incident-response-plan-template/examples/plan.html at master · SpongeBobCodePants/incident-response-plan-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang="">
<head>
  <meta charset="utf-8" />
  <meta name="generator" content="pandoc" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
  <meta name="author" content="Author: {{AUTHOR_NAME}}, {{AUTHOR_EMAIL}}" />
  <title>Incident Response Plan for {{COMPANY_NAME}}</title>
  <style>
    html {
      line-height: 1.5;
      font-family: Georgia, serif;
      font-size: 20px;
      color: #1a1a1a;
      background-color: #fdfdfd;
    }
    body {
      margin: 0 auto;
      max-width: 36em;
      padding-left: 50px;
      padding-right: 50px;
      padding-top: 50px;
      padding-bottom: 50px;
      hyphens: auto;
      word-wrap: break-word;
      text-rendering: optimizeLegibility;
      font-kerning: normal;
    }
    @media (max-width: 600px) {
      body {
        font-size: 0.9em;
        padding: 1em;
      }
    }
    @media print {
      body {
        background-color: transparent;
        color: black;
        font-size: 12pt;
      }
      p, h2, h3 {
        orphans: 3;
        widows: 3;
      }
      h2, h3, h4 {
        page-break-after: avoid;
      }
    }
    p {
      margin: 1em 0;
    }
    a {
      color: #1a1a1a;
    }
    a:visited {
      color: #1a1a1a;
    }
    img {
      max-width: 100%;
    }
    h1, h2, h3, h4, h5, h6 {
      margin-top: 1.4em;
    }
    h5, h6 {
      font-size: 1em;
      font-style: italic;
    }
    h6 {
      font-weight: normal;
    }
    ol, ul {
      padding-left: 1.7em;
      margin-top: 1em;
    }
    li > ol, li > ul {
      margin-top: 0;
    }
    blockquote {
      margin: 1em 0 1em 1.7em;
      padding-left: 1em;
      border-left: 2px solid #e6e6e6;
      color: #606060;
    }
    code {
      font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
      font-size: 85%;
      margin: 0;
    }
    pre {
      margin: 1em 0;
      overflow: auto;
    }
    pre code {
      padding: 0;
      overflow: visible;
    }
    .sourceCode {
     background-color: transparent;
     overflow: visible;
    }
    hr {
      background-color: #1a1a1a;
      border: none;
      height: 1px;
      margin: 1em 0;
    }
    table {
      margin: 1em 0;
      border-collapse: collapse;
      width: 100%;
      overflow-x: auto;
      display: block;
      font-variant-numeric: lining-nums tabular-nums;
    }
    table caption {
      margin-bottom: 0.75em;
    }
    tbody {
      margin-top: 0.5em;
      border-top: 1px solid #1a1a1a;
      border-bottom: 1px solid #1a1a1a;
    }
    th {
      border-top: 1px solid #1a1a1a;
      padding: 0.25em 0.5em 0.25em 0.5em;
    }
    td {
      padding: 0.125em 0.5em 0.25em 0.5em;
    }
    header {
      margin-bottom: 4em;
      text-align: center;
    }
    #TOC li {
      list-style: none;
    }
    #TOC a:not(:hover) {
      text-decoration: none;
    }
    code{white-space: pre-wrap;}
    span.smallcaps{font-variant: small-caps;}
    span.underline{text-decoration: underline;}
    div.column{display: inline-block; vertical-align: top; width: 50%;}
    div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
    ul.task-list{list-style: none;}
    .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  </style>
  <!--[if lt IE 9]>
    <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  <![endif]-->
</head>
<body>
<header id="title-block-header">
<h1 class="title">Incident Response Plan for {{COMPANY_NAME}}</h1>
<p class="author">Author: {{AUTHOR_NAME}}, {{AUTHOR_EMAIL}}</p>
<p class="date">Revision {{REVISION_NUMBER}}, Released {{RELEASE_DATE}}</p>
</header>
<nav id="TOC" role="doc-toc">
<ul>
<li><a href="#incident-response-plan-for-company_name">Incident Response Plan for {{COMPANY_NAME}}</a></li>
<li><a href="#assess">Assess</a>
<ul>
<li><a href="#assess-functional-impact">Assess Functional Impact</a></li>
<li><a href="#assess-information-impact">Assess Information Impact</a></li>
</ul></li>
<li><a href="#initiate-response">Initiate Response</a>
<ul>
<li><a href="#name-the-incident">Name the Incident</a></li>
<li><a href="#assemble-the-response-team">Assemble the Response Team</a>
<ul>
<li><a href="#reference-response-team-structure">Reference: Response Team Structure</a></li>
<li><a href="#reference-response-team-contact-information">Reference: Response Team Contact Information</a></li>
</ul></li>
<li><a href="#establish-battle-rhythm">Establish Battle Rhythm</a>
<ul>
<li><a href="#conduct-initial-response-call">Conduct Initial Response Call</a></li>
