A Weekend in Incident Response #6: Improving Digital Skills of Police Forces Should Be a Top Priority for Governments

With cyber-crime on the rise globally, it’s clear that law enforcement agencies around the world need to raise their level of cyber-security preparedness so that they can respond to this growing threat accordingly. But, it seems that improving their own digital skills has turned out to be a tough challenge for some police forces.

A recent report by England-based Her Majesty’s Inspectorate of Constabulary (HMIC) shows that the police officers in England and Wales are having trouble coping with the increased amount and complexity of cases involving cyber-crime.

Digital Forensic Capabilities Must Be Improved

The report finds that several police forces in England and Wales show a severe lack of digital skills that are needed to solve modern crimes. Specifically, investigators have proven to be insufficiently prepared to gather and process digital evidence, which is one of the crucial aspects of cyber crimes.

Another challenge that is underscored in the report is the fact that police forces are having difficulties understanding how different IT systems work, and how they can retrieve and share data between different systems.

Automated Case Management is One of the Solutions

Considering the significant gap in digital skills among police officers that the report notes, it’s clear that law enforcement agencies could use a tool that can help them overcome these challenges.

There are solutions that can be employed to make investigations into cyber incidents more efficient and help alleviate the problem of not being able to retrieve and process digital evidence properly. There are platforms that can track digital evidence and entire investigative processes automatically, helping to accelerate the investigation into a cyber incident.

A platform that is capable of gathering and managing information during cyber forensics processes, can make police forces much more efficient and prepare them for the challenges that are an inseparable part of modern crimes.

In order to be able to solve cyber crimes, police forces need to employ platforms that provide integrated support for cyber forensic tools, in addition to an integrated knowledge base access, as solutions that can help offset investigators’ lack of digital skills.

A Weekend in Incident Response #5: Reducing the Risks of Cyber Attacks in the Healthcare Sector

The healthcare industry is under a constant threat of cyber attacks, mostly due to the fact that organizations within this sector keep a variety of confidential and pertinent information, such as credit card information, social security numbers, insurance-related information, and some believe most importantly personal medical records.

A recent report states that healthcare entities have been under increased risk of targeted attacks lately, including phishing attacks, ransomware attacks, and network hacking attacks. The heightened risk for cyber attacks points to a growing need for enhanced protection, in addition to raising awareness of the different types of cyber attacks that many healthcare organizations are facing.

Healthcare Surpasses Financial Sector as the Most Frequently Attacked Industry

According to data provided by Advisen and Hiscox, the average cost of a cyber incident in the healthcare industry cost $150,000. A recent report published by IBM states that the healthcare industry was attacked more frequently than any other sector last year, replacing the financial services sector at the top. According to the report, over 100 million healthcare records were compromised in 2015, which is a staggering figure by all standards.

The Advisen and Hiscox report also notes that there has been a 1.6-times increase in Health Insurance Portability and Accountability Act (HIPAA) violations in the last five years. This statistic suggests that entities such as hospitals and clinics, need to ramp up their efforts for ensuring HIPAA compliance because it is one of the key steps toward achieving improved protection against cyber attacks.

Detecting Ransomware and Phishing Attacks

Currently, the most common cyber threats faced by healthcare entities include phishing attacks and ransomware. These are the most commonly used techniques by hackers trying to retrieve confidential patient information that is critical to protect. The best practices for preventing such threats involve data encryption tools, which are recommended for all covered entities.

Another solution that can be useful to healthcare organizations is a software that can create rules and can be integrated with different tools that can be adjusted in a way that allows them to automatically detect and report problems. Platforms with such capabilities should be a crucial part of each entity’s cyber defense efforts.

How to React in Case You Are Attacked

Even though there are tools designed to detect and prevent ransomware and phishing attacks, hackers often manage to find a way to go around all sorts of defenses and breach even the most sophisticated security armors. When that happens, organizations must be prepared to react as quickly and as effectively as possible with a proven solution.

To that end, all covered entities, including healthcare organizations, need to have a Computer Security Incident Response Team (CSIRT) in place. In order to help their CSIRT resolve cyber incidents, entities are advised to acquire platforms that have the ability to automatically notify CSIRTs when a cyber attack occurs, be it via e-mail or SMS, and gather a team of investigators to do the forensics on a given incident.

Incident Response platforms featuring specialized playbooks are also necessary for tackling healthcare-related incidents. They are the most indicated tool for resolving cyber incidents fast and efficiently, through their ability to accelerate the incident triage process, integrate with forensics and response systems, and predict similar events in the future. Some of those platforms (SIRPs) are also able to provide playbooks for vertical regulation, such as HIPAA and similar.

