CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection            9  3.4.4  Incident Response

Role of IDS in Incident Response 1 Reporting Incidents to Third Parties

The NSWC Dahlgren Computer Security Incident Handling Guidelines³⁴⁵ describe incident response as a six-step process:

1. Preparation: Setting up systems to detect threats and policies for dealing with them, including identifying roles staff will play in incident response, and creating emergency contact lists.
   
   
2. Identification: Identifying what the threat is, and/or the effects it is having on your systems/networks, including keeping records of the time/systems involved/what was observed, and making a full system backup as soon after the intrusion was observed, as possible, to preserve as much information about the attack as you can.
   
   
3. Containment: Limiting the effects of an incident by confining the problem to as few systems as possible, freezing the scene so that nothing further happens to the compromised system(s) by disconnecting its network connections and possibly console keyboard.
   
   
4. Eradication: Getting rid of whatever the attacker might have compromised by deleting files or doing a complete system reinstall – we cannot stress enough that you should err on the side of deleting MORE rather than less in order to restore a system to production, since the intruder may have left very-well-disguised Trojan Horse binaries around the system, to be activated once the system is reconnected to the Internet.
   
   
5. Recovery: Getting back into business, by putting the system back into normal operations, reconnecting it to the network, restoring from backups if necessary, etc.
   
   
6. Follow-up: If possible, tightening security so that the intrusion cannot happen again, determining the “cost” of the intrusion based on staff time/lost data/lost user work time (don’t skip this! It may help justify security expenditures in the future), considering which, if any, additional tools might have helped handle the incident better than it may have been handled, reflecting on “lessons learned” from both the intrusion and the organization’s response to it and tweaking policies as required.

SANS offers an incident response publication dealing with these 6 major phases, in detail³⁴⁶.

The very first thing to do is to secure access to the involved devices, to protect against further damage and to assist with preservation of evidence. The critical theme is to not destroy evidence by changing anything! Legal cases have been hampered, and even destroyed, by well-meaning system administrators “doing the wrong thing” in the name of “preservation of evidence.” Report any suspicious incidents to upper management.

Role of IDS in Incident Response 1 Reporting Incidents to Third Parties