<li><a href="#conduct-response-update">Conduct Response Update</a></li>
</ul></li>
<li><a href="#monitor-scope">Monitor Scope</a>
<ul>
<li><a href="#create-sub-teams">Create Sub-Teams</a></li>
<li><a href="#split-incident">Split Incident</a></li>
</ul></li>
</ul></li>
<li><a href="#investigate">Investigate</a>
<ul>
<li><a href="#create-incident-file">Create Incident File</a></li>
<li><a href="#collect-initial-leads">Collect Initial Leads</a>
<ul>
<li><a href="#reference-response-resource-list">Reference: Response Resource List</a></li>
</ul></li>
<li><a href="#update-investigative-plan-and-incident-file">Update Investigative Plan and Incident File</a>
<ul>
<li><a href="#reference-attacker-tactics-to-key-questions-matrix">Reference: Attacker Tactics to Key Questions Matrix</a></li>
</ul></li>
<li><a href="#create-and-deploy-indicators-of-compromise-iocs">Create and Deploy Indicators of Compromise (IOCs)</a></li>
<li><a href="#identify-systems-of-interest">Identify Systems of Interest</a></li>
<li><a href="#collect-evidence">Collect Evidence</a>
<ul>
<li><a href="#example-useful-artifacts">Example Useful Artifacts</a></li>
</ul></li>
<li><a href="#analyze-evidence">Analyze Evidence</a>
<ul>
<li><a href="#example-useful-indicators">Example Useful Indicators</a></li>
</ul></li>
<li><a href="#iterate-investigation">Iterate Investigation</a></li>
</ul></li>
<li><a href="#remediate">Remediate</a>
<ul>
<li><a href="#update-remediation-plan">Update Remediation Plan</a>
<ul>
<li><a href="#protect">Protect</a></li>
<li><a href="#detect">Detect</a></li>
<li><a href="#contain">Contain</a></li>
<li><a href="#eradicate">Eradicate</a></li>
</ul></li>
<li><a href="#choose-remediation-timing">Choose Remediation Timing</a></li>
<li><a href="#execute-remediation">Execute Remediation</a></li>
<li><a href="#iterate-remediation">Iterate Remediation</a></li>
</ul></li>
<li><a href="#communicate">Communicate</a>
<ul>
<li><a href="#communicate-internally">Communicate Internally</a>
<ul>
<li><a href="#notify-and-update-stakeholders">Notify and Update Stakeholders</a></li>
<li><a href="#notify-and-update-organization">Notify and Update Organization</a></li>
<li><a href="#create-incident-report">Create Incident Report</a></li>
</ul></li>
<li><a href="#communicate-externally">Communicate Externally</a>
<ul>
<li><a href="#notify-regulators">Notify Regulators</a></li>
<li><a href="#notify-customers">Notify Customers</a></li>
<li><a href="#notify-vendors-and-partners">Notify Vendors and Partners</a></li>
<li><a href="#notify-law-enforcement">Notify Law Enforcement</a></li>
<li><a href="#contact-external-response-support">Contact External Response Support</a></li>
<li><a href="#share-intelligence">Share Intelligence</a></li>
</ul></li>
</ul></li>
<li><a href="#recover">Recover</a></li>
<li><a href="#playbooks">Playbooks</a>
<ul>
<li><a href="#playbook-website-defacement">Playbook: Website Defacement</a>
<ul>
<li><a href="#investigate-1">Investigate</a></li>
<li><a href="#remediate-1">Remediate</a></li>
<li><a href="#recover-1">Recover</a></li>
<li><a href="#communicate-1">Communicate</a></li>
<li><a href="#resources">Resources</a></li>
<li><a href="#investigate-2">Investigate</a></li>
<li><a href="#remediate-2">Remediate</a></li>
<li><a href="#communicate-2">Communicate</a></li>
<li><a href="#recover-2">Recover</a></li>
<li><a href="#resources-1">Resources</a></li>
</ul></li>
<li><a href="#playbook-phishing">Playbook: Phishing</a>
<ul>
<li><a href="#investigate-3">Investigate</a></li>
<li><a href="#remediate-3">Remediate</a></li>
<li><a href="#communicate-3">Communicate</a></li>
<li><a href="#recover-3">Recover</a></li>
<li><a href="#resources-2">Resources</a></li>
<li><a href="#investigate-4">Investigate</a></li>
<li><a href="#remediate-4">Remediate</a></li>
<li><a href="#communicate-4">Communicate</a></li>
<li><a href="#recover-4">Recover</a></li>
<li><a href="#resources-3">Resources</a></li>
</ul></li>
<li><a href="#playbook-supply-chain-compromise">Playbook: Supply Chain Compromise</a>
<ul>
<li><a href="#investigate-5">Investigate</a></li>
<li><a href="#remediate-5">Remediate</a></li>
<li><a href="#communicate-5">Communicate</a></li>
<li><a href="#recover-5">Recover</a></li>
<li><a href="#resources-4">Resources</a></li>
</ul></li>
</ul></li>
<li><a href="#roles">Roles</a>
<ul>
<li><a href="#structure-of-roles">Structure of Roles</a></li>
<li><a href="#wartime-vs.-peacetime">Wartime vs. Peacetime</a></li>
<li><a href="#role-all-participants">Role: All Participants</a>
<ul>
