SCORE Session 1 — Cybersecurity Incident Response

I want to give a hearty welcome to everyone that has joined us today. I'm looking at the chat and where everyone is shouting themselves out from and I am actually quite surprised to see such a geographically diverse audience today. I'm honored to be here to share this information with you and I know that you'll get a lot out of it. So, let's go ahead and jump right into it. We're going to talk about cybersecurity incident response.

Restoring your business after a cyber attack. Today, there's a lot going on in the world around us. Geopolitically, there's a lot of unrest. Of course, we know what's going on between the United States and Iran. Typically, when we have those kinds of situations are going on in the world around us, that generally kicks up the bees nest of malicious actors from a cyber perspective who get really busy at attempting to exploit vulnerable computer systems around the world.

We see that today. You might have heard of the Stryker incident that happened a couple of weeks ago. There are even more incidents that are occurring as a result of the geopolitical unrest that we have going on today. So, I'm glad that you guys are here partaking of this webinar because hopefully this if you apply this information to your own businesses to protect your technology infrastructures, you won't be the next Stryker. So, we're going to talk about where we are today.

We're going to look at a couple of statistics that kind of put the framework around what's going on in the world around us. Then, we'll jump into the incident response planning framework. I'm going to take you through a step-by-step process that you can employ to some varying degree based on your level of maturity in your business to build resilience or the capability of being able to respond to an incident after it happens or even in a lot of cases prevent the incident from happening in the first place. And then we'll look at where do we go from here? So offer some tidbits of information that you can use to enhance your protection that will make it much more tougher for you to be that next victim.

As Stacie mentioned, I bring over 30 years of experience in cybersecurity, digital forensics AI and high-speed network design. I'm a former professor and department chair of computer security and computer forensics. And I have been a contributing analyst on all the major networks related to addressing or discussing cybersecurity related issues happening around the world. So let's look at some trends and statistics that begin to frame the issue that we're dealing with today. Today in 2026 the cost of cybercrime has grown to $10.8 trillion up from $8 trillion in 2023.

That makes the amount of money generated from cybercrime activities the third largest GDP in the world behind the United States and China. With that amount of money that's being generated in the world through malicious activities you can see why cybercrime continues to remain one of the world's major issues that we need to stay on top of. If we relax ourselves, this will get worse. Some stats to be mindful of as we continue to frame this issue about 94% of small businesses will be a victim of a cyber attack. And what that means is you the small business owner have a high probability of being a victim if you haven't already been a victim of cybercrime.

Now, Stacie mentioned that it's not a matter of if, it's a matter of when it happens. But today, given AI coming online and quantum computing coming online here in the very near future, it won't just be a matter of when, it'll be a matter of how soon will you be a victim of cybercrime. And so, the more proactive that you can be now, the harder you will make it for you to be a victim. 37% of companies hit by ransomware had fewer than 100 employees. The average ransom paid this year is up to $137,000. Insurance, and I'll talk a little bit about this later on, insurance, as a result of this figure, insurance companies are becoming much more strict in how they underwrite customers because this dollar figure continues to grow. 78% of SMBs could not continue operating after they've been hit by ransomware.

We're going to talk a little bit about ransomware. This is a part of a series of webinars that'll be going on throughout the year. One of those webinars will be on ransomware, so we'll delve deeper into what this whole ransomware threat vector is all about and how to harden your business against being a victim to a ransomware attack. 65% of SMBs, SMBs, if you don't know, stands for small and medium businesses, did not purchase insurance until after the attack, meaning it was too late, which meant that they had to bear the total cost of recovery if they were to stay in business after that cyber attack. 95% of SMB cybersecurity incidents cost as much as $250,000. So, what that means is not just in the payment of a ransom if it was a ransomware attack, but also in the cost for the money that you will spend in recovery activities like hiring professionals, recovering your data, hardening your infrastructure after the incident. This makes insurance a very valuable tool to have in your toolbox to help you guard against not only the threat of a cyber attack, but also the impact of it. 80% of SMBs were the target of cyber attacks this year. 87% of SMBs have customer data that could be compromised by a cyber attack.

We're going to talk a little bit about some things that you can do to protect your customer data because it's not just about protecting the customer data, it's also what liability will you be exposed to after the attack occurs. So, we'll look at that a little bit. 70% of SMBs would stop doing business after a cyber attack. And the median number of cyber attacks still sit at four this year, which means that the number of cyber attacks that a small business will experience is about four. And that's four too many. Let's look at some of the top 10 cyber threats for this year.

Of course, AI-driven phishing and social engineering. We've heard all about the capabilities of AI. The fakes we've seen, the videos, the artificially generated videos, we've seen the images, we've heard about the AI's capability of being able to mimic live voices. Those are very real threats out there. And now that AI has become capable enough to be able to access data and streamline threat vectors, it makes this one of the top 10 threats that you as a business owner have to be concerned about.

Social engineering and phishing still responsible for about 70 to 90% of the breaches that occur throughout businesses. Ransomware 2.0, it's an evolution of the original threat vector of ransomware now involving data extortion, which means that not only do they encrypt your data and require you to pay in order to decrypt your data, they also now extort you, meaning they are threatening to release your data into the onto the dark web or into the general cyber marketplace, which could expose you to great liability. So, for instance, you had put in place countermeasures to prevent your business from being impacted by data being encrypted, like having air-gapped data backups. If your data is still impacted through the encryption process and exfiltrated out of your environment, they have the ability to threaten to release that data, which generally results in the business paying in order to prevent that from happening. In some cases, they pay and it still happens.

Cloud misconfiguration and SaaS exploits. Most SMBs are cloud-first, but not cloud-secure. And what that means is because cloud architectures have become very affordable and accessible to pretty much any business, we move so far into the cloud, but have not really considered what it means to keep our cloud infrastructure secure. And that's where we see a lot of cyber incidents occurring today as a result of the insecure configurations of cloud architectures. Business email compromised through wire transfers, invoice manipulations and so forth and so on.

I can't tell you how many calls we get a week from businesses that have either been negatively impacted by it or have caught it in time before they made the big $500,000 transfer to this individual posing as a legitimate vendor. We just had one last week of a vendor in Las Vegas who caught it in time before they made the transfer, but realized that they needed to step up their security countermeasures to prevent this from happening again. This is a very common attack because it's a lucrative one right off the bat. Credential theft and identity attacks. Identity is now the number one attack surface.

