| Acknowledgments |
|
xv | |
| Introduction |
|
xv | |
|
Part I The Threat Landscape |
|
|
|
Chapter 1 Introduction to Planning and Crisis |
|
|
3 | (14) |
|
|
|
5 | (2) |
|
|
|
7 | (6) |
|
|
|
7 | (1) |
|
|
|
8 | (1) |
|
|
|
9 | (1) |
|
|
|
9 | (1) |
|
|
|
10 | (1) |
|
Maintaining the Initiative |
|
|
10 | (1) |
|
Tactical, Operational, and Strategic Perspectives |
|
|
11 | (1) |
|
Requirements-Driven Execution |
|
|
11 | (1) |
|
|
|
12 | (1) |
|
Military Decision-Making Process |
|
|
12 | (1) |
|
A Plan Is Preparation Manifested |
|
|
13 | (4) |
|
Anticipation: Objectives and Requirements |
|
|
14 | (1) |
|
Collaboration: Socialization and Normalization |
|
|
14 | (1) |
|
Research: The Availability of Relevant Information |
|
|
14 | (1) |
|
The Ad Hoc Organization for Time of Crisis |
|
|
15 | (1) |
|
The Value of Documentation |
|
|
15 | (2) |
|
Chapter 2 Cyber Due Diligence in an Era of Information Risk |
|
|
17 | (18) |
|
|
|
18 | (4) |
|
Gramm-Leach-Bliley Act (Financial Services Modernization Act of 1999) |
|
|
19 | (1) |
|
The Health Insurance Portability and Accountability Act of 1996 |
|
|
19 | (1) |
|
Sarbanes-Oxley Act of 2002 |
|
|
20 | (1) |
|
State Breach Requirements |
|
|
20 | (1) |
|
|
|
21 | (1) |
|
Federal/State Enforcement |
|
|
21 | (1) |
|
|
|
22 | (1) |
|
|
|
22 | (3) |
|
|
|
23 | (1) |
|
|
|
23 | (1) |
|
|
|
24 | (1) |
|
Service Organization Controls |
|
|
24 | (1) |
|
|
|
24 | (1) |
|
How Do I Know that I'm Doing the Right Thing? |
|
|
25 | (1) |
|
|
|
25 | (1) |
|
|
|
25 | (1) |
|
|
|
26 | (1) |
|
|
|
26 | (1) |
|
|
|
27 | (1) |
|
ISO/IEC 27005 (Information Security Risk Management) |
|
|
27 | (1) |
|
|
|
27 | (1) |
|
|
|
27 | (8) |
|
|
|
28 | (1) |
|
|
|
28 | (1) |
|
|
|
28 | (1) |
|
|
|
29 | (1) |
|
|
|
29 | (1) |
|
Measurement and Monitoring |
|
|
30 | (1) |
|
|
|
30 | (1) |
|
Calendar for Testing Processes and Controls |
|
|
30 | (1) |
|
|
|
31 | (1) |
|
|
|
31 | (4) |
|
Part II Planning for Crisis |
|
|
|
Chapter 3 Getting More Out of Your Plans |
|
|
35 | (6) |
|
Proactively Using Plans During Period of Heightened Risk |
|
|
36 | (1) |
|
Understanding How Your ISOC Works |
|
|
37 | (1) |
|
Building Relationships Outside of IT |
|
|
38 | (1) |
|
Leveraging Your CIRP to Develop Relationships with Law Enforcement |
|
|
38 | (2) |
|
Using Plans to Augment Your Current ERM Efforts |
|
|
40 | (1) |
|
Chapter 4 Writing Your Computer Incident Response Plan |
|
|
41 | (10) |
|
What Problem Are You Solving? |
|
|
42 | (1) |
|
Don't Bother if You Don't Have an Executive Sponsor |
|
|
42 | (1) |
|
Using an Advisory Committee: My Plan vs. Our Plan |
|
|
43 | (1) |
|
Understanding Your Audiences |
|
|
44 | (1) |
|
Leveraging the Table of Contents |
|
|
44 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (1) |
|
Incident Detection, Analysis, and Declaration |
|
|
46 | (1) |
|
|
|
47 | (1) |
|
Plan Maintenance/Post Incident |
|
|
47 | (1) |
|
Development of an Ad Hoc Organization to Respond to Crisis |
|
|
48 | (3) |
|
Part III Plan Development: Data Breach |
|
|
|
Chapter 5 Your Data Breach CIRP: Incident Preparation |
|
|
51 | (28) |
|
|
|
54 | (2) |
|
|
|
56 | (1) |
|
|
|
56 | (1) |
|
Plan Scope and Assumptions |
|
|
56 | (1) |
|
Plan Execution and Command Topologies |
|
|
57 | (2) |
|
|
|
59 | (2) |
|
Updating and Synchronization |
|
|
60 | (1) |
|
|
|
61 | (1) |
|
Statutory/Compliance Framework |
|
|
61 | (1) |
|
|
|
62 | (1) |
|
PCI Data Map (End 1) **RESTRICTED** |
|
|
62 | (1) |
|
ISOC Threat Portfolio (PCI) (Tab B) **RESTRICTED** |
|
|
62 | (1) |
|
|
|
62 | (1) |
|
Third-Party (Payment) Connections (Tab D) |
|
|
62 | (1) |
|
|
|
63 | (7) |
|
PCI Forensic Investigator (PFI) |
|
|
63 | (1) |
|
Identity Protection Services |
|
|
63 | (1) |
|
Compromise Notification Fulfillment |
|
|
64 | (3) |
|
Sources of Precursors and Indicators |
|
|
67 | (3) |
|
|
|
70 | (3) |
|
|
|
70 | (1) |