<li><a href="#description">Description</a></li>
<li><a href="#duties">Duties</a></li>
<li><a href="#training">Training</a></li>
</ul></li>
<li><a href="#role-incident-commander-ic">Role: Incident Commander (IC)</a>
<ul>
<li><a href="#description-1">Description</a></li>
<li><a href="#duties-1">Duties</a></li>
<li><a href="#training-1">Training</a></li>
</ul></li>
<li><a href="#role-deputy-incident-commander-deputy">Role: Deputy Incident Commander (Deputy)</a>
<ul>
<li><a href="#description-2">Description</a></li>
<li><a href="#duties-2">Duties</a></li>
<li><a href="#training-2">Training</a></li>
</ul></li>
<li><a href="#role-scribe">Role: Scribe</a>
<ul>
<li><a href="#description-3">Description</a></li>
<li><a href="#duties-3">Duties</a></li>
<li><a href="#training-3">Training</a></li>
</ul></li>
<li><a href="#role-subject-matter-expert-sme">Role: Subject Matter Expert (SME)</a>
<ul>
<li><a href="#description-4">Description</a></li>
<li><a href="#duties-4">Duties</a></li>
<li><a href="#training-4">Training</a></li>
</ul></li>
<li><a href="#role-liaison">Role: Liaison</a>
<ul>
<li><a href="#description-5">Description</a></li>
<li><a href="#duties-5">Duties</a></li>
<li><a href="#training-5">Training</a></li>
</ul></li>
</ul></li>
<li><a href="#conduct-an-after-action-review-aar">Conduct an After Action Review (AAR)</a>
<ul>
<li><a href="#conduct-the-aar-meeting">Conduct the AAR Meeting</a></li>
<li><a href="#communicate-aar-status-and-results">Communicate AAR Status and Results</a>
<ul>
<li><a href="#status-descriptions">Status Descriptions</a></li>
</ul></li>
</ul></li>
<li><a href="#about">About</a>
<ul>
<li><a href="#license">License</a></li>
<li><a href="#instructions">Instructions</a></li>
<li><a href="#references-and-additional-reading">References and Additional Reading</a></li>
</ul></li>
</ul>
</nav>
<h1 id="incident-response-plan-for-company_name">Incident Response Plan for {{COMPANY_NAME}}</h1>
<p>Author: {{AUTHOR_NAME}}, {{AUTHOR_EMAIL}}</p>
<p>Revision {{REVISION_NUMBER}}, Released {{RELEASE_DATE}}</p>
<p>This incident response plan is based on the concise, directive, specific, flexible, and free plan available on Counteractive Security’s <a href="https://github.com/counteractive/incident-response-plan-template">Github</a> and discussed at <a href="https://www.counteractive.net/posts/an-ir-plan-you-will-use/">www.counteractive.net</a></p>
<p>It was last reviewed on {{REVIEW_DATE}}. It was last tested on {{TEST_DATE}}.</p>
<p><code>TODO: Customize this plan template for your organization using instructions at https://github.com/counteractive/incident-response-plan-template.  For incident response services, or help customizing, implementing, or testing your plan, contact us at contact@counteractive.net or at (888) 925-5765.</code></p>
<h1 id="assess">Assess</h1>
<ol type="1">
<li><strong>Stay calm and professional.</strong></li>
<li>Gather pertinent information, <em>e.g.</em>, alarms, events, data, assumptions, intuitions (<strong>observe</strong>).</li>
<li>Consider impact categories, below (<strong>orient</strong>), and determine if there is a possible incident (<strong>decide</strong>):</li>
<li>Initiate a response if there is an incident (<strong>act</strong>). If in doubt, initiate a response. The incident commander and response team can adjust upon investigation and review.</li>
</ol>
<h2 id="assess-functional-impact">Assess Functional Impact</h2>
<p>What is the direct or likely impact on your mission? (<em>e.g.</em>, business operations, employees, customers, users)</p>
<ul>
<li>Mission/business degradation or failure: <strong>incident!</strong></li>
<li>None: assess information impact.</li>
</ul>
<h2 id="assess-information-impact">Assess Information Impact</h2>
<p>What is the direct or likely impact on your information/data, particularly anything sensitive? (<em>e.g.</em>, PII, proprietary, financial, or healthcare data)</p>
<ul>
<li>Information accessed, taken, changed, or deleted: <strong>incident!</strong></li>
<li>None: handle via non-incident channels (<em>e.g.</em>, support ticket).</li>
</ul>
<p><strong>Every team member is empowered to start this process.</strong> If you see something, say something.</p>
<p><code>TODO: Customize categories/severities as necessary.  This simple example (incident vs. no incident) is based on impact categories in NIST SP 800-61r2.</code></p>
<h1 id="initiate-response">Initiate Response</h1>
<h2 id="name-the-incident">Name the Incident</h2>
