IH - Step 2 - Module 8 Powerpoint Presentation.pptx

IH - Step 2 - Module 8 Powerpoint Presentation.pptx

1. Dr. Kevin F. Streff Founder and Managing Partner 1 Incident Handler Certification

2. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 2

3. Agenda 3 Module 1 Incident Response Overview Module 2 Incident Response Laws and Regulations Module 3 The Fit of Incident Response in Information Security and Privacy Programs Module 4 Privacy Incidents Module 5 Security Incidents Module 6 Incident Response Program Overview Module 7 Step 1 - Preparation Module 8 Step 2 - Detection and Analysis Module 9 Step 3 - Contain, Eradicate, and Recover Module 10 Step 4 - Post Incident Activity Module 11 Incident Response Testing Module 12 Third Party Incident Response Requirements Module 13 Incident Response Auditing Module 14 Incident Response Metrics

4. Module 8 Incident response programs – Step 2 Detection and analysis 4

5. NIST SP-800-61 National Institute of Standards and Technology Computer Security Incident Handling Guide NIST Special Publication SP 800-61

6. Types of security incidents (samples) Denial of Service Incident Malicious Code Incident ACH Fraud Wire Fraud Merchant Capture Incident Debit Card Fraud Unauthorized Access Incident Inappropriate Usage Incident Physical Security Breach

7. Types of privacy incidents (samples) Incorrect disposal of hardware Data emailed to incorrect recipient  Data of wrong data subject shown in client portal  Data posted or faxed to incorrect recipient  Failure to redact  Failure to bcc  Hardware/software misconfiguration  Incorrect disposal of paperwork  Loss/theft of device containing personal data  Verbal disclosure of personal data  Unauthorized data aggregation Violating primary use requirement

8. Triage Event (something happened) Incident (Violation of policy, law or regulation) 2) Determine root cause 3) Assess severity/impact

9. Triage Event (something happened) Incident (Violation of policy, law or regulation) Cyber triage best practices include:  establishing standardized protocols, leveraging threat intelligence to prioritize alerts, automating repetitive tasks, incorporating AI and machine learning for faster analysis, regularly updating detection rules, training analysts on emerging threats, and continuously improving processes to adapt to evolving cyber threats

10. Triage Event (something happened) Incident (Violation of policy, law or regulation) Use both human and technical mechanisms to detect incidents Need partners who can alert you of incidents Need a monitoring capability Need a process to review logs

11. 2) Determine root cause Leverage your resources Leverage subject matter experts Review holistically CVE database How did it start?

12. 3) Assess severity/impact Assess what systems are affected Assess what business processes are affected

13. 13

14. Module 8 Summary People and technology work together to detect incidents The earlier an incident is identified the less damage it is likely to cause The IRT must analyze quickly so that a response can be formed 14

15. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 15 American Security and Privacy, LLC