Enhancing Your Response Capabilities

1. Detection Strength

The underpinning of an effective response strategy is broad detection.

This requires a broad log ingestion ecosystem, allowing for the appropriate depth of data and breadth of sources to detect across the entire kill chain. Outcomes then can scale through analytics while implementing advanced technologies (e.g., machine learning and building extensions) through API-based connections. Visibility into pre- and post-breach environments, analyzing data, and producing insights across the IT estate are critical to enable response actions spanning network, endpoint, and cloud environments. Various data sources also are necessary during forensics to complete the picture of an attack.

“Responding effectively to security events means that responses are tailored to each threat, system, and execution environment, as well as to compliance and regulatory requirements, customer obligations, and the organization’s
overall risk appetite.¹“

2. Broad Response Coverage

Discover ingress and egress points.

An organization’s IT estate is dynamic, but the constants always will include endpoints (client and server), network (firewall, WAF), cloud (AWS, Azure, GCP), and identity (Active Directory, SSO). These are a sampling of sources for telemetry data which are key to detecting incidents. However, they also represent the targets where the response action will occur to minimize the damage of a detected breach. An effective response strategy should include a policy update applied at the endpoints, network edge, and cloud service provider.

3. Risk Profile

Consider the value of an asset and type of attack.

A revenue-generating asset, such as an e-commerce server, will have a different response than a non-critical asset, like a print server. To understand the type of attack against an asset, ensure you have access to the security content detail provided in an actionable way, including analytics content and configuration requirements. As your IT estate grows in size and complexity, the ability to classify assets with similar criteria to apply the response actions is imperative. Failure to do so will result in significant management challenges.

4. User Experience

Your solution should allow for configurable response workflows.

This solution should invoke the optimal balance of process automation and human interaction to address your evolving security requirements. Resource-gapped organizations may not be able to respond to every incident nor want everything automated as this can have adverse effects. The ideal scenario is to automate actions based on circumstances such as an organization’s risk tolerance, skillset, and headcount. Some prefer a simplified experience with a sage to guide them in the playbook creation process. Consequently, more sophisticated users may prefer fully customized playbooks.

5. Actions Taken

Recognize that effective response is often a blend of multiple actions.

Prioritization changes based on variables such as incident type, asset criticality, and desired outcomes. The blend should consist of:

• Notification — Inform appropriate responders of the security incident with sufficient detail to allow for decision-making.
• Containment — Limit access of the compromised entity, which may include limiting system services, restricting network access and egress, or reducing user roles and privileges.
• Elimination — Disrupt the attack and block access to the vulnerable service.

In most cases, there will be a notification prompting security teams to further investigate and execute the recommended remediation steps. Steps may include revising a policy or change control, updating a misconfigured service, or applying patches to affected systems.

6. Use Cases

Every organization is at a different stage in their automation journey.

Your ability to incorporate human interaction for response actions allows adoption at a pace that is comfortable for you. Review the following scenarios that include both human-guided and fully automated response actions:

• Indicators of Potential Insider Threat: An IT administrator’s credentials are being used to access and modify previously untouched systems. This either could be an early warning to a potential insider threat or be nothing. The anomalous activity triggers a playbook which sends a push notification to the IT admin and their supervisor on their mobile devices. They have the choice of disabling the user credentials on Active Directory or investigating further by opening a ServiceNow ticket.
• Privilege Access Management Anomaly: The privileged credentials of a senior executive are used to manipulate company information from an unusual geography. The incident triggers a playbook to contain the potential threat and notify the security team. The privileged credentials are restricted, a push notification is sent to the security administrator, and a message is distributed via Slack to the security team to verify legitimacy of the activity.
• Complex Indicators of Compromise: A healthcare clinic’s patient admitting system is demonstrating abnormal PowerShell activity consistent with known ransomware attack campaigns. The incident instantly triggers a playbook to isolate the compromised host and block communication from an external source at the edge to prevent spreading to other hosts.

In each scenario, multiple actions are taken. The number of human decisions, conditions, and triggers in the playbook should be customizable to align with the organization’s business requirements.

More sophisticated organizations should have the ability to design playbooks with the flexibility to create decision trees with multiple conditions and actions.

7. Incidence Response Communication

Carefully consider appropriate communications.

For your response strategy to be effective, communicating the action you are taking to stakeholders who need to be informed or provide additional forensic detail as part of the process is key. Users should be notified with collaboration tools such as Slack, Teams or email, or advanced ticketing systems like Jira and ServiceNow. Integrating your response strategy into these collaboration and ticketing platforms enables effective and efficient dissemination of critical information.

Once the seven pillars of effective response have been addressed, implementation and execution of your plan can begin. It is essential that the plan be carefully crafted, easily iterated, and improved as needed.