<p>Create an <a href="http://creativityforyou.com/combomaker.html">simple two-word phrase</a> to refer to the incident—a codename—to use for the incident file and channel(s). <code>TODO: Customize incident naming procedure.</code></p>
<h2 id="assemble-the-response-team">Assemble the Response Team</h2>
<ol type="1">
<li>Page the on-duty/on-call Incident Commander. <code>TODO: Add Incident Commander call list or procedure</code></li>
<li><strong>Do not</strong> discuss the incident outside the response team unless cleared by the Incident Commander</li>
<li>Launch and/or join the response chat at {{RESPONSE_CHAT}}. <code>TODO: Add response chat launch procedure.</code></li>
<li>Launch and/or join the response call at {{RESPONSE_PHONE}} and/or {{RESPONSE_VTC}}. <code>TODO: Add response call launch procedure.</code></li>
<li>Prefer voice call, chat, and secure file exchange over any other methods.</li>
<li><strong>Do not</strong> use primary email if possible. If email is necessary, use sparingly or use {{ALTERNATE_EMAIL}}. Encrypt emails when any participant is outside the {{ORGANIZATION_DOMAIN}} domain. <code>TODO: Add alternative email details and procedure, e.g., on-demand Office 365 or GSuite</code></li>
<li><strong>Do not</strong> use SMS/text to communicate about the incident, unless to tell someone to move to a more secure channel.</li>
<li>Invite on-duty/on-call responders to the response call and response chat.
<ul>
<li>Invite the security team. <code>TODO: Add security team contact list or procedure.</code></li>
<li>Invite a SME for affected teams and systems. <code>TODO: Add team SME contact list or procedure.</code></li>
<li>Invite executive stakeholders and legal counsel at earliest opportunity, but prioritize operational responders. <code>TODO: Add executive stakeholder contact list or procedure.</code></li>
</ul></li>
<li><em>OPTIONAL:</em> Establish an in-person collaboration room (“war room”) for complex or severe incidents. <code>TODO: Add collaboration room procedure.</code></li>
</ol>
<h3 id="reference-response-team-structure">Reference: Response Team Structure</h3>
<ul>
<li>Command Team
<ul>
<li><a href="#role-incident-commander-ic">Incident Commander</a></li>
<li><a href="#role-deputy-incident-commander-deputy">Deputy Incident Commander</a></li>
<li><a href="#role-scribe">Scribe</a></li>
</ul></li>
<li>Liaison Team
<ul>
<li>Internal <a href="#role-liaison">Liaison</a></li>
<li>External Liaison</li>
</ul></li>
<li>Operations Team
<ul>
<li><a href="#role-subject-matter-expert-sme">Subject Matter Experts</a> (SMEs) for Systems</li>
<li>SMEs for Teams/Business Units</li>
<li>SMEs for Executive Functions (<em>e.g.</em>, Legal, HR, Finance)</li>
</ul></li>
</ul>
<p><code>TODO: Modify role structure as necessary.</code></p>
<h3 id="reference-response-team-contact-information">Reference: Response Team Contact Information</h3>
<table>
<thead>
<tr class="header">
<th>Response Team Role</th>
<th>Contact Information</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>Incident Commander pager</td>
<td>{{INCIDENT_COMMANDER_PAGER_NUMBER}}</td>
</tr>
<tr class="even">
<td>Incident Commander pager url</td>
<td>{{INCIDENT_COMMANDER_PAGER_URL}}</td>
</tr>
<tr class="odd">
<td>Incident Commander roster</td>
<td>{{INCIDENT_COMMANDER_ROSTER}}</td>
</tr>
<tr class="even">
<td>Security team roster</td>
<td>{{SECURITY_TEAM_ROSTER}}</td>
</tr>
<tr class="odd">
<td>Team SME roster</td>
<td>{{TEAM_SME_ROSTER}}</td>
</tr>
<tr class="even">
<td>Executive roster</td>
<td>{{EXECUTIVE_ROSTER}}</td>
</tr>
</tbody>
</table>
<p><code>TODO: Customize response team contact information.  Include contact procedures in rosters, which can be static or dynamic.</code></p>
<h2 id="establish-battle-rhythm">Establish Battle Rhythm</h2>
<h3 id="conduct-initial-response-call">Conduct Initial Response Call</h3>
<ol type="1">
<li>Conduct initial call using the <a href="#reference-initial-response-call-structure">initial response call structure</a></li>
<li>Follow instructions from the Incident Commander. If the on-duty/on-call Incident Commander does not join the call <strong>within {{INCIDENT_COMMANDER_RESPONSE_SLA}}</strong> and you are a trained incident commander, take command of the call.</li>
<li>Follow the <a href="#roles">instructions for your role</a>.</li>
<li>Follow the call and chat, and comment as appropriate. If you are not a SME, filter input through the SME for your team if possible.</li>
<li><strong>Keep the call and chat active throughout the incident for event-driven communication.</strong></li>
<li>Schedule updates <strong>every {{UPDATE_FREQUENCY}}</strong> on the active bridge.</li>