Why? Because it directly involves the human being and as we say in the security business, the human being is the weakest link in any security architecture. So, we can attack that link, we can generally guarantee ourselves success. Supply chain and third-party attacks. Trusted access equals biggest risk.

We see third-party or vendor risk issues. For instance, you might have heard about the Target incident that happened about maybe 10 years or so or go. Target was a victim of a cyber attack as a result of the vendor that they had managing their HVAC systems that was vulnerable that for whatever reason was connected to Target systems and allowed that malicious actor to get into Target systems through that vendor. Vendor risk management has become a really big deal today. And what that basically is partners ensuring that each is doing what it can possibly do.

It's due diligence basically to ensure that they are mitigating any vulnerabilities between the two so that they don't become a residual or pass-through victim of a cyber attack. Endpoint mobile device attacks. Endpoints remain the primary initial access vector. Why? Because we get very lax and in our comfort zone as it relates to our cell phone usage, our tablet usage, our laptop usage.

We access sites without care concern, we download data, we click on links without care or concern, and so the endpoint has become that main attack vector, access vector for malicious activity. Insider threat. Insider threat remains a very high potential. And the reason being is because that individual knows all about your business. They know how they do their processes work.

They know how your systems are configurated. And in most cases, they have the direct credential access into the data and those systems, which makes them a very viable and potent threat. Dr. Jerry Post, who's deceased now, is famous for his work that he did for the CIA in profiling Saddam Hussein, did some work, a study commissioned by IBM, about the insider threat. And what his research determined was that about 80% of cybersecurity related issues are going to come from the inside of the organization and not from the outside.

So, you can see how the people that you work with every day can be a potential threat to your business. Zero-day vulnerabilities and exploit Zero-day vulnerability exploitation. Speed is now the attacker's advantage. Again, with the and quantum computing coming online, speed will be even faster. And what I mean by that is the ability to be able to parse through data, to identify those vulnerabilities in complex infrastructures, the amount of time that it takes to do that will be so significantly reduced that zero-day vulnerabilities will be a very big concern.

And I mean, they already are, but they will be becoming even a bigger concern with those new technologies coming online. Malware-as-a-Service. Malware-as-a-Service is a big deal these days because now malicious actors are hiring attackers to build malware and attack systems through weak and vulnerable vectors into those infrastructures. So, instead of them doing the work, they hire these individuals that are specifically tasked to doing that kind of work. So, as you can see, these are significant threats that we face every day.

What we're going to talk about will help you to put in place response capabilities so that you can recover quickly from these incidents should you be a victim of a cyber attack. So, we're going to look at four components today that make up the complete framework of incident response. The first is preparation. The things that you need to do before an attack occurs in order to ensure that one, you've hardened your infrastructure, you put in place the processes and procedures necessary to help you streamline your response. The detection and analysis of an incident.

What are some of the things that you need to do or that you will be doing in order to detect and analyze an event to determine whether it's an event or an incident. We will discuss the differences between those two shortly here. Containment, eradication, and recovery. What do you do from a technical perspective to contain the incident, to eradicate the malicious actor from your environment, to recover control over your environment, and then to harden your environment to prevent the incident from occurring again. We've had a number of customers in our past that did go through this process, but they didn't go through the hardening phase of it.

The attacker returned to the scene of the crime because they knew that the systems were weak, and they had to go through this process all over again. Lastly is the post-incident phase. This is where you're going to take time to review your incident response process to determine any shortcomings or deficiencies in your process that you need to improve on to make sure that next time an incident occurs that your incident response process can be delivered in as efficient of a manner as possible. So, some quick definitions that I'm going to offer to you. First is the event or an event.

Now, when you have a technology infrastructure, whether you have one computer or thousands of computers, network devices, and any manner of IoT devices, those are all those devices that have IP addresses associated with them like TVs or watches or cameras or whatever appliances you might have in your environment. At some point in time you're going to have some operational issues with a device or more. Just because you're having issue with an operational issue with that device, meaning that the device is not functioning way that it normally does, it doesn't necessarily mean it's a cyber attack that's causing malfunction of the device. It could just be software-related issue, a network-connectivity related issue, that is occurring on that device. That's what we would generally call an event.

An event where your IT guy, if you have one, or your IT team, if you have one, would respond to that event in order to address the issue or remediate it to get that device back online and operating as expected. An information security event is one that is related directly to a cyber attack of some sort. It generally means that there's been a failure in some way, shape, or form of your countermeasures, if you had them enabled. If you didn't have them enabled, then it would generally means that that event is going to translate into some negative impact on your infrastructure and your business. An information security incident is a single or series of unwanted or expected events that have a significant probability of compromising the confidentiality, availability, and integrity of the information in your business.

You'll hear me use the those terms confidentiality, availability, and integrity as it relates to data. Some of your businesses are subject to ordinances, municipal ordinances, municipal, state, or federal ordinances that require you to protect PII or personally identifiable information. When we talk about that, we're usually from a cybersecurity perspective, we usually refer to CIA or confidentiality, availability, and integrity as it relates to how you maintain that data within your environment. And sharing that it's the confidenti- confidentiality is maintained. Ensuring that that data is always available to those authorized users.

And ensuring that the integrity of that data is maintained while it's in your possession. And then lastly, an incident a declared incident. And what that means is that you have done the due diligence to weed out or rule out the consideration of this being an event. You're now considering to be an incident and you're declaring it such. And when you declare that as an incident, there's a whole set of steps that occur that we're going to talk about that you will launch including calling third parties, getting your insurance company involved, maybe even calling law enforcement depending on the indicators of compromise of that incident.

You want to be very judicious in declaring an incident because there's a lot of other implications that come about as a result of that declaration. So, let's talk about preparation. There are basically three phases of preparation that you can go through. Now, so a lot of this your intention to pursue this also depends on the maturity of your business. If you are a single business owner, more than likely you're not going to have to go through most of this because it's just you.

But if you've got a number of employees, you may want to seriously consider going through this at least to prep your team in what the expectation is as it relates to how you're going to deal with an incident once that incident has occurred. So, we're going to look at policy development, tools and resource allocation, and process and procedure development. If you engage in these three phases of preparation, you should be well prepared to respond to an incident when it occurs. So, first step in preparation is policy development. Policy development is basically going to be a step that you take to define how you're going to prepare for the incident, what resources you're going to allocate to support you in that incident, rules and processes and procedures that you're going to stipulate that allow for and govern behavior around the response to the incident.