A Weekend In Incident Response #4: How to Reduce the Noise of Cyber Threat Intelligence

Is Cyber Threat Intelligence Still Useful?

The importance of information in business in today’s modern world is invaluable. But, in some cases, having large amounts of information coming your way can actually hurt your business. This holds true particularly for organizations that are constantly dealing with the risk of cyber attacks, and every piece of information that could help them prevent those attacks can be of great use to them. This is where cyber threat intelligence comes in, as one of the crucial aspects of developing an effective cyber defense strategy.

But, with so many feeds from various sources at their disposal, determining which information is relevant and credible and distinguishing it from the data that is not essential in regard to a potential cyber threat has become a major challenge for many cyber security professionals. As a result, being able to reduce the noise coming from the flurry of threat intelligence is now key to creating successful security operations.

Overwhelming Amount of Cyber Threat Information

A new study recently conducted by Ponemon Institute LLC, and sponsored by Anomali, reveals that the amount of threat intelligence that cyber security professionals deal with is overwhelming, preventing them from tackling incidents more efficiently.

The study, titled The Value of Threat Intelligence: A Study of North American and United Kingdom Companies, surveyed more than 1,000 professionals from the cyber security industry, with 70 percent of them saying that threat intelligence is often “too voluminous and/or complex to provide actionable intelligence”. This is a figure that should raise a concern, considering that almost half of the respondents (46%) said that incident responders rely on threat data during the incident response process. Furthermore, according to the study, there is too much data to really make sense of if enterprises have a limited resource staff of security operations center analysts or threat analysts.

SIEM Integration Vs IR Orchestration

Cyber security experts agree that in order to be able to use cyber threat intelligence data in an effective and productive way, there must be an SIEM integration in place. However, while 62% of those surveyed said they were aware of this necessity, as many as 64% of them stated that putting such integration in place takes a lot of time and resources, making it a tough feat.

In my corporate experience, the companies that are actually integrating SIEM with CTI, represent a minority. The main challenge of such lack of integration is the impossibility of valorizing the TI Feeds, during an incident. But, there is a new technology trend that addresses this exact problem. There are platforms that are capable of sitting on top of the SIEM, integrating multiple tools from different vendors, which is one of the biggest challenges that threat analysts are faced with. This approach is usually taken during the incident triage phase, it is not intended to be a SIEM replacement but can help SOC and CSIRTs to reduce reaction time and related noise. Such platform fits the Incident Response and SOC Orchestration space, featuring multiple integrations that are easy to use and configure and, nowadays, are probably the only way to reach a near real time- and money-saver incident response, filling the gap that is created when the data sources are originated by different vendors. Such platforms support SIEM integration and could represent a great solution for all entities that are trying to create a successful and affordable cyber defense, by effectively reducing the noise of threat intelligence.

In one of my next columns, I will introduce this paradigm, along with its main potentials in the world of Security Operations and Incident Response. In the meanwhile, you can follow me on our LinkedIn Page, by clicking here.

DFLabs Presents on “Standardizing Data Breach Response” at Data Privacy Asia 2016

DFLabs previews new cyber incident response playbook for Asian regulatory environment

Boston – November 7, 2016DFLabs, the global leader in cyber incident response automation and orchestration, announced today its Vice President of Engineering, Andrea Fumagalli, will present on “Standardizing Data Breach Response: State of the Art” at Data Privacy Asia 2016, to be held November 9-11 in Singapore at the One Farrer Hotel & Spa. DFLabs will also preview a new playbook dedicated to breach notification, response and compliance activities specific to the Asian regulatory environment.

One of the largest data sets on the market, the IncMan RP playbook is a unique new module of the company’s cyber incident response automation and orchestration platform, IncMan. The playbook is based on U.S. and EU regulations and industry standards and gives customers immediate access to a large number of pre-built incident and data breach response actions to follow. Providing the most playbooks available today to handle the entire breach response process – from technical to operational and legal – it is divided into state/federal, industry sector and type of incident/breach segments and works with both human and machine based processes.

“Active data breach and privacy regulations are making incident response platforms mandatory and our commercial and government customers in Singapore and Asia are working very hard to establish the right framework for cyber incident and breach response. As the first mover in fast growing categories of Security Operations, Analytics and Reporting (SOAR) and Security Incident Response Platforms (SIRP), we are happy and proud to participate in this important event, educate on global standards and best practices, and serve customers with our unique new playbooks,” said Dario Forte, Founder and CEO of DFLabs.