</ol>
<h4 id="reference-initial-response-call-structure">Reference: Initial Response Call Structure</h4>
<ul>
<li>INCIDENT COMMANDER (IC): My name is [NAME], I am the Incident Commander. I have designated [NAME] as Deputy, and [NAME] as Scribe. Who is on the call?</li>
<li>SCRIBE: [Takes attendance]</li>
<li>IC: [If missing key personnel] Deputy, please page [MISSING PERSONNEL].</li>
<li>IC: [Asks questions to understand situation, symptoms, scope, vector, impact, and timeline from the incident reporter, applicable SMEs for systems and business units]</li>
<li>SMEs: [Brief answers to IC’s questions]</li>
<li>IC:[If this is an incident]:
<ul>
<li>At this time, the incident summary is as follows: [reiterates summary]. The Investigation team will be led by [NAME], the Remediation team will be led by [NAME], and the Communication team will be led by [NAME]. They will coordinate team membership and report to me. SMEs, please report to your appropriate team leader.</li>
<li>What investigation, remediation, or communication steps have already been taken? [this should be a short list, but needs to come out now]</li>
<li>This call and chat will remain up and available until incident closure, please use it for all incident related communications. Provide real-time status updates in the chat, if possible. Are there any questions or remaining inputs? [answers questions]</li>
<li>Team leaders, please proceed with your planned actions. We will reconvene at [UPDATE_TIME] to discuss the status. Thank you.</li>
</ul></li>
<li>IC: [If this is not an incident]: At this time, these facts do not rise to the level of an incident. I will coordinate directly with the incident reporter for follow-on actions. Thank you for your time.</li>
</ul>
<h4 id="reference-call-etiquette">Reference: Call Etiquette</h4>
<ul>
<li>Join both the call and chat.</li>
<li>Keep background noise to a minimum.</li>
<li>Keep your microphone muted until you have something to say.</li>
<li>Identify yourself when you join the call; State your name and role (<em>e.g.</em>, “I am the SME for team x”).</li>
<li>Speak up and speak clearly.</li>
<li>Be direct and factual.</li>
<li>Keep conversations/discussions short and to the point.</li>
<li>Bring any concerns to the Incident Commander (IC) on the call.</li>
<li>Respect time constraints given by the Incident Commander.</li>
<li><strong>Use clear terminology, and avoid acronyms or abbreviations. Clarity and accuracy is more important than brevity.</strong></li>
</ul>
<h3 id="conduct-response-update">Conduct Response Update</h3>
<ul>
<li>Conduct scheduled updates using the <a href="#reference-response-update-call-structure">update call structure</a> every {{UPDATE_FREQUENCY}} on the active bridge. <code>TODO: Customize update frequency and scripts; recommend no more than twice daily.</code></li>
<li>Adjust frequency as necessary.</li>
<li>Coordinate independent updates (<em>e.g.</em>, executive, legal) as required, but as infrequently as practicable.</li>
</ul>
<h4 id="reference-response-update-call-structure">Reference: Response Update Call Structure</h4>
<ul>
<li>INCIDENT COMMANDER (IC): Since our last scheduled update, the incident summary is as follows:
<ul>
<li>[Impact]</li>
<li>[Vector]</li>
<li>[Summary update]</li>
<li>[Timeline update]</li>
</ul></li>
<li>IC: Investigation team, please provide a brief update
<ul>
<li>INVESTIGATION LEAD: [Investigative activities or “nothing to report”]</li>
<li>What is your recommended investigations plan?</li>
<li>What investigation actions need tasking or approval? [listen, gain consensus, task/approve]</li>
</ul></li>
<li>IC: Remediation team, please provide a brief update
<ul>
<li>REMEDIATION LEAD: [Remediation activities or “nothing to report”]</li>
<li>What is your recommended remediation strategy? Strong objections? [listen, gain consensus, task/approve]</li>
<li>What remediation actions need tasking or approval?</li>
</ul></li>
<li>IC: Communication team, please provide a brief update:
<ul>
<li>COMMUNICATIONS LEAD: [Communication activities or “nothing to report”]</li>
<li>What is your recommended communication strategy? Strong objections? [listen, gain consensus, task/approve]</li>
<li>What communication actions need tasking or approval?</li>
</ul></li>
<li>IC: This call and chat will remain up and available until incident closure, please use it for all incident related communications. Provide real-time status updates in the chat, if possible. Are there any questions or remaining inputs? [answers questions]</li>