I'll give you an example. If you're a decent size business and you're more than likely have some official financial, procurement, allocation and management processes in place that helps you to manage your day-to-day financial operations. That might take several steps in order to engage in procuring a service or device, but during the time of an incident, you might not have the time to go through the official set of steps required to procure a service or equipment. And so, having a policy in place that allows for the exception for you to go beyond what is traditionally followed is a good thing to do because it shortens the amount of time that it takes for you to get allocated the money, the services, the resources that you need in order to support the response effort and not get tied down in the day-to-day red tape that you normally would engage in order to manage. So, that would be an example of a policy that you would implement that would stipulate the exceptions that that can engage in when dealing with an incident.

Policies and procedures around governing the hiring and termination of employees, this is a big one. Most organizations are immature in the policies related to how they hire and fire employees. Especially terminating employees. When you are terminating an employee, that is a potential area where especially if that person is disgruntled and they have access to your system, they could become that insider threat and evoke damage in your system in retaliation to being terminated. So, having those right processes and procedures in place, for instance, to alert your IT team that you're going to be terminating this individual, so that they can be vigilant and either shutting off credentials or access, retrieving endpoints that they may have in their possession that they could use to retaliate against you.

Depending on the maturity level of your organization, you may have in place policies and procedures governing deployment of new technologies. You might have procurement rules and strategies, you might have staging rules and strategies, you might have testing rules and strategies around how you integrate new technologies in your environment. If you're dealing with an incident, you're not going to have time to go through those standard operating procedures that you've implemented in your organization. You might have to usurp those processes and procedures in order to get some new technology in to help to streamline or facilitate your incident response process. So, policies around that, allowing for exceptions, are necessary.

Change management, of course, during an incident there's going to be a lot of changes going on depending on the maturity level of your organization. You may have change processes and procedures in place that govern how changes are made, who reviews them, who approves them, the testing functions that go along with changes before they are put into production, for instance. During an incident, you're not going to have that time to go through that process if you need to implement or integrate new technologies that you've purchased to help support the incident response process. So, policies that allow for the exception to change management are necessary. The next step in preparation is the tool set that you're going to procure in a proactive way that will help you to bolster your incident response capabilities and your team should you need them.

So, tools such as virus scanning tools, which you should actually already have in place to help you deal with malware threats in a proactive way, monitoring, reporting, and alerting, I highly recommend even if you are a one-person shop, that you procure a monitoring, reporting, and alerting capability that will let you know what's happening underneath the covers of your technology. For instance, if you're dealing with a credential attack against your endpoints, more than likely you're going to have a lot of failed logins in a short period of time that indicate that there's a potential of a credential attack occurring against your endpoints. If you don't have the monitoring, reporting, and alerting tools in place to help alert you to that, you will never know that. And so, again, I go back to my recommendation of making sure that you've got some monitoring and reporting or alerting capability, whether you can implement it or you have to procure it through a third party, through an IT guy, for instance. If you're a one-person shop and you have someone who is taking care of the management of your IT technology, your endpoints, have them have some capability enabled that allows you to see those kinds of things happening so that you can respond to them.

Most incidents that are discovered did not occur at the time of discovery. Those initial breaches into the environment generally occurred months before, even years before, the incident was actually discovered. And so, as a result, if they were not alerted to the initial breach, they would have never known that the malicious intruder was in their system poking around and finding other vulnerabilities or exfiltrating data. Often, so again, I go back to the recommendation that monitoring, reporting, and alerting is extremely important to both pre- proactive and reactive management of your environment. Next is forensic data collection toolkits.

After an incident has occurred, one of the most important functions you're going to engage in is evidence collection. You never know where the investigation or response to that incident is going to wind up. And so, you want to make sure that you have maintained what's called a forensically sound posture when collecting that data because if that incident winds up in some kind of litigious activity, meaning if you have it to a lawsuit or some kind of prosecution, then the data that you've collected, you need to make sure it was collected in a forensically sound manner so that it can be used in the commission of that prosecution. If it has not been, then more than likely that data will be dismissed. We'll talk a bit about what it means to abide in a forensically sound manner as you're going through the containment, eradication, and recovery phases of the incident.

Intrusion detection tools, similar to monitoring, reporting, and alerting, give you some sense of what's going on behind the scenes. They give you some sense of the activities that might indicate that a potential breach is occurring or that there's a malicious actor who's attempting to breach your environment in some way, shape, or form. These tools today not only detect potential incidents, but depending on the sophistication of the intrusion detection tool itself, can even mitigate or stop the attack in its tracks. NetFlow data capturing and analysis tools are extremely important because they help from an investigator perspective, that forensic examiners or the IT people who were investigating the incident, to determine how the incident occurred, where it came from, how it propagated through your environment, the endpoints that were under threat by the malicious actor. So, being able to capture that NetFlow data helps us as forensic examiners to really do a deep dive investigation into the propagation of that event throughout your environment.

We had a situation, a customer a few years ago, who got hit by ransomware attack up their entire business down. And not just for a day, for weeks. They went through the incident response process, but they were not following forensic sound data collection processes, and they did not have NetFlow data captured, and so by the time they called us in, they had pretty much erased all of the pertinent data that we needed in order to determine root cause of the incident. And so, the only thing we could really do was to help them in the recovery and the eradication and the recovery effort, but we couldn't tell them how it happened because due to their process, they had erased everything. Cloud communication tools, Office 365, Teams, Zoom, etc. are extremely important because what they do is they help you set up secure communications amongst all the parties involved in your incident response process.

This is key because for instance, if you are dealing with an email spoofing attack, which is what most wire transfer or invoicing fraud issues are born from, if you are communicating with people that you are engaged in the response with, the attacker can see those emails as well and be able to maneuver around your environment in order to continue to maintain prevalence in your environment. So, you don't want to use your compromised email tenant to communicate about what's happening, what you're doing, because they can see that as well. So, you want to use secure cloud communications like Teams and Zoom to make sure that you can securely communicate effectively, but not give away what you're doing to the bad guys that are in your environment. One of the recommended preparation steps that I suggest is to speed up recovery of your environment is to make what we call clean system images of all of your key systems at least. If you only have a few endpoints, then to make clean images of those endpoints so that after the compromise has occurred, you can restore your devices from those clean images, get rid of all the malicious indicators of compromise, malware variants, configuration changes, anything that the malicious actor might have done while they were in your endpoint or your device.