In his Data Privacy Asia 2016 session on Wednesday, November 9th from 4:00pm- 4:30pm, Fumagalli will cover the recent progress made by ISO (International Organization for Standardization) in the field of Incident and Data Breach Response. In the past 36 months 5 standards have been published, with the purpose of providing practitioners and evaluator a series of tools – based upon consensus – able to support Cyber Security Operations and Breach Response. As one of the most recognized experts in ISO standards, he will give an overview on the entire spectrum, along with some insights on how to implement them within any size of the organization, including an overview of the available technologies to automate and orchestrate incident management and response.

“These developments further our vision of Supervised Active Intelligence® to combine automation, orchestration, and response in one powerful platform, giving cyber operations and incident response teams the ability to react faster globally while maintaining the critical element of human control,” added Forte.

About DFLabs
DFLabs is a recognized global leader in cyber incident response automation and orchestration. The company is led by a management team recognized for its experience in and contributions to the information security field including co-edited many industry standards such as ISO 27043 and ISO 30121. IncMan – Cyber Incidents Under Control – is the flagship product, adopted by Fortune 500 and Global 2000 organizations worldwide. DFLabs has operations in Europe, North America, Middle East, and Asia with US headquarters in Boston, MA and World headquarters in Milano, Italy. For more information visit: DFLabs or connect with us on Twitter @DFLabs.

Media contacts:
Leslie Kesselring, Kesselring Communications
503-358-1012
[email protected]

A Weekend in Incident Response #3: U.S. Department of Defense Introduces Final Rule on Cyber Incident Reporting

On November 3, 2016, a new cyber incident reporting rule for Defensive Industrial Base (DIB) companies that are doing business with the U.S. Department of Defense (DoD) has gone into effect.

The final rule, recently published by the Office of the Chief Information Officer of the DoD, will implement requirements that all DoD contractors and subcontractors will have to comply with when reporting cyber incidents. It defines the mandatory cyber incident reporting requirements, which the Department of Defense says will apply to “all forms of agreement between DoD and DIB companies”. The agreements in question include contracts, grants, cooperative agreements, and any other type of legal instrument or agreement.

Adopting a Standard Reporting Mechanism

One of the goals of this rule is to establish a uniform reporting standard for cyber incidents on unclassified DoD contractor networks or information systems. Under this rule, DoD contractors and subcontractors will be required to report cyber incidents that result in “actual or potentially adverse effect on a covered contractor information system or covered defense information residing therein, or on a contractor’s ability to provide operationally critical support“.

While it is interesting to see that every cyber incident is potentially subject to reporting, it’s also important to note that this rule changes the definition of Covered Defense Information (CDI). The rule states that it will now refer to any data in the Controlled Unclassified Information Registry that requires “safeguarding or dissemination controls pursuant to and consistent with law, regulations and Government-wide policies“ and is either marked or otherwise identified in an agreement and provided to the contractor by or on behalf of the DoD in support of the performance of the agreement, or collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the agreement.

Also, there is a new definition for covered contractor information system, which is now defined as “unclassified information system that is owned or operated by or for a contractor and that processes, stores, or transmits covered defense information.”

Using Incident Response Platform for Efficient and Quick Reporting

There is a lot of data and different types of information that go into a cyber incident report. While -on the technical side- there is an ongoing discussion on which taxonomy should be used for effective reporting, strategists are in agreement that creating a proper cyber incident report that complies with the above-mentioned requirements is not an easy task, and it might take a lot of time and resources to do it.

However, there are various solutions designed for this exact purpose, that can help contractors save a lot of time and money by automatically gathering all the necessary information following an incident and creating reports that can help during investigations.

For instance, all entities that the DoDs Final Rule on Cyber Incident Reporting applies to can get a lot of use out of a software with KPI report summary capabilities, creating information summaries for all incidents under previously specified user criteria.

Also, such a software should be able to create custom reports that can be invoked by the user, employing previously created custom templates, complying with most cyber incident reporting standards and requirements worldwide, not only in the United States.

Is the Existing Vendor Supply Chain Ready for This?

In general, I personally think there is still a consistent number of companies -that are part of the IT supply chain- which is not ready for such regulations. On the other hand, vendor risk management is quickly becoming part not only of the Government system but also of the business practice. So breach notification policies shall be globally followed as part of it. The main risk is that will be interpreted as a compliance task, not a security one. Thus, the real challenge will be creating value out of such compliance task. My personal experience suggests me that value can be created only in two ways: by providing the correct information (in a timely and standard manner) and by sharing them. Time will tell.