for root-cause analysis to determine which exploits the hacker used and what can be learned from that. That's what Bailey, the government contractor, did once he discovered his problem. After contacting law enforcement, making a full disclosure to affected customers and partners, and completing a forensic analysis, he moved to cover the holes in his data protection strategy. These included better procedures for installing patches. He also recruited a manager of information security, expanded her department and set up a computer incident response team. Among its activities, the team lurks on hacker boards to keep up with the latest exploits and conducts intrusion detection exercises.
Today, most important, Bailey fully appreciates the risks. That's the key for CIOs who must manage the growing threat to corporate knowledge, says Borg: "Simply appreciat[ing] the stakes.
"There's some very sophisticated hacking taking place — some of it state-sponsored-and they're going after IP," says Bailey. "We can never be 100 percent secure, but we've redoubled our efforts. It taught us a big lesson."