A Cyber Security Incident Response Team

The trusted computing base (TCB) internal network in the Global Finance, Inc. Network Diagram hosts the company’s mission critical systems without which the company’s operations and financial situation would suffer. The Oracle database and email systems are among the most intensively used application servers in the company. As we know, GFI cannot afford system outages because its cash flow and financial systems heavily depend on the network stability. GFI has experienced DOS network attacks twice this year and its Oracle database and email servers had been down for a week. The recovery process required GFI to use $25,000 to restore its operations back to normal. GFI estimated the loss from these network attacks at more than $100,000 including lost customer confidence.

During this course there have been a number of key learning points that would help every organization protect itself from a cyber-event. These include password management, patch management, security policies, encryption, and user training. In each of the cyber security breaches one or more of these standard security protocols were not used.

The world of cyber security continues to introduce new threats each year against network infrastructures and computer devices. In the recent years, the impact from cyber-attacks has wreaked havoc on many company brands and organizational reputations. As this issue grows so does the technology to prevent and protect against these malicious attacks. It is absolutely crucial for organizations and businesses to shift focus from defense for different types of attacks to improving safeguards to mitigate the loss of sensitive data when an attack occurs. In addition to the traditional security technology used to detect an attack, companies will have to include

Under the new Appendix J’s Business Continuity Plan (BCP) cyber resilience guidelines, credit unions and their third-party service providers need to consider and incorporate the potential impact of a cyber-event. FFIEC notes five categories of cyber risks credit unions and their third-party service providers will need to address when updating their BCPs: 1) malware, 2) insider threats, 3) data or systems destruction and corruption, 4) communication infrastructure disruption, 5) and simultaneous attack on financial institutions and technology service providers. Below is a brief description of the five categories and FFIEC’s recommendations:

Attacks or intrusion attempts on banks’ computer and network systems are major concern. Studies show that systems are more vulnerable to internal attacks than external, because internal system users have knowledge of the system and access. Banks should have sound preventive and detective controls to protect their Internet banking systems from exploitation both internally and externally.

At the beginning of the cybersecurity capstone simulation, we sat down as a team to go over the assignment and understand the Mistral Bank, which is one of the largest financial sector of the world. In addition, we went over all security controls that are included in the simulation. We then assigned each team members with a role in Mistral Bank executive management team. Table 1 below shows Mistral Bank organization structure:

Following is a summary of the security breach at Corporation Techs. As soon as the breach was detected the firewall logs were reviewed and confirmation of the security breach was documented. The IT group had a meeting to administrator the corrective action. The incident was isolated and then the damaged was assessed. The goals of the incident response were to minimize downtime, minimize loss, and restore the environment back to a secured normal state as quickly as possible. We followed six primary steps to conclude. The steps included,

Given the test results, the organization selected Cb Response as its new security solution. With Cb Response, the organization quickly remediated all 600 compromised machines. The organization also found that Cb Response enables it to accelerate root cause identification by 75%. In addition, the company is now doing 90% of their protection with six Cb Response watchlists. Implementing Cb Response helped the organization successfully remediate an immediate issue so it could return to normal daily productivity. It now has faster and more reliable threat response, along with a reduced workload for the IT

By using the recommended security strategies, an alternative outcome demonstrates how they may have stopped or mitigated the attack. A risk-based method to security would have involved examining threats and weaknesses for all systems on a routine basis to control high-risk systems. Prioritizing threats would have helped establish which Critical Controls to implement first based on probable harm to the business. Risk analysis would have assisted the company establish which Critical Controls to apply first. Use of the Critical Controls to implement a stronger Defense in Depth strategy may have blocked the cybercriminals at different points before they reached the credit card data. Even if Target had not used every single control listed, one or

A Computer Incident Response Team usually investigates and resolves incidents related to computer security. A CIRT process includes isolating the compromised system, preserving evidence, forming CIRT team, cleaning up the incident, notifying the authorities and evaluating how the situation was handled.

Now that we have discussed how to protect against malware and other numerous threats it is just as equally important that a good plan is in place when systems or network in general become compromised. First at foremost if you think a compromise or incident has occurred the affected systems must be taken offline immediately, this is going to reduce any further compromise. Next I would highly recommend notifying the Computer Security Incident Response Team (CSIRT), a CSIRT team is an organization that receives security incident reports and providing a detailed analysis on the said report then relays that information to the sender. A CSIRT will provide 24/7 service to any user, service, company, or organization. The great thing about CSIRT is

Greiblock Credit Union (GCU) financial firm should always test and update software regularly, and perform, backup to all systems. It’s imperative the organization expands on new tools that are able to acquire different devices. Different cases and incidents should be handled accordingly as they arise, or a prediction of what may occur in the future. Greiblock Credit Union (GCU) financial firm should be prepared and innovative in the technology world and cyber security environment, so that they can mitigate risk, and reduce the reoccurring issues and fraud. Greiblock Credit Union (GCU) financial firm should maintain databases for file hashes OS and application deployments along with maintaining

Cyber Security Operations Centre (CSOC) investigates and analysis cyber-attacks on UK Networks and provide solutions and means to mitigate future attack. Its job is in cyber forensics and incident response while the Government Computer Emergency Response Team (GovCERT) deals with the public sector organisations on issues relating to computer security incidents, warnings, alerts, assistance and advice to prevent, reduce expose and mitigate attacks.

1 What are the procedures incase of an attack. We should write a well-developed cyber incident response plan that includes all the protocols to responses. Our plan should generally have these following components, such as response team, reporting, initial response, investigation, recovery and follow up, public relations, and law enforcement. The job of the response team is to develop cyber incident response plan and for investing and responding to cyber attack. They will identify and classify cyber attack sceneries, and figuring out what tools and technology will be used to detect the attack. Determined the scope of the attack and internal investigation. Lastly, address the data breach and conduct follow reviews. Second, The cyber incident response plan should address procedures to take on discovery and reporting of cyber attack incidents. For example, set up team to monitor industry practices, checking if all the system are updated and patched. Non-stop monitoring the system activity and computers logs to see any incidents, than recorded it in a track log for later use. Third, if there was a report of a cyber attack, the response team should start their investigation whether the attack had occurred. The response team should quickly stop the attacker right away and stop the spreading further into the companies computers system. After doing that they should document what they have done and the incident. Forth, investigating the cyber security we need to construct internal

A group of individual’s part of the CISRT team called members will be responsible to handle responsibility of the incident and will monitor different areas of the company. Other members of this team should include Legal help, public relations officers, contractors and other member of management both from business and IT that can help during security breaches.