CMU5XX-INFOSEC

Information Security for Industry

Session 11: Incident Response & Business Continuity

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Execute the 6-phase Incident Response Lifecycle (NIST SP 800-61).
  • Formulate effective Containment and Eradication strategies during an active breach.
  • Differentiate between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP).
  • Calculate and apply Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
  • Design and facilitate a cyber crisis Tabletop Exercise.

Seminar Structure (3 Hours)

Part 1: Incident Response (1.5 hrs)
  • The Incident Response Lifecycle
  • Containment vs Eradication
  • Task 1: Active Containment Strategy
Part 2: BCP and Disaster Recovery (1.5 hrs)
  • BCP vs DRP
  • RTO, RPO, and High Availability
  • Task 2: RTO/RPO Calculation

Part 1: Incident Response

Duration: 1.5 Hours

The Reality of Breach

Assume Breach. Prevention eventually fails; your response dictates your survival.

  • Incident Response (IR): The organized approach to addressing and managing the aftermath of a security breach or cyberattack.
  • The goal is to limit damage, reduce recovery time, and costs.
  • An ad-hoc, panicked response (e.g., unplugging servers randomly) destroys forensic evidence and prolongs downtime.

The IR Lifecycle (NIST)

  1. Preparation: Writing playbooks, establishing communication channels (Out-of-Band), and training the Computer Security Incident Response Team (CSIRT).
  2. Detection & Analysis: Identifying that an incident is occurring. Triaging alerts, gathering logs, and determining scope.
  3. Containment, Eradication, & Recovery: Stopping the bleeding, removing the threat, and restoring systems.
  4. Post-Incident Activity (Lessons Learned): The most important phase. What broke? How do we prevent it next time?

Containment Strategies

The immediate priority is stopping the spread, not fixing the root cause.

  • Isolation: Disconnecting an infected subnet from the internet or the wider corporate network.
  • The Dilemma: Do you shut down the system immediately to stop data theft (destroying volatile memory evidence), or do you monitor the attacker to see what they are after (risking further data loss)?
  • Eradication: Removing malware, disabling compromised accounts, and patching the vulnerability the attacker used.

Introduction to Task 1

During an active incident, decisions must be made in minutes with incomplete information. Playbooks guide these decisions.

We will formulate a containment strategy for an active ransomware outbreak.

Task 1: Active Containment Strategy

Timing: 45 minutes

Scenario: It is 2:00 PM on a Tuesday. The Helpdesk reports that 5 users in the Accounting department cannot open their files. A screen message demands Bitcoin. The SIEM shows massive internal SMB traffic originating from Accounting.

  1. What is your immediate Containment action? Explain why you chose this over simply turning off the specific affected laptops.
  2. The CFO demands you pay the ransom immediately to get the payroll data back. As the Incident Commander, how do you respond?
  3. What Eradication steps must be completed before you allow the Accounting subnet back online?

15 Minute Break

Please return promptly for Part 2.

Part 2: BCP and Disaster Recovery

Duration: 1.5 Hours

BCP vs DRP

They are related, but distinct disciplines.

  • Business Continuity Plan (BCP): Focuses on the business. If the main office burns down, how do we process payroll? (e.g., "Everyone works from home, route calls to mobile phones").
  • Disaster Recovery Plan (DRP): Focuses on the technology. If the main data center floods, how do we restore the servers? (e.g., "Failover database to the AWS US-East region").
  • The DRP is a technical subset of the broader BCP.

RTO and RPO

The two most critical metrics in disaster recovery.

  • Recovery Time Objective (RTO): How long can the system be down before the business suffers unacceptable loss? (e.g., "The payment gateway has an RTO of 4 hours"). Determines Failover architecture.
  • Recovery Point Objective (RPO): How much data can the business afford to lose? (e.g., "We can lose 1 hour of transactions"). Determines Backup Frequency.
  • An RTO/RPO of "zero" costs millions of dollars (requires synchronous replication across multiple continents).

Tabletop Exercises (TTX)

A DRP that hasn't been tested is just a theory.

  • The TTX: A low-stress, discussion-based exercise where executives and IT leaders gather in a room and talk through a simulated disaster scenario (e.g., "A hurricane hits the data center").
  • Identifies massive gaps in the plan without risking actual downtime (e.g., "Our plan says the CEO authorizes failover, but the CEO is on a flight to Tokyo. Who has delegated authority?").

Introduction to Task 2

Aligning IT recovery capabilities with business expectations prevents catastrophic misunderstandings during an actual crisis.

We will calculate architectural requirements based on business RTO/RPO demands.

Task 2: RTO/RPO Calculation

Timing: 50 minutes

A logistics company runs a warehouse routing system. The business unit states: "If the system goes down, trucks stop moving. It must be back online within 2 hours. However, because routes are printed on paper hourly, we can afford to lose up to 12 hours of digital routing data if necessary."

  1. Identify the RTO and the RPO from the statement above.
  2. The IT team currently backs up the system to tape every night at midnight. The tape takes 6 hours to restore. Does this meet the RTO? Does it meet the RPO? Explain.
  3. Propose a new technical backup/recovery architecture (e.g., Cloud Snapshots, Active-Passive failover) that strictly meets both requirements.

Summary & Next Steps

  • Incident Response is about structured, rehearsed decision-making under extreme pressure.
  • Disaster Recovery is a business discussion first, and a technical architecture discussion second. The business defines the RTO/RPO; IT builds to it.
Next Week: Compliance, Laws, and Auditing (Regulatory Requirements)