These products here, Acronis, Cyber OpenText, EnCase, and ManageEngine are tools that can be used to make those system images that you would store offline for safekeeping and only use when you need to restore those devices back to an operational state. IRP training, important here as well. IRP training, or incident response planning training, basically takes your key people in your organization the training process for processes and procedures that you have established for responding to the incident. We've identified four groups of people or four groups of roles within your organization that need to be to go through this training. So, your senior management, they need to obviously understand the process the policies that you've established to help to support the execution of the incident response.

Mid-level managers, who are more than likely going to be involved in the on-the-ground technical response along with the IT staff and other employees involved in the on-the-ground response are going to need to understand what this process is. They're going to be to understand who to communicate with, how to communicate with them, and what to communicate to the various parts of your incident response team. And we're going to talk about testing later, which takes each of these roles through the testing process to ensure that they can maintain a high level of vigilance and readiness to execute the incident response plan should you need to do that. The incident a contact list is it important having that prepared and ready to go is necessary because it shortens the amount of time with of you figuring out who do you need to call when this incident happens. Depending on the size of your organization you're going to have multiple roles on that list.

So as you see here we have law enforcement, legal support, insurance, technology vendor support, employees in the company. You should have those roles identified on your contact list and backup roles because you never know when someone's on vacation or just unavailable at the time of an incident. You want to make sure you've got a backup to that role as well. Information you're going to have on that list is the member name, job title, the role that they're going to play in the incident response process. You're going to have a primary member, phone number, home, cell, all the phone numbers necessary that will allow you to get in contact with an individual because if an incident occurs at night, off hours, you're going to need a way to get in touch with them quickly.

The office address, primary and secondary emails, and again as I mentioned, backup teams. We're going to get a little bit deeper into the third party support including law enforcement, legal, insurance, and technology vendor support because those are all going to play critical roles and again related to the maturity level of your business and how they're going to support you in your incident response. It is an absolutely necessary that you have this identified up front because again, you don't want to have to scramble to try to figure out who do I call now that my systems are not available to me daily business. You're losing time which could do even more damage to your systems, your data, and your ability to restore in the long run. Incident categorization. this is a necessary function of preparation.

Incident categorization helps you to predefine steps that you're going to take in your response process based on the type of incident that occurs. There are generally three incidents that you're going to deal with. It's either a malware infection, a network or system security breach, or data loss or private privacy breach. Most incidents, all incidents that you're going to deal with, are going to fall in the one of those three categories. And so it's helpful to have processes and procedures defined for how you're going to triage that incident to confirm that it's one of those three.

Once you've confirmed that it's one of those three, how you're going to begin your response process, your containment, your eradication and recovery process, what tools you need in order to facilitate the recovery process based on the category of the incident. Having this predefined streamlines this process and saves you a lot of time in your incident response activities. The escalation decision tree, for those businesses that are a bit more mature in their operations, an escalation decision tree is I recommend it is very helpful to is a helpful tool to also helping to streamline the response process. An escalation decision tree is basically a flowchart that's associated with the category of the incident that I just talked about that really outlines all the steps in a flowchart that if you follow those steps according to that flowchart will lead you to the resolution process but also to make sure that you do all the proper data collection, all the proper data reporting all the proper communications and that you're not leaving out any steps along the way. And I'll show you here on the next slide what the decision tree looks like.

So this might look a little complicated but if you really delve deep into it this helps you as an incident response team to really figure out what your response is going to look like without you having to do that on the fly. It maps out each step and it maps out all sub steps from that step should there be an affirmative or a negative associated with that step. And it takes you all the way to the end of the incident response process. This is a generic the escalation decision tree you can take this and modify it based on your business, based on your maturity level. This typically most businesses that that have a number of employees would look to engage in this because it helps again to streamline the process.

If you're one or two person a firm or business you might not need to engage in this because it's just the two of you or the few of you coupled with any outside resources that you might bring in. Another component of the preparation process is defining what your business critical path is. The business critical path is basically that path of operations that are absolutely necessary for you to do business on a daily basis. If any one of those components on your path were to disappear, would your business stop being able to be viable in delivering products or services as a result of that missing piece in that critical path? Every business has a critical path.

Those are the most important functions in your business that are absolutely necessary. There are functions in your business that are what we would call secondary, that if they were not available, that you could still do business. It might be a little challenging to do business, but you could still do business on a daily basis. I'll give you an example. The one of the local hospitals here in Chicago experienced a security breach about 2 years ago.

There was a ransomware attack that encrypted their databases to the point where it prevented them from being able to do surgeries and procedures, from being able to deliver basic care. They really couldn't do anything. As a matter of fact, they had to resort back to paper operations in order to keep things moving along as best they could, but some of their essential services they couldn't deliver because they didn't have access to their data on their computer systems. That database that was attacked was a part of their business critical path, that when it disappeared, it stopped them from being able to do business normally. You want to identify this for yourself because the identification of your business critical path, you can proactively put in place recovery mechanisms or secondary processes or procedures that could take over in order to ensure that you can continue to do business and not lose complete functionality.

What do we need from start to finish in order to execute this mission? What are those components of our operations that we need in order to execute this operation, in order to pursue our mission, if you're a nonprofit, and what can we absolutely do without? Once you identify those, then you really know where your focus needs to be, especially when it comes in when you're looking at the proactive ways of protecting those components of your business. As a part of the business critical path definition, you can do what we call a business impact analysis. A business impact analysis is a formal process of engaging in that analysis to qualify and quantify the impact to your business if you were to lose one of those components in that business critical path.

And what this will help you do is to determine or give you the business case to do the things that you need to do to put in place those recovery or backup measures to ensure that if you lose that primary component, that that backup measure can take over and keep you moving forward. As a part of the preparation process, who are you going to call? You need to know that up front. As I mentioned before, you one of the things you don't want to do is have to sit on and figure that out after the incident has occurred. Most likely, you're going to be contacting support organizations, customers and folks internal to your organization, especially if they're identified on the CIRT list, to get engaged in the response process.

