National Infrastructure : Classroom Essays

Chapter 11

Response

Cyber Attacks Protecting National Infrastructure, 1st ed.

• Incident response process is the most familiar component of any cyber security program

• A cyber security program will contain at least the following – Incident trigger

– Expert gathering

– Incident analysis

– Response activities

C h a p te

r 1 1 –

R e s p o n s e

Introduction

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.1 – General incident response process schema

• There are two fundamental types of triggers – Tangible, visible effects of an attack

– Early warning and indications information

• Thus, two approaches to incident response processes – Front-loaded prevention

– Back-loaded recovery

• The two approaches should be combined for comprehensive response picture

• Protecting national assets is worth suffering a high number of false positives

C h a p te

r 1 1 –

R e s p o n s e

Pre- Versus Post-Attack Response

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.2 – Comparison of front-loaded and back-loaded response processes

• Front-loaded prevention critical to national infrastructure protection

• Taxonomy of early warning process triggers – Vulnerability information

– Changes in profiled behavioral metrics

– Match on attack metric pattern

– Component anomalies

– External attack information

• Front-loaded prevention have a high sensitivity to triggers

C h a p te

r 1 1 –

R e s p o n s e

Indications and Warning

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.3 – Comparison of trigger intensity threshold for response

• Optimal incident response team includes two components – A core set of individuals

– A set of subject matter experts

• In complex settings, with multiple incidents, important for team to not work at cross-purposes

C h a p te

r 1 1 –

R e s p o n s e

Incident Response Teams

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.4 – Management of simultaneous response cases

• Response teams in a national setting must plan for multiple concurrent attacks aimed at a company or agency

• Considerations for proper planning include – Avoidance of a single point of contact individual

– Case management automation

– Organizational support for expert involvement

– 24/7 operational support

C h a p te

r 1 1 –

R e s p o n s e

Incident Response Teams

• Questions addressed in the forensic analysis process include – Root cause

– Exploits

– State

– Consequences

– Action

• Great care must be taken to protect and preserve evidence

C h a p te

r 1 1 –

R e s p o n s e

Forensic Analysis

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.5 – Generic high-level forensic process schema

• Internal expert most likely the best to lead a company investigation

• Forensic analysts need the following – Culture of relative freedom

– Access to interesting technology

– Ability to interact externally

C h a p te

r 1 1 –

R e s p o n s e

Forensic Analysis

• Should law enforcement be involved and called upon for support?

• Carefully review local, regional, and national laws regarding when law enforcement must be contacted

• Figure 11.6 outlines a decision process

C h a p te

r 1 1 –

R e s p o n s e

Law Enforcement Issues

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.6 – Decision process for law enforcement involvement in forensics

• Three Components of a Disaster Recovery Program – Preparation

– Planning

– Practice

C h a p te

r 1 1 –

R e s p o n s e

Disaster Recovery

Fig. 11.7 – Disaster recovery exercise configurations

C h a p te

r 1 1 –

R e s p o n s e

• National programs can provide centralized coordination – Intrasector coordination should be encouraged

• Currently, coordination is not the main focus of most national emergency response team programs

C h a p te

r 1 1 –

R e s p o n s e

National Response Program

C h a p te

r 1 1 –

R e s p o n s e

Fig. 11.8 – National response program coordination interfaces

Best writers. Best papers. Let professionals take care of your academic papers

National Infrastructure

Mission

Writing Servicess

More Services

Contact Us

Best writers. Best papers. Let professionals take care of your academic papers

You might also like

Mission

Writing Servicess

More Services

Contact Us