Planning beyond the 72-hour window and building long-term resilience after IR cases
Synopsis
When an incident occurs we put 100% of our focus into putting out the fire. Efforts toward investigation, containment, and initial recovery start to occur within the first three days of detection. But what happens next?
Our focus on "firefighting" without a long-term view of our remediation and recovery process can often lead to dangerous blind spots when it comes to building cyber resilient program.
In this session we'll explore best practices for what happens before, during, and AFTER an event with a special emphasis on post-event forensics and investigation and cyber risk exposure management.
While organizations invest heavily in IR tools and services, the processes necessary in the following weeks and months ultimately determines true recovery or risks the potential for repeat compromise or APT activity. Drawing from real-world incident response cases and lessons learned, I'll demonstrate step-by-step how to balance post-event investigation with active incident response management including...
1. Baselining on the post-incident gap in common security practices — analyzing common patterns of failure, including pre-mature attribution and confirmation, insufficient RCA, and failure to address systemic risk categories including misconfigurations and vulnerabilities.
2. Introducing a structured framework for building long-term resilience after major security events — value of real-time cyber risk scanning and reporting, prioritization matrix for implementing operational remediations, where and how to leverage in-line and out-of-band network telemetry, advanced RCA methodologies, metrics and KPIs, and building an internal culture of implementing improvements derived from incident findings.
As the cybercriminal underground evolves to support distributed monetization models (i.e. initial access brokers), adversaries prioritize speed, and nation-state actors become craftier and more aggressive toward both private/public enterprise and federal entities, getting in front of cyber risk and learning from past IR cases is critical to maintaining a secure organization for your stakeholders, shareholders, staff, and customers/users.
In short: This is an incident response best practice session tailored toward cybersecurity operations leaders looking for guidance to 'complete the work' after an event.