So, some of those types of roles that will come to your aid, again, technical incident response support, depending on the maturity level of your business, you might need some outside support to help you with that. Law enforcement, This is kind of a tricky one because the used to be that there were certain dollar levels that or thresholds that law enforcement would require before you would get involved. Now, anytime you're dealing with a cyber incident, you should always file a police report at the very least because that data can then be used to help support trending and also help law enforcement understand what they need to do to help better support the general public. Depending on the dollar threshold that is associated with the cyber attack that might trigger a higher level of response from law enforcement like state police or FBI who will get involved after that threshold has been crossed in a very technical way to help support the investigation doing everything from taking forensic images of devices endpoints in your environment doing the analysis. It also depends on the incident.

If you're dealing with for instance a contraband kind of issue like child pornography, they will immediately get involved no matter if you are a person, business or 50,000 person business. If you're dealing with child pornography or some kind of sexual abuse attack they will immediately get involved and when they get involved you're in a whole different space of operations at that point. The next thing you need to do is to be calling your legal support and to help guide you through that process. They are on this list. Depending on the maturity level of your business, you might have a legal team involved.

You definitely want to get involved. You might have crisis support. If you have a large customer contingent on the consumer side, crisis communication providers are a good tool to have to help you determine how to get information out there, what information to get out there so that you don't make the situation worse. Partners, if you're doing business with partners who are going to be impacted by the incident, you want to communicate with them so that they can at least start investigations on their ends to make sure that they're not been impacted by the incident and can have that level of vigilance and due diligence to ensure that it doesn't propagate into their business environments. Of course, employees you're going to want to get involved to some degree depending on the role that identified on the CIRT list.

And regulators, depending on the incident and the customers or consumers that are involved or exposed, you might be subject to some regulatory liability that might require you to do things like offer free credit reports, make notice to those individuals that are affected. I would imagine that we've all received the letters in the mail from our credit card company or financial institution or some business that we've been engaged with for making the report to us that they have been a victim of a cyber attack and that our data exposed or compromised in that attack. These are the things that you were going to offer you like credit monitoring or some other service to help you ensure that you're not going to be negatively impacted by that cyber incident. That's why they're getting those letters cuz they are legally mandated to send out that communication. Incident testing, we talked about the need to test.

You want to test every component of your incident management process from the triage process to the communication process, and you want to do that on an annual basis to make improvements to that plan. You don't want to that first time that you crack open that incident management plan to be during an incident. You want to make sure that you do this you test it on an annual basis to make sure that you've got all the right pieces and parts in place to ensure that this plan is going to support your incident response process based on the categories that you are planning for and that we mentioned earlier. So, detection and analysis. Detection and analysis, three phases, the incident triage phase the indicators of compromise review, and the evidence collection, preservation, and handling.

These are all extremely important in the detection and analysis because what this is going to do is tell you what actually happened. Where it happened. When it happened. And you might even be able to determine the how it happened and the who did it. Now, the who did it piece, last thing you want to be thinking about, you really want to be focused on restoring control over your business.

The who did it piece can come after you have regained control over your business and now you can focus on potentially identifying the source for prosecution later on. In the incident communications protocol, there's the pre-incident declaration communication the incident response execution communication and the post-incident response communication. This level of communication is basically going to provide you with guidance or provide the team and the company with guidance on what's happening during the incident response process. The who, what, where, why and how of it all so that people know what they are expected to do during the incident the alerting to your partners third party organizations who ever need to get involved or who might be impacted by the incident or all going to happen as a part of your communications protocol. In the testing phase of this you want to test out this protocol to make sure that you're communicating the right things to the right people at the right time and that you're not over communicating which could make the situation worse.

What do we need to communicate about during the incident? Again all communication should be on a need to know basis. All communication should be secure. I mentioned using Zoom or Teams or standard form of distribution list should be used for status reporting. What you communicate about will depend on what you know and how soon you know it depending on the maturity level of your business.

If you have a crisis team in place they will help guide you through the communication process so that you're all communicating appropriately every step of the way. For incident triage this is the place where you're going to do your initial investigation to determine what happened that has brought this event on. So I'll give you an example. You're going about your day your business is going about its day and your employees or one of your employees start to complain about inability to access emails or someone's complaining that they've sent emails out to an individual and that individual realizes that they never received the emails. We had a customer call us about that about a week and a half ago.

One of their vendors called them and said hey did you get my emails? And the individual said no I never received them. They said I've emailed you three or four times which then triggered some concern about they're not suddenly receiving emails. This is typically how an incident gets discovered if you don't have those monitoring capabilities in place. It's typically a loss of some daily functionality that you're used to having that's no longer there that could indicate that there's an incident.

Now, this just might be an event. Could be that maybe the tenant expired or maybe the license needed to be reviewed and it wasn't renewed. It could be that maybe the hard drive on the computer crashed somewhere. Or maybe even provider has somehow lost the ability to provide that service. That's happened before in the past.

This incident triage is the process where you're going to figure that out. What's going on here that's causing us to lose daily access to the functions that we're used to having every day. You're going to collect a full account of all initial reports and indicators related to the event. You'll begin to bring these together to piece together what's going on here. You'll conduct an initial assessment of the impact of the event.

How many people are experiencing this issue? Is it just one or is it multiple people? So, that kick kicked up an investigation that determined that their Microsoft 365 had been hacked into. You're going to assess the impact to the key and critical business processes and functions. Remember that critical business path and that BIA that we talked about.

If you've already predefined that business critical path and you know what technology support the processes on that path, then you can immediately go and look at the components of that path to determine whether or not they have been impacted by this event. Depending on the outcome of the analysis of those three steps will help you to determine whether you're dealing with an event or you're dealing with an incident. As a part of the analysis and section and as a part of the triage, you're going to be doing what's called an indicator of compromise review. And this means what are all the indicators in our environment that indicate that we've been compromised. If your technical team is able to do an initial assessment of endpoints to see log files or data that's either been encrypted or deleted we have a situation where a company or customer experiences cyber attack and the attack was that some individual overseas uploaded a porn site to their web infrastructure and was running this porn site from their business.