<li>IC: Team leaders, please proceed. We will reconvene in [] to discuss the status. Thank you.</li>
</ul>
<h2 id="monitor-scope">Monitor Scope</h2>
<ul>
<li>Monitor the scope of the response to ensure it does not exceed the Incident Commander’s span of control.</li>
<li>If an incident gets sufficiently complex, and there are sufficient responders, consider spinning off sub-teams.</li>
</ul>
<h3 id="create-sub-teams">Create Sub-Teams</h3>
<ul>
<li>In preparation for complex incidents, three sub-teams are pre-defined: Investigation, Remediation, and Communication, generally responsible for those response functions. <code>TODO: Customize sub-team structure if necessary.</code></li>
<li>Create a call bridge and chat for each sub-team.</li>
<li>The Incident Commander will designate team leaders, who report to the IC, and team members, who report to their team leader. <em>Team leaders do not have to be trained as incident commanders, however some leadership experience is preferable.</em></li>
<li>The Incident Commander may adjust the purpose or name of the sub-teams as necessary.</li>
<li>If you wish to switch teams, ask your <strong>current team leader</strong>. <strong>Do not</strong> ask the Incident Commander, or the leader of the other team(s). Use the chain of command.</li>
</ul>
<h3 id="split-incident">Split Incident</h3>
<p>If an incident turns out to be two or more distinct incidents:</p>
<ul>
<li>Establish a new <a href="#create-incident-file">incident file</a>.</li>
<li>Track and coordinate investigation, remediation, and communication in the appropriate file.</li>
<li>Consider establishing sub-teams for each incident.</li>
<li><strong>Maintain one top-level Incident Commander</strong>, to coordinate low-density, high-demand assets and maintain unity of command.</li>
</ul>
<h1 id="investigate">Investigate</h1>
<p><strong><a href="#investigate">Investigate</a>, <a href="#remediate">remediate</a>, and <a href="#communicate">communicate</a> in parallel, using separate teams, if possible.</strong> The Incident Commander will coordinate these activities. Notify the Incident Commander if there are steps the team should consider.</p>
<h2 id="create-incident-file">Create Incident File</h2>
<ol type="1">
<li>Create a new incident file at {{INCIDENT_FILE_LOCATION}} using the <a href="#name-the-incident">incident name</a>. Use this file for secure storage of documentation, evidence, artifacts, <em>etc.</em>
<ul>
<li>Provision secure digital storage.</li>
<li>Provision secure file exchange.</li>
<li>Obtain physical storage.</li>
<li>Share the incident file location on the call and chat.</li>
<li><code>TODO: Customize and automate file location and procedure</code></li>
</ul></li>
<li>Document the functional and information impact, if known (see <a href="#assess">Assess</a>). <code>TODO: Customize impact categories, if necessary.</code></li>
<li>Document the vector, if known (<em>e.g.,</em> web, email, removable media). <code>TODO: Customize vector list, if necessary.</code></li>
<li>Document the incident summary: a brief overview of the vector, impact, investigation, and remediation situation, if known.</li>
<li>Document the incident timeline, including attacker activity and responder activity. <code>TODO: Add timelines of varying details, as necessary.</code></li>
<li>Document investigation, remediation, and communication steps. Document activities independently so they can be combined and reused, if possible.</li>
<li>Track significant information such as:
<ul>
<li><strong>Evidence</strong>, with time of collection, source, chain of custody, <em>etc.</em></li>
<li><strong>Affected systems</strong>, with how and when system was identified, and summary of effect (<em>e.g.</em>, has malware, data accessed).</li>
<li><strong>Files of interest</strong>, such as malware or data files, with system and metadata.</li>
<li><strong>Accessed and taken data</strong>, with filenames, metadata, and time of suspected exposure.</li>
<li><strong>Significant attacker activity</strong>, such as logins and malware execution, with time of the event.</li>
<li><strong>Network-based indicators of compromise (IOCs)</strong>, such as IP addresses and domains.</li>
<li><strong>Host-based IOCs</strong>, such as filenames, hashes, and registry keys.</li>
<li><strong>Compromised accounts</strong>, with scope of access and time of compromise.</li>
</ul></li>
</ol>
<p><code>TODO: Customize incident documentation procedure, including spreadsheets, databases, forms, systems, and templates, if necessary.</code></p>
