Incident Response Frameworks
|NIST Incident Response Process||SANS Incident Response Process|
|Step 1. Preparation||Step 1. Preparation
|Step 2. Detection and Analysis||Step 2. Identification|
|Step 3. Containment, Eradication, and Recovery||Step 3. Containment|
|Step 4. Post-Incident Activity||Step 4. Eradication|
|Step 5. Recovery|
|Step 6. Lessons Learned|
When we compare the NIST and SANS frameworks side-by-side, you’ll see the components are almost identical, but differ slighting in their wording and grouping. The biggest difference lies with Step 3, where NIST believes that containment, eradication, and recovery overlap – meaning you shouldn’t wait to contain all threats before beginning to eradicate them.
Some debate which framework is better, but it really comes down to a matter of preference and your organization’s resources. CrowdStrike’s Incident Response team follows the NIST framework, therefore this article expands upon the four steps and break down what each mean for your incident response plan.
Step #1: Preparation
No organization can spin up an effective incident response on a moment’s notice. A plan must be in place to both prevent and respond to events.
Define the CSIRT (Computer Security Incident Response Team)
To act quickly and completely while an incident is unfolding, everyone on the CSIRT needs to know their responsibilities and the decisions that are theirs to make.
The CSIRT should include a cross section of business and technical experts with the authority to take action in support of the business. Members should include representatives from management, technical, legal, and communications disciplines, as well as security committee liaisons. All departments affected by an incident should be in the loop and everyone should have a decision matrix to guide their actions during and after the incident.
The plan should also define who is in charge and who has the authority to make certain critical decisions. Those aren’t things to figure out–let alone argue over–in the heat of the moment.
Develop and update a plan
Ensure plans and other supporting documents exist and are updated periodically to remain current. All relevant personnel should have access to the parts of the plan that pertain to their responsibilities and should be alerted when the plan is revised. There should be a feedback loop that is enacted after every significant incident in order to improve the plan continuously.
Acquire and Maintain the Proper Infrastructure and Tools
Have the capabilities to detect and investigate incidents, as well as to collect and preserve evidence. To determine if an attacker is in your environment, it’s critical that you have endpoint security technology that provides total visibility into your endpoints and collects incident data.
Without the right tools, and processes to guide their use, you’ll be ill-equipped to investigate how attackers are accessing your environment, how to mitigate an attacker’s existing access, or how to prevent future access.
Always Improve Skills and Support Training
Ensure the IR team has the appropriate skills and training. This includes exercising the IR plan from time to time. It also includes staffing the IR team, with either in-house staff or through a third-party provider, to accommodate the time away from the job necessary in order to maintain certifications and leverage other educational opportunities.
Possess Up-to-Date Threat Intelligence Capabilities
Threat intelligence capabilities help an organization understand the kinds of threats it should be prepared to respond to. Threat intelligence should integrate seamlessly into endpoint protection and use automated incident investigations to speed breach response. Automation enables a more comprehensive analysis of threats in just minutes, not hours, so an organization can outpace advanced persistent threats (APTs) with smarter responses.
Step #2. Detection & Analysis
The second phase of IR is to determine whether an incident occurred, its severity, and its type. NIST outlines five steps within this overall phase:
- Pinpoint signs of an incident (precursors and indicators): Precursors and indicators are specific signals that an incident is either about to occur, or has already occurred.
- Analyze the discovered signs: Once identified, the IR team has to determine if a precursor or indicator is part of an attack or if it is a false positive.
- Incident documentation: If the signal proves valid, the IR team must begin documenting all facts in relation to the incident and continue logging all actions taken throughout the process.
- Incident prioritization: NIST designates this step as the most critical decision point in the IR process. The IR team can’t simply prioritize incidents on a first come, first serve basis. Instead, they must score incidents on the impact it will have on the business functionality, the confidentiality of affected information, and the recoverability of the incident.
- Incident notification: After an incident has been analyzed and prioritized, the IR team should notify the appropriate departments/individuals. A thorough IR plan should already include the specific reporting requirements.
Don’t let the simplified list above fool you. The detection and analysis phase can be extremely challenging. Here are a few reasons why:
- Incidents may be detected by many means, ranging from automated detection systems to user reports. The level of fidelity and detail will vary according to how or who made the report, and some incidents are nearly impossible to detect no matter how they were reported.
- The volume of indicators of potential compromise (IOCs) can be extremely high. Some organizations may even receive millions per day. Separating the signal from the noise is a massive task.
- Analyzing incident-related data with accuracy requires deep and specialized technical knowledge, as well as a great deal of experience. Automation helps, but people are the ultimate arbiters of determining whether an incident is occurring or not. Many organizations struggle to acquire the level of expertise necessary to recognize incidents in progress.
CrowdStrike’s Falcon platform is used extensively for incident response – especially during the detection and analysis phase. Its cloud-based architecture enables significantly faster incident response and remediation times and provides remote visibility across endpoints throughout the environment, enabling instant access to the “who, what, when, where, and how” of an attack. Services like Falcon Complete streamline the detection and analysis phase by combining CrowdStrike’s endpoint security technology with the people, expertise and processes necessary to remediate an incident quickly.
Step #3. Containment, Eradication, & Recovery
The purpose of the containment phase is to halt the effects of an incident before it can cause further damage. Once an incident is contained, the IR team can take the time necessary to tailor its next steps. These should include taking any measures necessary to address the root cause of the incident and restore systems to normal operation.
These decisions have the potential to impact productivity, and IR teams must approach them with caution. An IR plan will ease their decision-making process by having a set of predetermined strategies and procedures for containment that are based on the organization’s level of acceptable risk.
Develop containment, eradication, and recovery strategies based on criteria such as:
- the criticality of the affected assets
- the type and severity of the incident
- the need to preserve evidence
- the importance of any affected systems to critical business processes
- the resources required to implement the strategy
At all times, these processes should be documented and evidence should be collected. There are two reasons for this: one, to learn from the attack and increase the security team’s expertise, and two, to prepare for potential litigation.
Front Lines Report
Every year our services team battles a host of new adversaries. Download the Cyber Front Lines report for analysis and pragmatic steps recommended by our services experts.Download Now
Step #4. Post-Incident Activity
Every incident should be an opportunity to learn and improve, but many organizations give short shrift to this step. Adversaries are always evolving, and IR teams need to keep up with the latest techniques, tactics, and procedures.
A lessons learned meeting involving all relevant parties should be mandatory after a major incident and desirable after less severe incidents with the goal of improving security as a whole and incident handling in particular. In the case of major attacks, involve people from across the organization as necessary and make a particular effort to invite people whose cooperation will be needed during future incidents.
During the meeting, review:
- what happened and when
- how well the IR team performed
- whether documented procedures were followed
- whether those procedures were adequate
- what information was missing when it was needed
- what actions slowed recovery
- what could be done differently
- what can be done to prevent future incidents
- what precursors or indicators can be looked for in the future
Document the important points made during the meeting, assign action items, and follow up with an email record to those who could not attend.
The results of these meetings can become an important training tool for new hires. They can also be used to update policies and procedures and create institutional knowledge that can be useful during future incidents.