The indicator of compromise was all the data that suddenly appeared on their servers that indicated that someone had broken in and uploaded this data. Log files, volatile memory and net flow data artifacts are all what we call indirect indicators of compromise. As you're going through your triage, you want to make sure that you are collecting this information and you're storing it away so that if you do move into a litigious or prosecutorial process, if you will that that data is available for the investigators to analyze and help to also piece together what happened. Direct indicator of compromise, again, log files, volatile memory Windows registry, startup folders TCP connectivity records if you go on any computer that's connected to a network, there are TCP connectivity records that show who is connected to that device at any point in time. And then file systems, depending on the amount of data in the file system that's traditionally in the file system, that can help you determine that you that their compromise has occurred.

Evidence collection and preservation, as I just mentioned, that's an extremely important process. And that is focused on how you collect and store away that information. We use this term in our business called the chain of custody. The chain of custody is extremely important to maintain if you're moving into the legal process because that ensures or records the integrity of the information that you've collected. If you don't have that chain of custody, then it's going to be very hard to use that data down the line.

So, you always want to be maintaining the chain of custody. You can Google what chain of custody looks like. It's a very simple process of just keeping a log of when the information was collected, who collected it, where did they collect it from, and then what did they do with it after they collected it. And then storing that information into some in some secure location like a locked box or drawer or room where you can control the access to that evidence or even to the compromised device itself. As a part of the detection and analysis, I'm sorry, let me let's go through the chain of custody that I just talked about.

So, these are questions that are going to be asked if you're moving down the legal route. Was the evidence gathered and verified in a forensically sound manner? You heard me use that term early on. Was the chain of custody maintained? That's basically the record keeping of how the data was collected and what was done with it afterwards.

Is the ownership of the licensing appropriate for the forensics tool used? Sometimes we might procure a tool that we don't necessarily have license to use. Like for instance, we might call up a buddy at another company who might have a forensic tool that they can lend to us, but the tool hasn't been licensed to us, it's been licensed to them. If we're using that tool to support our forensic data collection process, we could be poisoning that data. It's called fruit of the poisonous tree, which is the legal term used to describe the data that you collected using unlicensed tools.

Was the proper examination environment being maintained and controlled by those other members of the CIRT? So this again goes to the chain of custody. Were we able to keep control over the environment while we were doing the analysis of the triage? Can the results of the technical analysis be duplicated by using other tools? Does the analyst understand what they're doing or are they just punching buttons and clicking on things to produce results?

Do other professionals use the same techniques and methodologies? This is important because if you wind up in a defense situation or a situation where there's going to be a defense, someone's being prosecuted, if the defense can prove that the techniques that you used were not appropriate, it will invalidate that data. Is the analyst technically capable of defending and supporting the interpretation of the evidence? Can they tell you what they did, why they did it, how they did it, and why the results were the way that they are. So, in situations where you don't have this capability in house, make sure that you do bring someone in that does have the skill set and capability because all eight of these questions are going to be definitely asked to that individual, and you want to be able to answer those questions in the affirmative.

Otherwise, your ability to prosecute will be put in jeopardy. Now, not all hacking incidents move to some prosecutorial level, but you never know that, and so you want to make sure that you are following the step-by-step process that I previously laid out related to forensically collecting data, so that if it does, you are prepared. Eradication and recovery, the next step in the incident response process. The goal of containment is to remove control of your systems and your environment by the malicious third party. You want to contain their functions and capabilities that they've executed in your environment, so you're basically stopping the attack as it's happening.

You want to in some cases be performing containment as you are executing the triage because what that will do is minimize the level of liability that you could be potentially exposed to through the loss of data or any effects related to the incident that could expose you to a high level of liability. The overall goal of the incident response process is one to help you to respond to the incident timely and efficient manner, but also to minimize your liability based on the incident as well. For short-term containment, if your systems have been impacted by the incident, a lot of us are not using on-prem servers anymore. We're in the cloud, so unplugging isn't a option, but if you do have on-prem equipment, unplugging might be the way to go. Now, when you unplug, just remember that you're going to be losing some valuable data like in the volatile memory, the TCP connects, or other information that could help in the investigation process.

Pulling the cord may be necessary to prevent the loss of data or to prevent further propagation of the attack. That's something that you're going to weigh during the triage process to determine what the best response is to this incident. It might just be disconnecting the device from the network to prevent any further outside access to that device. But again, those are some of the things that you're going to figure out as you're sitting and contemplating what your response is going to be. Long-term recovery can involve a number of different steps from disabling applications on a system, identifying vulnerabilities that could have been used to exploit the system and removing those vulnerabilities, updating and patching your operating systems can be one way to help support long-term containment.

Hardening your firewalls and your network devices, putting in new rules, closing ports are ways to not only harden, but stop the access or prevalence of the attacker in your environment. Redirecting network traffic, depending on the complexity of your environment, to what we call a honeypot so that you can continue to keep an eye on the individual to see what their intention is, what their activities are, which you can use as intelligence to better strengthen your environment. Identifying the possible sources of the attack. Again, as I mentioned before, the source is the last consideration you want to make in your containment, eradication, and recovery. You want to focus on getting control over your systems to start with.

Eradication, depending on the threat prevalence and eradication confidence levels, the compromised systems may need to be completely rebuilt. Depends on how deep the attacker got into your environment, how long they were there. The longer an attacker is in your environment, the more prevalence they will have established in your environment. What that means is the more control over the environment they would have sought to gain. The more configuration changes, malware variants, or applications that they would have installed in your environment to allow them to continue to retain control over your environment.

It might just be the quickest way to reduce prevalence to zero might just be to rebuild the system from scratch. Taking it completely offline, re-imaging it, using those tools that I talked about earlier for re-imaging key and critical systems to get rid of any prevalence that that individual might have established in your environment. Using any vulnerability analysis tools to identify vulnerabilities that they could have used to exploit the security in the system. Get rid of accounts. This is one of the biggest ways that attackers find their ways into other systems, particularly into cloud-based tenants because some unsuspecting user with admin access logged into a device that was compromised and that attacker was able to commandeer those credentials and then use them to get into your tenant and then make configuration changes that give them prevalence and control over your tenant.