<h2 id="collect-initial-leads">Collect Initial Leads</h2>
<ol type="1">
<li>Interview incident reporter(s).</li>
<li>Collect initial supporting data (<em>e.g.</em>, alarms, events, data, assumptions, intuitions) in the incident file.</li>
<li>Interview SME(s) with domain or system expertise, to understand technical detail, context, and risk.</li>
<li>Interview SME(s) in affected business unit, to understand mission/business impact, context, and risk.</li>
<li>Ensure leads are relevant, detailed, and actionable.</li>
</ol>
<h3 id="reference-response-resource-list">Reference: Response Resource List</h3>
<table>
<thead>
<tr class="header">
<th>Resource</th>
<th>Location</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>Critical information list</td>
<td>{{CRITICAL_INFO_LIST_LOCATION}}</td>
</tr>
<tr class="even">
<td>Critical asset list</td>
<td>{{CRITICAL_ASSET_LIST_LOCATION}}</td>
</tr>
<tr class="odd">
<td>Asset management database</td>
<td>{{ASSET_MGMT_DB_LOCATION}}</td>
</tr>
<tr class="even">
<td>Network map</td>
<td>{NETWORK_MAP_LOCATION{}}</td>
</tr>
<tr class="odd">
<td>SIEM console</td>
<td>{{SIEM_CONSOLE_LOCATION}}</td>
</tr>
<tr class="even">
<td>Log aggregator</td>
<td>{{LOG_AGGREGATOR_CONSOLE}}</td>
</tr>
</tbody>
</table>
<p><code>TODO: Complete critical information and asset lists ("crown jewels"). This is incredibly important to effective response.</code></p>
<p><code>TODO: Customize response resource list</code></p>
<h2 id="update-investigative-plan-and-incident-file">Update Investigative Plan and Incident File</h2>
<ol type="1">
<li>Review and refine incident impact.</li>
<li>Review and refine incident vector.</li>
<li>Review and refine incident summary.</li>
<li>Review and refine incident timeline with facts and inferences.</li>
<li>Create hypotheses: what may have happened, and with what confidence.</li>
<li><strong>Identify and prioritize key questions</strong> (information gaps) to support or discredit hypotheses.
<ul>
<li>Use the MITRE ATT&amp;CK matrix or similar framework to <a href="#reference-attacker-tactics-to-key-questions-matrix">develop questions</a>.
<ul>
<li><a href="https://attack.mitre.org/wiki/Main_Page">ATT&amp;CK for Enterprise</a>, including links to Windows, Mac, and Linux specifics.</li>
<li><a href="https://attack.mitre.org/mobile/index.php/Main_Page">ATT&amp;CK Mobile Profile</a> for mobile devices.</li>
</ul></li>
<li>Use interrogative words as inspiration:
<ul>
<li><strong>When?</strong>: first compromise, first data loss, access to x data, access to y system, <em>etc.</em></li>
<li><strong>What?</strong>: impact, vector, root cause, motivation, tools/exploits used, accounts/systems compromised, data targeted/lost, infrastructure, IOCs, <em>etc.</em></li>
<li><strong>Where?</strong>: attacker location, affected business units, infrastructure, <em>etc.</em></li>
<li><strong>How?</strong>: compromise (exploit), persistence, access, exfiltration, lateral movement, <em>etc.</em></li>
<li><strong>Why?</strong>: targeted, timing, access x data, access y system, <em>etc.</em></li>
<li><strong>Who?</strong>: attacker, affected users, affected customers, <em>etc.</em></li>
</ul></li>
</ul></li>
<li><strong>Identify and prioritize witness devices and strategies</strong> to answer key questions.
<ul>
<li>Consult network diagrams, asset management systems, and SME expertise</li>
<li>Check the <a href="#reference-response-resource-list">Response Resource List</a>)</li>
</ul></li>
<li>Refer to <a href="#playbooks">incident playbooks</a> for key questions, witness devices, and strategies for investigating common or highly damaging threats.</li>
</ol>
<p><strong>The investigative plan is critical to an effective response; it drives all investigative actions. Use critical thinking, creativity, and sound judgment.</strong></p>
<h3 id="reference-attacker-tactics-to-key-questions-matrix">Reference: Attacker Tactics to Key Questions Matrix</h3>
<table>
<colgroup>
<col style="width: 22%" />
<col style="width: 32%" />
<col style="width: 45%" />
</colgroup>
<thead>
<tr class="header">
<th>Attacker Tactic</th>
<th>The way attackers …</th>
<th>Possible Key Questions</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>Reconnaissance</td>
<td>… learn about targets</td>
<td>How? Since when? Where? Which systems?</td>
</tr>
<tr class="even">
<td>Resource Development</td>
<td>… build infrastructure</td>
<td>Where? Which systems?</td>
</tr>
<tr class="odd">
<td>Initial Access</td>
<td>… get in</td>
<td>How? Since when? Where? Which systems?</td>
</tr>
<tr class="even">