|
|
|
71 | (1) |
|
|
|
71 | (1) |
|
|
|
71 | (1) |
|
|
|
72 | (1) |
|
|
|
73 | (2) |
|
|
|
73 | (1) |
|
|
|
74 | (1) |
|
Non-Actionable/Informational |
|
|
74 | (1) |
|
|
|
75 | (4) |
|
Incident Notification and Mobilization |
|
|
75 | (3) |
|
|
|
78 | (1) |
|
Chapter 6 Your Data Breach CIRP: Plan Execution |
|
|
79 | (32) |
|
|
|
80 | (6) |
|
|
|
80 | (5) |
|
|
|
85 | (1) |
|
Synchronization and Decision-Making |
|
|
86 | (3) |
|
|
|
86 | (3) |
|
Mandatory Reporting/Notification(s) |
|
|
89 | (3) |
|
Payment Card Industry Data Security Standard (PCI DSS) |
|
|
89 | (3) |
|
Release of "Public-Facing Documents" |
|
|
92 | (4) |
|
Draft/Approve/Release Process |
|
|
93 | (1) |
|
Public-Facing Documents Participants |
|
|
94 | (2) |
|
Evidence Discovery and Retention |
|
|
96 | (2) |
|
|
|
96 | (1) |
|
|
|
97 | (1) |
|
|
|
97 | (1) |
|
Liaison with Local Law Enforcement |
|
|
98 | (2) |
|
XYZ Loss Prevention (LE Liaison) |
|
|
98 | (1) |
|
Law Enforcement Points of Contact (POC) (Tab 1) |
|
|
99 | (1) |
|
Incident Containment, Eradication, and Recovery |
|
|
100 | (2) |
|
The XYZ (Data Compromise) CIRP SWAT Team |
|
|
100 | (1) |
|
|
|
100 | (2) |
|
|
|
102 | (2) |
|
|
|
102 | (1) |
|
|
|
102 | (2) |
|
Disaster Recovery/Business Continuity |
|
|
104 | (1) |
|
CIRP Roles and Responsibilities |
|
|
104 | (7) |
|
|
|
105 | (6) |
|
Chapter 7 Your Data Breach CIRP: Post Incident Planning and Maintenance |
|
|
111 | (12) |
|
|
|
112 | (2) |
|
|
|
112 | (2) |
|
|
|
114 | (1) |
|
|
|
114 | (1) |
|
|
|
115 | (8) |
|
Verification/Updates of Perishable Data |
|
|
115 | (1) |
|
Annual Testing of the Plan |
|
|
115 | (8) |
|
Part IV Plan Development: Malware |
|
|
|
Chapter 8 Your Malware Outbreak CIRP: Incident Preparation |
|
|
123 | (20) |
|
|
|
125 | (2) |
|
|
|
127 | (1) |
|
|
|
127 | (1) |
|
Plan Execution and Command Topologies |
|
|
128 | (2) |
|
|
|
130 | (2) |
|
|
|
130 | (2) |
|
|
|
132 | (3) |
|
Isolotion Points within the XYZ Enterprise |
|
|
133 | (1) |
|
Business Impact Overlay of Isolation Points |
|
|
133 | (1) |
|
|
|
133 | (2) |
|
Third-Party Support Services |
|
|
135 | (1) |
|
PCI Forensics Investigator (PFI) |
|
|
135 | (1) |
|
BXD LongSight Threat Management System |
|
|
135 | (1) |
|
Incident Detection, Analysis, and Declaration |
|
|
135 | (2) |
|
Sources of Precursors and Indicators |
|
|
135 | (1) |
|
|
|
136 | (1) |
|
Field Services Responding to Malware Calls |
|
|
136 | (1) |
|
NOC, Service Desk, and Other Internal Sources of Detection |
|
|
136 | (1) |
|
|
|
137 | (1) |
|
|
|
137 | (1) |
|
|
|
137 | (1) |
|
|
|
138 | (1) |
|
|
|
138 | (4) |
|
Incident Notification and Mobilization |
|
|
139 | (3) |
|
|
|
142 | (1) |
|
Chapter 9 Your Malware Outbreak CIRP: Plan Execution |
|
|
143 | (16) |
|
|
|
144 | (7) |
|
|
|
144 | (7) |
|
|
|
151 | (1) |
|
|
|
152 | (1) |
|
|
|
153 | (6) |
|
Synchronization and Decision Making |
|
|
153 | (6) |
|
Chapter 10 Your Malware Outbreak CIRP: Post Incident Planning and Maintenance |
|
|
159 | (6) |
|
|
|
160 | (2) |
|
Criteria for Terminating an Incident |
|
|
160 | (2) |
|
|
|
162 | (3) |
|
|
|
162 | (1) |
|
|
|
162 | (1) |
|
Annual Testing of the Plan |
|
|
163 | (2) |
|
Chapter 11 Closing Thoughts |
|
|
165 | (18) |
|
New Age for InfoSec Professionals |
|
|
166 | (1) |
|
Paradigm #1 The New Consciousness of the Zero-Day Attack |
|
|
167 | (5) |
|
Paradigm #2 The Need for Transparent Due Diligence |
|
|
172 | (1) |
|
Paradigm #3 Consequence-Based Information Security |
|
|
173 | (2) |
|
Paradigm #4 The Constant Challenge of Change |
|
|
175 | (2) |
|
Paradigm #5 While We're All Focusing on the Silicon-Based Systems, the Bad Guys Are Targeting the Carbon-Based Ones |
|
|
177 | (6) |
|
|
|
|
A Useful Online Resources |
|
|
183 | (4) |
|
B Computer Incident Response Plan (CIRP) Management Checklist |
|
|
187 | (2) |
| Glossary |
|
189 | (12) |
| Index |
|
201 | |