So, you want to make sure that you are going through the process of hardening or removing any rules for instance situation that we dealt with a week or so ago, we found that there were a bunch of rules that the individual wrote in their Microsoft 365 tenant to reroute emails to different accounts. And once we discovered those rules, we were able to remove them and any configuration changes that the malicious attacker had made that then gave the customer back control over their 365 tenant. So, for the eradication process, you want to remove all malicious artifacts that you discovered through your triage, detection, and analysis process. You want to review the incident analysis and perform vulnerability remediation through all of your endpoints. Now, one thing I will recommend is even though you might have discovered what endpoints were involved in the incident, it probably behooves you to do a complete analysis and vulnerability remediation across all of your endpoints to ensure that those devices are not subjected or susceptible to those attack vectors that were used by the malicious actor.

And you really want to look at improving security controls. This is where the procurement policy piece comes in that I talked about earlier. If you need to implement new security countermeasures, if you have the policies in place for exceptions, you can go out and make those procurements and implement those new tools that harden your environment. Then the recovery piece, after you've done the eradication, meaning you've gotten rid of the malicious actors' footprints and presence in your environment, now you're going through system recovery. Depending on the size of your business, the system owner is going to have to determine when is the best time to go through that process because it might affect production.

It also depends on the extent of the incident itself. If you're dealing with, let's say, a law enforcement-related issue you're going to have to coordinate that with them because the thing that you don't want to do is get rid of pertinent evidence that can be used in the prosecution. Once you get law enforcement involved, you're more than likely headed down the prosecution route. You're going to work with your teams to determine what tests need to be run and how long those tests need to be run and you're going to develop a criteria that will indicate that the integrity of those systems has been restored so that you can then begin to resume production usage of your infrastructure. The post-incident review, you can review everything that happened in the incident up to that point.

You're going to review the timelines of all activities. You have to review all the communications that happened during that timeline. And the reason why you're doing this is because you want to see where there are any deficiencies in your process that need to be improved upon. You have to look at all the incident details and descriptions that help you to understand how effective your processes were when they were executed. You're going to look at the individuals to understand whether they had the proper skill sets to support the incident response process efficiently.

You're going to determine what areas are in your plan that you need to improve upon and then you're going to test that again just to make sure that they are properly integrated and function as you expect. Generally, this lessons learned session is probably what gets most ignored. And the reason being is because the staff are generally of the mindset that they just want to get things back up and going so that they can get back to work. It's more than likely the incident response process is going to fall on staff. With the fatigue from the late hours and the stress and pressure being applied upon them to get the systems back up and going, the last thing they want to do is sit down and do a lessons learned.

But, this isn't as valuable as the other three components of the incident response process because it helps you understand where you're deficient and what you need to do in order to shore up so that that process goes a lot more efficiently the next time you need to execute it. So, that's the preparation and the response process. Let's talk a little bit about some things that you need to do to reduce the vulnerability to cyber incidents. Here, what we've done is we've laid out the areas of focus based on the levels of maturity of your business. If you are a new or very small business with a small staff, level one items are where your focus needs to be.

So, data backup and restoration, endpoint security, network and endpoint security, privileged access management, vulnerability management, and incident response are really where your focus needs to be in order to ensure that you are being proactive, that you're putting place the right countermeasures to harden your business against the cyber attack. At level two maturity, you're looking more at operations. You're looking at management for managed detection and response. You're looking at regular recurring cybersecurity assessments to identify issues in your business and your technology infrastructure that need to be remediated. As you're adding more technology to your business as it's growing, as you're making changes to your business, you're inadvertently introducing new risks into your business.

And you want to identify that through the assessment cyber security assessment process so that you can mitigate those risks and keep your infrastructure and business operations hardened. Disaster recovery a more efficient process of recovering a business when critical recovering operations when a critical systems have been taken offline. That does require secondary systems, maybe even a secondary location. But with today's cloud infrastructure much easier to do than in the past because it's really just an allocation of separate resources to support disaster recovery. And at level three, now you're looking at more management level strategies like risk management, risk register management which is basically a listing of all the risks that have been identified in the organization and the remediation that's assigned to those risks or an acceptance.

Some risk you can accept without having to do anything about it. You will indicate that so that you can focus your team on those risks that you can accept and that you need to remediate intentionally. Governance related to strategy around cyber security as well as policy development supporting what the organization is going to do to implement the right cyber security program and operations to continuously protect the business. And then you might even look at getting a CISO, chief information security officer either in a full-time or fractional basis to help guide you through these things. And the value there is that the CISO who should understand the industry that you're in can also help you understand what regulatory requirements you have to meet to ensure that you're not exposed to any liability.

Another part of the proactive counter measures that you need to be taking doing regular vulnerability scans to identify and remediate vulnerabilities conducting your cybersecurity assessments on a bi-annual or an annual basis. One key item here is conducting security awareness for your employees on a regular basis. And what this does is this keep keeps your employees vigilant in how they use your data and your systems on a daily basis. Tools like KnowBe4, which is a very popular tool that can help facilitate canned training and assessment. I highly recommend because that as I mentioned before, your employees are the weakest link in your security operations.

And you can harden that link by taking your employees through regular awareness training. And then just being aware of the malicious insider. Those individuals that have the deep keys to the kingdom that can affect some serious damage on your business. You want to make sure that you've got countermeasures in place to prevent that from happening. We talked about working with HR for instance if you're going to be terminating that individual having compartmentalized credentials in place to prevent that individual from having complete access to your entire environment.

Those things are all useful. Online account protection, every one of us on this call has about 40 to 50 online accounts that we use or that we have used over our digital lifespan. Online accounts are one of the very easy ways that an attacker can get access to your digital life. Particularly if they're using weak credentials. You want to use MFA and have that enabled on your email accounts at the very least.

And we offer some rules, tips and guidance in the YouTube video that we put together that talk about how you can create compartmentalization and other techniques that you can use to strengthen your online accounts. Cyber liability insurance are extremely important, especially during the time of an incident from a financial perspective. Not only can they make money available to you, but they can also make resources available to you as well. Resources like forensic examiners or incident response technicians that can help you address the incident. Components of cyber liability insurance that you want to consider technology errors and omission and cyber liability are both things that you want to consider having as a part of your insurance platform.

We do we've got we are going to be offering a webinar on this later on in the year to talk in detail about cyber liability insurance and what you need to do in order to be prepared for it. So where do we go from here? We do offer a incident response planning template that you can use to help outline your incident response process. You can customize this template for your needs. I highly recommend you consult an IT or cyber security resource to help you to support you in the development of that template.

