Albany Bank Corporation
Security Incident Management Program
2
CONSULTANTS
• Taurus Allen
• Destiny Dyer
• Marta Pelyo
• Daniel Post
• Michele Reina
• Robert Warshauer
3
PROJECT OBJECTIVES
1. Create an effective security incident management program
2. Compliance with regulatory and industry standards
3. Identifying potential vendors
4. Implementation of roadmap
4
AGENDA
• Project Approach
• Bank Profile
• Purpose of Security Incident Management Program
• Industry Regulations and Standards
• Explanation of Proposed Program
• Workflow
• Vendor Recommendations
• Roadmap
5
PROJECT APPROACH
Objective: To assist ABC with creating and recommending a
security incident management program.
Phase 1
Phase 2
Phase 3
Planning and
Content Research
Content
Development and
Recommendations
Final Presentation
and Preparation
Research of Current Events, Weekly Status Report, Project Timeline, Peer Evaluations
6
BANK PROFILE
Overview:
• 20th largest bank in the United States
• Specializes in commercial, retail, investment banking
• Holds $50 billion of assets
Problems Facing Albany Bank Corporation:
• Well known hacking group breached security records
• Approximately 20 million customer records compromised
• ABC did not have formal incident security program in place
• Reputational and financial losses
7
RECENT BREACHES
These breaches occurred due to lack of:
• Adequate cyber security
• Detailed incident response procedures
• Efficient detection/analysis and containment strategies
8
SECURITY INCIDENT MANAGEMENT OBJECTIVE
• Process of monitoring and detecting threats
to a network
• Encompasses integrating IT management
systems
• Identifies and prioritizes incidents based on
business impact
• Used to protect confidential data
NIST Cybersecurity Framework
9
INDUSTRY REGULATIONS: FFIEC
Purpose: To develop and ensure uniformity of report forms, standards,
and principles for financial institutions
Incident Management Requirements:
• Periodic risk assessments
•
Layered security controls
•
Member awareness and education
•
Ad-Hoc activity monitoring
•
Defined escalation protocols
10
INDUSTRY STANDARDS: ISO 27001-27002
Purpose: To provide a model for Information Security Management System
Incident Management Requirements:
• Management of information security risks
• Develop criteria for accepting risks and identifying level of risks
• Identify and evaluate options for treatment of risks
• Implement training and awareness programs
11
INDUSTRY STANDARDS: NIST 800-61 REV 2
Purpose: Computer Security Incident Handling Guide
Incident Management Requirements:
• Procedure for performing incident handling and communication
• Incorporation of response teams in incident handling process
• Reduce frequency of incidents
12
INCIDENT RESPONSE LIFECYCLE
Steps:
• Preparation
• Detection
• Analysis/Classification
• Containment
• Eradication/Recovery
• Post-Incident Activity
13
INCIDENT RESPONSE LIFECYCLE: PREPARATION
Checklist to ensure that all pivotal functions and procedures of incident response
program are being performed
14
INCIDENT RESPONSE LIFECYCLE: PREPARATION
• Establish escalation procedures and response teams
• Improve educational awareness
• Training sessions
• Document procedure checklist
• Implement a playbook system
• Install malware protection software
• Create a simulated attack program to test response teams
15
INCIDENT RESPONSE LIFECYCLE: DETECTION
• C03 automated system
• Report incident: Ticketing System
•
Open Ticket Here
• Triage Incident
• Significance of the constituency
• Experience of the incident reporter
• Severity of the incident
16
INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION
Impact: Measures the effect of an
incident on the company
Financial Ranges
Users
Critical
Loss of more
than $5 Million
Affects 76%-100%
High
Loss between
$3 – 5 Million
Affects 51%-75%
Medium
Loss between
$1 – 3 Million
Affects 25%-50%
Low
Loss of less than
$1 Million
Affects 0-24%
17
INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION
Core Business Operations
Urgency: Measures the effect an
incident has on the core business
functions
Critical
Interferes with core business functions
or loss of critical data
High
Interferes with non-core activities or
functions that do not affect the entire
company
Medium
Interferes with normal completion of
work or tasks that are more difficult
but not impossible to complete
Low
Interferes with non-business related
use
18
INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION
Response and Resolution Time for Incidents:
Incident Priority
Timeframe
Critical
Action within 1 hour
Resolution within 1 day
High
Action within 2 hours
Resolution within 2 days
Medium
Action within 1 day
Resolution within 5 days
Low
Action within 2 days
Resolution within 7 days
19
INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION
Incident Classification Matrix
Impact
Matrix Key
Critical
Red
High
Black
Medium
Gray
Low
White
20
INCIDENT RESPONSE WORKFLOW
21
22
INCIDENT RESPONSE LIFECYCLE: DETECTION/ANALYSIS
Detection / Analysis Checklist:
23
INCIDENT RESPONSE LIFECYCLE: CONTAINMENT
•
Sandbox method: Threat quarantined, assessed and monitored
•
Freeze assets threatened
•
Suspend network services
•
Protect the chain of custody
24
INCIDENT RESPONSE LIFECYCLE: ERADICATION/RECOVERY
Checklist
What information is
recoverable
•
Restore systems
Change passwords
•
Tighten network
•
What information is
permanently lost
•
Replace compromised
files
•
Timeline of recovery
•
Install patches
•
25
INCIDENT RESPONSE LIFECYCLE: ERADICATION/RECOVERY
Eradication/Recovery Checklist:
26
INCIDENT RESPONSE LIFECYCLE: POST-INCIDENT
Perpetual loop of improvement:
• Improve technology
• Follow up report
• Lessons learned meeting
• Trend analysis team
• Communicate incidents to affected users
Post-Incident Checklist
27
IDENTIFYING POTENTIAL VENDORS
Vendor Checklist
28
IDENTIFYING POTENTIAL VENDORS
29
IDENTIFYING POTENTIAL VENDORS
Major Solutions Offered:
•
•
•
Ticketing system
Compliance of Security Incident Response Cycle
Risk assessment
•
•
•
Auditing
Employee training
Single user sign on
•
•
•
Workflow
Matrix
Automatic response system
•
•
•
Advanced layered security
Risk management
Compliance
30
SECURITY MANAGEMENT PROGRAM: ROADMAP
• 0-3 Months
• Preparation
Step II
• 3-6 Months
• Implementation
Step I
• 6-18 Months
• Finalization
Step III
31
PHASE ONE: 0-3 MONTHS
•
•
•
•
•
•
Research of regulation and standards
Finalize business function requirements
Implement response teams: red, black, gray, and white
Perform vendor selection
Effective escalation process (via use of teams)
Manual management for short term security incident response
program
32
PHASE TWO: 3-6 MONTHS
•
•
•
•
•
•
Implement the selected vendor tools
Implement the workflow
Implement the tool for manual
Define and document incident response plans
Implement incident management and ticketing system
Continuous management of any security incident
33
PHASE THREE: 6-18 MONTHS
• Perform security response testing/training
• Initiate a communication plan for security incident management program for
internal/external stakeholders
• Meets legal and regulatory tandards
• Employee education and training
• Customer awareness
• Vendor training: Roles and responsibilities
• Trend analysis capability
34
MEASURE OF SUCCESS
• How fast was incident contained?
• How quickly did Albany Bank Corporation recover from the incident?
• How well did Albany Bank Corporation mitigate their losses?
• How effective was Albany Bank Corporation’s communication of incident?
35
NEXT STEP RECOMMENDATIONS
•
Initiate Incident Response Program
•
Quarterly assessment of risks
•
Annual testing of response teams and procedures
We guarantee to help
“Chase Risk Away”