CYT200_Rajankumar Patel_A5 Presentation.pptx

NIST Cybersecurity Incident Response Plan

1. Trainer: Rajankumar Patel Framework for Effective Incident Management NIST INCIDENT RESPONSE PLAN TRAINING 01 Trainer: Rajan Patel (Cyber Analyst) @Lambda-CRO

2. Trainer: Rajankumar Patel 02 Introduction What Is a Cybersecurity Incident Response Plan? A w r it t e n an d s ys t e m at i c a p p r o ach t h at establishes procedures and documentation. Incident Response Policy Can include items such as: Guidelines Roles and responsibilities Communication plans Standard Protocols Incident Response Teams Teams Plans Policy

3. Trainer: Rajankumar Patel 03 Introduction What is the NIST Cybersecurity Incident Response Plan? Definition: A comprehensive framework provided by NIST to guide organizations in effectively managing and responding to cybersecurity incidents. Purpose: Establish a structured approach for identifying, managing, and mitigating cybersecurity incidents. Scope: Applicable to organizations of all sizes and across all industries, ensuring a standardized approach to incident response.

4. Regulatory Impact 04 Importance of Incident Response Plan Regulatory Impact Business Impact Technical Impact Compliance Helps organizations meet regulatory requirements and industry standards for incident response. Operational Continuity Minimizes disruptions and downtime caused by incidents. Reputation Management Protects organizational reputation by managing incidents effectively. Rapid Response Enables quick detection and containment of security incidents. Improved Security Posture Enhances overall security measures through continuous monitoring and response improvements.

5. Trainer: Rajankumar Patel 05 NIST Incident Response Lifecycle NIST Special Publication (SP) 800-61 Revision 2 “Computer Security Incident Handling Guide” outlines the principles and steps for developing an Incident Response Plan. The NIST Incident Response Plan provides detailed guidelines for organizations. The objective is to minimize the overall impact of cyber incidents. Facilitate the recovery of operations The Incident Response Lifecycle – 4 Key Elements Preparation and Planning; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activities Many incident response plans align with this lifecycle Source: Swimlane

6. Trainer: Rajankumar Patel 06 Preparation Phase The initial part of the lifecycle provides an opportunity for training, obtaining tools, and gathering resources while working towards preventing incidents through risk assessments. Identifying Assets and Risks : Can include hardware, software, networks, and personnel Creating specialized response teams Identifying tools and resources needed NIST recommends classifying incidents based on severity and impact. Organizations can tailor response strategies to be more effective.

7. Trainer: Rajankumar Patel 07 Detection and Analysis Phase This phase involves identifying potential security incidents and analyzing them to understand their nature and scope. Implement monitoring tools like IDS/IPS, SIEM, and threat intelligence. Set up automated alerts for suspicious activities. Perform an initial assessment to evaluate the nature and scope of the incident. Collect and preserve evidence for further investigation. Categorize incidents based on severity and impact to tailor response strategies.

8. Trainer: Rajankumar Patel 08 Containment, Eradication, and Recovery This phase focuses on limiting the impact of the incident, eliminating the threat, and restoring normal operations. Short-Term Containment Implement immediate actions to limit the impact, such as isolating affected systems. Long-Term Containment Develop strategies to prevent recurrence, like applying patches or updates. Malware Removal Remove malware and other malicious components from affected systems. Scanning Conduct thorough scans to ensure all threats are eliminated. System Restoration Restore systems to normal operation by reinstalling software, applying patches, etc System Validation Validate that systems are functioning correctly and securely.

9. Trainer: Rajankumar Patel 09 Post-Incident Analysis Phase Post-incident activities are one of the most important parts of the incident response lifecycle, but unfortunately , it is one of the most neglected. One of the most important parts of incident response Provides an opportunity to discuss threats, technology, and lessons learned Benefits improving security measures and handling processes Meetings can cover multiple incidents

10. Trainer: Rajankumar Patel 10 Case-Study: Capital One Data Breach In 2019, Capital One experienced a data breach, exposing over 100 million customer records due to a vulnerability in a web application firewall Revised incident response policies were introduced to enhance resilience, and improved security measures were implemented to prevent and detect future breaches Detection through internal monitoring led to immediate containment. The vulnerability was patched, and systems were restored

11. Trainer: Rajankumar Patel 11 References Cichonski , P., Millar, T., Grance , T., Scarfone , K., National Institute of Standards and Technology, United States Computer Emergency Readiness Team, & Scarfone Cybersecurity. (2012). Computer Security Incident Handling Guide. In NIST Special Publication 800-61 (Revision 2). https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf 2019 Capital One Cyber incident | What happened | Capital One. (n.d.). Capital One. https://www.capitalone.com/digital/facts2019/ Khan, S., Kabanov, I., Hua, Y., & Madnick , S. (2022). A Systematic analysis of the Capital One data breach: Critical Lessons learned. ACM Transactions on Privacy Security, 26(1), 1–29. https://doi.org/10.1145/3546068 NIST Incident Response: Your Go-To Guide to Handling Cybersecurity Incidents | AuditBoard . (n.d.). AuditBoard . https://www.auditboard.com/blog/nist-incident-response/

12. 12 Please feel free to ask any questions you may have Mr. Rajan Patel [email protected] Senior Cyber Analyst