And you can consult an insurance broker about the cyber liability that we've talked about. And with that, I will open it up for questions and answers. If you when you have a moment if you would do us a favor and take this survey about this particular webinar to help us improve it as we go along in the future, that would be extremely appreciated. So I'll turn it back over to you, Stacie. Farris, thank you so much.

I have been collecting some of the questions that we've gotten in our Q&A is in our chat. There is a specific question from John, Marsha, and Brenda, but I think it's going to be covered in our upcoming webinar on May 21st, which is focused on insurance. So, just some questions around qualifying for insurance, recommendations or references or resources for some insurance, and then costs, the range of costs. Like, what does the insurance environment look like? But, as a reference for everyone, we will be covering that specific topic on May 21st, but Cyrus, if you have anything to comment on it, that would be awesome.

Yep. So, the cost of insurance varies, depends on your carrier, but the process is changing. It used to be that to qualify for cyber liability insurance, you just had to fill out a checklist. Do you have a firewall? Do you use malware software?

Do you have passwords on your accounts? Those kinds of things. And most people would check yes. But, what insurance companies were finding is that as claims were rising, they were realizing that they needed to do more due diligence to ensure that the was actually doing the due diligence to protect their environment. So, not only do you get that checklist, now you have to provide artifacts that show your password architecture or nomenclature, your firewall configuration, and your incident response plan, any vulnerability analysis that you've done on a regular basis, any policies and procedures that you have around cybersecurity.

So, you're going to have to do a lot more work in order to qualify for insurance. And that's why the last slide I recommended engaging an IT professional in cybersecurity because they can help guide you through that process. If your business is mature enough, you might want to look at getting a of some sort, fractional or full-time, that can guide you through that process to make you ready for insurance. But, insurance is a very valuable tool. It's widely available these days.

Most carriers do offer it. If you do have an incident and you don't measure up to the due diligence, you will get dropped and it'll make it harder in the future to get insurance. So, that's the climate that we're dealing with today. I recommend getting some type of IT professional to help you address the due diligence piece. Yeah, so yes, I think that's why I think understanding what those requirements are is going to be really helpful for our participants.

So, John, I hope that helps and Marsha and Brenda, Brenda had a follow-up question asking, does SOC 2 and penetration testing help their cybersecurity efforts? Absolutely. If you go through a SOC 2 assessment or penetration testing, you are definitely showing due diligence. As a matter of fact, most insurance companies are going to require you to do at least a pen test on an annual basis, not only to get insurance, but to maintain it as well. So, if you're going through either one of those, SOC 2 is a very rigorous process and assessment of the environment that shows the due diligence.

So, that's one way to do it. Penetration testing is a very technical way to go about it. I recommend both. SOC 2 is more of a paper-based assessment. Penetration test is an on-the-ground, hands-on-keyboard test of your actual infrastructure which is complimentary to the SOC 2 assessment.

Great affirmation too. I have a question in here regarding when clients are utilizing and accessing all of their software through third-parties like Zoom, Calendly, what do we need to consider in protection of our clients when those third-party platforms are included? Yeah, so the more third-party platforms you integrate into your environment, the more risk you integrate as well. Tools like Calendly are very useful for booking, but because they integrate into your office or your client your calendar client, they open up to whatever the vulnerabilities or risks are for those tools that you're opening up. And so you want to make sure that you do your research.

If there've been some previous incidents with these tools, you want to know that. Because if you are going for insurance for instance and you're exposing yourself to these tools, then you are mitigating your insurability as a result. So, do your research. It's hard to test these tools unless The only way you're really going to know is if there've been incidents that have happened and people have reported them through user reviews and things like that indicate that they've had some negative experience with those tools. So, I would do the research before you integrate those tools into the environment, tenants, or your business in any way, shape, or form, and see what their mitigation or warranties or liability are in the agreements that you would sign with them to determine whether or not you would have recourse against them if your business was impacted through a vulnerability in their tools.

And when it comes to a few questions in here, can you recommend any monitoring, reporting, and alerting tools that you would say would be most beneficial? Yeah, the most common one is a Microsoft's Sentinel SIEM tool. If you have an Azure environment, that comes with that tenant. Some of the bigger ones on the marketplace like Splunk or LogRhythm or N-able are also tools that you can use, but those are very large solutions typically meant for large organizations. The ones that I think that can be easily implemented and scaled to the business is Sentinel SIEM.

We make a tool called DataShield Analytics that can be scaled to the business as well. So, those are some recommendations that I would suggest you look at. It depends on the size of your business. You might be a Splunk or an N-able candidate. If you are, more power to you because they are very challenging to implement, but if you're not, SIEM or DataShield Analytics are tools that you can use as well that are easier and scalable to your size.

Awesome. Thank you for that. And I think we just have one more question and if anyone else has anything that you want to pop into the chat or like I mentioned, you can come off mute. I think we can push it through for maybe a couple more minutes here. Any advice on how to proceed when working with a company that has had a previous data breach?

Yeah, so the vendor risk management process is that process that you want to engage in when you're dealing with a partner company. Now, basically, the vendor risk management process is a set of steps that the partner needs to engage in to prove their due diligence and vigilance implementing the right technical procedures to ensure that they are doing everything they can possibly do to protect their environment. So, as a part of the contract that you might establish between the two parties, you want to make sure that there's a vendor risk management component to that contract that stipulates that they need to do this before the contract can be considered executed. And there are many, many ways to do that. AI can help provide some guidance in that.

You can Google it. We also offer a risk management template that you can use to guide you through the step-by-step process of establishing the right relationship between two partners. Cyrus, thank you so much for all of this valuable information. Anyone who's on the line still, if you didn't take the survey, please, I know it's such valuable information to Data Defenders and bringing such great quality content and support to all of their clients. I'm going to go ahead and attempt to copy and paste our upcoming seminars, our webinars into the chat.

So, if you have the opportunity to take note, the dates are there. So, please join us again and I just want to say thank you again to Cyrus. I can't wait for our other four sessions this year. Absolutely fantastic. I know that everybody on the line was really informed and I hope that everyone has a few great key takeaways to take on.

And this recorded, it'll be sent out and we really appreciate you so much. Thank you so much and thanks to everybody for joining us today. Thank you. Have a wonderful day. Thanks, everyone.