A Weekend in Incident Response #7: The Importance of Accurate Cyber Incident Reporting and Preservation of Digital Evidence

Although cyber security solutions are advancing at an extraordinarily fast pace, the harsh reality is that cyber attacks will continue to occur and hackers will continue to breach the networks and computer systems of businesses and government agencies around the globe. Efficient and accurate cyber incident reporting is considered key to mitigating the potential damage these attacks can inflict.

All cyber security experts agree that cyber attacks are inevitable and can’t always be prevented. No matter how sophisticated an organization’s cyber defense is, there will always be a way to breach it. With that in mind, the best way to defeat attackers is to devise the best possible cyber incident response plan. The way you respond to an incident is one of the crucial aspects to the efforts for ultimately defeating hackers and preventing recurring attacks. Reporting and forensic investigations are the two of the most important elements of a successful cyber incident response plan.

Keeping Incidents Under Control

A quick and effective response to a cyber incident should include having firm control over all data breaches and incidents, which is best executed through the utilization of an incident response orchestration platform that provides automated and manual response, to immediately detect and respond to breaches.

There are platforms on the market that provide complete control over cyber security incidents, along with gathering evidence efficiently, specific, and detailed playbooks that help you react to an incident fast and effectively, and integration with forensic and response systems.

These types of features are essential for organizations that want to make sure that they preserve the scene of a cyber security incident, which in turn results in a more effective investigation, fast recovery, as well as compliance with existing regulations. It’s an accurate way to prevent a destruction or loss of evidence, which often occurs unintentionally and prevents a speedy recovery following a breach.

Efficient Reporting

An efficient incident response includes accurate cyber incident reporting, as well. Reporting to authorities is an important part of the process of resolving cyber-crime cases, and it should be conducted in accordance with existing regulations, such as the EU Network Information Security (NIS) directive, and the new cyber incident reporting rule introduced by the U.S. Department of Defense, that is supposed to go into effect in 2017.

If your organization is a victim of a cyber-attack, notifying authorities about the incident should be one of your top priorities. The creation of reports is useful for a faster recovery. With a tool that can create automated incident reports and send them to the security team within an organization, the organization reduces the time it takes to react and resolve a cyber incident, and contain the damage.

A Weekend in Incident Response #3: U.S. Department of Defense Introduces Final Rule on Cyber Incident Reporting

On November 3, 2016, a new cyber incident reporting rule for Defensive Industrial Base (DIB) companies that are doing business with the U.S. Department of Defense (DoD) has gone into effect.

The final rule, recently published by the Office of the Chief Information Officer of the DoD, will implement requirements that all DoD contractors and subcontractors will have to comply with when reporting cyber incidents. It defines the mandatory cyber incident reporting requirements, which the Department of Defense says will apply to “all forms of agreement between DoD and DIB companies”. The agreements in question include contracts, grants, cooperative agreements, and any other type of legal instrument or agreement.

Adopting a Standard Reporting Mechanism

One of the goals of this rule is to establish a uniform reporting standard for cyber incidents on unclassified DoD contractor networks or information systems. Under this rule, DoD contractors and subcontractors will be required to report cyber incidents that result in “actual or potentially adverse effect on a covered contractor information system or covered defense information residing therein, or on a contractor’s ability to provide operationally critical support“.

While it is interesting to see that every cyber incident is potentially subject to reporting, it’s also important to note that this rule changes the definition of Covered Defense Information (CDI). The rule states that it will now refer to any data in the Controlled Unclassified Information Registry that requires “safeguarding or dissemination controls pursuant to and consistent with law, regulations and Government-wide policies“ and is either marked or otherwise identified in an agreement and provided to the contractor by or on behalf of the DoD in support of the performance of the agreement, or collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the agreement.

Also, there is a new definition for covered contractor information system, which is now defined as “unclassified information system that is owned or operated by or for a contractor and that processes, stores, or transmits covered defense information.”

Using Incident Response Platform for Efficient and Quick Reporting

There is a lot of data and different types of information that go into a cyber incident report. While -on the technical side- there is an ongoing discussion on which taxonomy should be used for effective reporting, strategists are in agreement that creating a proper cyber incident report that complies with the above-mentioned requirements is not an easy task, and it might take a lot of time and resources to do it.

However, there are various solutions designed for this exact purpose, that can help contractors save a lot of time and money by automatically gathering all the necessary information following an incident and creating reports that can help during investigations.

For instance, all entities that the DoDs Final Rule on Cyber Incident Reporting applies to can get a lot of use out of a software with KPI report summary capabilities, creating information summaries for all incidents under previously specified user criteria.

Also, such a software should be able to create custom reports that can be invoked by the user, employing previously created custom templates, complying with most cyber incident reporting standards and requirements worldwide, not only in the United States.

Is the Existing Vendor Supply Chain Ready for This?

In general, I personally think there is still a consistent number of companies -that are part of the IT supply chain- which is not ready for such regulations. On the other hand, vendor risk management is quickly becoming part not only of the Government system but also of the business practice. So breach notification policies shall be globally followed as part of it. The main risk is that will be interpreted as a compliance task, not a security one. Thus, the real challenge will be creating value out of such compliance task. My personal experience suggests me that value can be created only in two ways: by providing the correct information (in a timely and standard manner) and by sharing them. Time will tell.