FORESEC Academy
FORESEC Academy Security Essentials (II)
INCIDENT HANDLING
FOUNDATIONS
FORESEC Academy
Agenda
 What is incident handling?
 Why is it important?
 What is an incident?
 Fundamentals
 The Six Step process
 Legal issues
FORESEC Academy
Incident Handling
 Incident Handling is an action plan for
dealing with intrusions, cyber-theft, denial of
service, malicious code, fire, floods, and other
security-related events
 Having procedures and policy in place so you
know what to do when an incident occurs
FORESEC Academy
Why is it Important?
 Sooner or later an incident is going to
occur. Do you know what to do?
 It is not a matter of “if” but “when”
 Planning is everything
 Similar to backups
-You might not use it every day, but if a
major problem occurs you are going to be
glad that you did
FORESEC Academy
Legal Aspects of Incident
Handling
 Plans, policies and procedures developed for
incident handling must comply with
applicable laws.
 This is not a legal course, have them reviewed
by legal counsel.
FORESEC Academy
What is an Incident?
 An “incident” is an adverse event in an
information system, and/or network, or the
threat of the occurrence of such an event.
 Incident implies harm, or the attempt to do
harm
- Incident handler reduces or minimizes harm
 The fact that an incident has occurred may
mean a law has been broken
FORESEC Academy
Types of Incidents











Bombings, Explosions
Earthquakes, Fires, Floods
Power outages, Storms
Hardware/software failures
Strikes, Employees unavailable
Hazard material spills
Cyber-theft, Intellectual property theft
Viruses, worms or other malicious software
Unauthorized use
Intrusions, Internal or external attack
Denial of Service.
FORESEC Academy
What is an Event?
 An “event” is any observable occurrence in a
system and/or network
 Examples of events include:
- the system boot sequence
- a system crash
- packet flooding within a network
 These observable events compose an incident
 All incidents are composed of events, but not all
events are incidents
FORESEC Academy
Examples of an Incident
 Which of the following is an incident:
1. An attacker running NetBIOS scans against
a Unix system.
2. An attacker exploiting Sendmail on a Unix
system.
3. A backup tape containing sensitive
information is missing.
FORESEC Academy
Overview of the
Incident Handling Process
Incident Handling is similar to first aid. The
caregiver tends to be under pressure and
mistakes can be very costly. A simple, wellunderstood approach is best. Keep the six
stages, (preparation, detection, containment,
eradication, recovery, and follow-up) in mind.
Use pre-designed forms, and call on
others for help.
FORESEC Academy
Incident Handling - 6 Steps
 Preparation
 Identification
 Containment
 Eradication
 Recovery
 Lessons Learned
FORESEC Academy
Preparation
 Planning is everything
 Policy
- Organizational approach
- Inter-organization
 Obtain management support
 Select team members
 Identify contacts in other organizations
(legal, law enforcement)
FORESEC Academy
Preparation (2)
 Update disaster recovery plan
 Compensate team members
 Provide checklists and procedures
 Have emergency communications plan
 Escrow passwords and encryption keys
 Provide training
 Have a jump bag with everything you
need to handle an incident
FORESEC Academy
Identification
 How do you identify an incident
 Be willing to alert early but do not jump
to a conclusion
- “Boy that cried wolf” syndrome
- Look at all of the facts
 Notify correct people
 Utilize help desk to track trouble tickets to
track the problem
FORESEC Academy
Signs of an Incident
 IDS tool has an alert
 Unexplained entries in a log file
 Failed events, such as logon
 Unexplained events (new accounts)
 System reboots
 Poor performance
FORESEC Academy
Identification (2)
 Assign a primary handler
 Determine whether an event is an
incident
 Identify possible witnesses and
evidence
 Make a clean backup of the system
FORESEC Academy
Containment
 An incident handler should not make




things worse, liability and negligence
Secure the area
Make a backup
Possibly pull the system off the network
Change passwords
FORESEC Academy
Eradication
 Must fix problem before putting it
back online
 Determine cause and symptom
 Improve defenses
 Perform vulnerability analysis
FORESEC Academy
Recovery
 Make sure you do not restore
compromised code
 Validate the system
 Decide when to restore operations
 Monitor the systems