<td>Execution</td>
<td>… run hostile code</td>
<td>What malware? What tools? Where? When?</td>
</tr>
<tr class="odd">
<td>Persistence</td>
<td>… stick around</td>
<td>How? Since when? Where? Which systems?</td>
</tr>
<tr class="even">
<td>Privilege Escalation</td>
<td>… get higher level access</td>
<td>How? Where? What tools?</td>
</tr>
<tr class="odd">
<td>Defense Evasion</td>
<td>… dodge security</td>
<td>How? Where? Since when?</td>
</tr>
<tr class="even">
<td>Credential Access</td>
<td>… get/create accounts</td>
<td>Which accounts? Since when? Why?</td>
</tr>
<tr class="odd">
<td>Discovery</td>
<td>… learn our network</td>
<td>How? Where? What do they know?</td>
</tr>
<tr class="even">
<td>Lateral Movement</td>
<td>… move around</td>
<td>How? When? Which accounts?</td>
</tr>
<tr class="odd">
<td>Collection</td>
<td>… find and gather data</td>
<td>What data? Why? When? Where?</td>
</tr>
<tr class="even">
<td>Command and Control</td>
<td>… control tools and systems</td>
<td>How? Where? Who? Why?</td>
</tr>
<tr class="odd">
<td>Exfiltration</td>
<td>… take data</td>
<td>What data? How? When? Where?</td>
</tr>
<tr class="even">
<td>Impact</td>
<td>… break things</td>
<td>What systems or data? How? When? Where? How bad?</td>
</tr>
</tbody>
</table>
<p>See the <a href="https://attack.mitre.org/">MITRE ATT&amp;CK page</a> for more insight and ideas.</p>
<h2 id="create-and-deploy-indicators-of-compromise-iocs">Create and Deploy Indicators of Compromise (IOCs)</h2>
<blockquote>
<p>Emphasize <strong>dynamic and behavioral</strong> indicators alongside static fingerprints.</p>
</blockquote>
<ul>
<li>Create IOCs based on <a href="#collect-initial-leads">initial leads</a> and <a href="#analyze-evidence">analysis</a>.</li>
<li>Create IOCs using an open format supported by your tools (<em>e.g.</em>, <a href="https://oasis-open.github.io/cti-documentation/stix/intro">STIX 2.0</a>), if possible. <code>TODO: Customize IOC format as necessary.</code></li>
<li>Use automation, if possible. <code>TODO: Add IOC deployment/revocation procedure.</code></li>
<li><strong>Do not</strong> deploy unrelated, un-curated “feeds” of IOCs; these can cause confusion and fatigue.</li>
<li>Consider all IOC types:
<ul>
<li>Network-based IOCs such as IP or MAC addresses, ports, email addresses, email content or metadata, URLs, domains, or PCAP patterns.</li>
<li>Host-based IOCs such as paths, file hashes, file content or metadata, registry keys, MUTEXes, autoruns, or user artifacts and permissions.</li>
<li>Cloud-based IOCs such as log patterns for <a href="https://en.wikipedia.org/wiki/Software_as_a_service">SaaS</a> or <a href="https://en.wikipedia.org/wiki/Infrastructure_as_a_service">IaaS</a> deployments</li>
<li>Behavioral IOCs (a.k.a., patterns, TTPs) such as process tree patterns, heuristics, deviation from baseline, and login patterns.</li>
</ul></li>
<li>Correlate various IOC types, such as network and host-based indicators on the same systems(s).</li>
</ul>
<h2 id="identify-systems-of-interest">Identify Systems of Interest</h2>
<ol type="1">
<li>Validate whether they are relevant.</li>
<li>Categorize the reason(s) they are “of interest”: has malware, accessed by compromised account, has sensitive data, etc. Treat these as “tags”, there may be more than one category per system.</li>
<li>Prioritize collection, analysis, and remediation based on investigative needs, business impact, <em>etc.</em></li>
</ol>
<h2 id="collect-evidence">Collect Evidence</h2>
<ul>
<li>Prioritize based on the investigative plan</li>
<li>Collect live response data using {{LIVE_RESPONSE_TOOL}}. <code>TODO: Customize live response tools and procedure.</code></li>
<li>Collect relevant logs from system(s) (if not part of live response), aggregator(s), SIEM(s), or device console(s). <code>TODO: Customize log collection tools and procedure.</code></li>
<li>Collect memory image, if necessary and if not part of live response, using {{MEMORY_COLLECTION_TOOL}}. <code>TODO: Customize memory collection tools and procedure.</code></li>
<li>Collect disk image, if necessary, using {{DISK_IMAGE_TOOL}}. <code>TODO: Customize disk image collection tool and procedure.</code></li>
<li>Collect and store evidence in accordance with policy, and with proper chain of custody. <code>TODO: Customize evidence collection and chain of custody policy.</code></li>
</ul>
<p>Consider collecting the following artifacts as evidence, either in real time (_e.g., via EDR or a SIEM) or on demand:</p>
<h3 id="example-useful-artifacts">Example Useful Artifacts</h3>
<p><code>TODO: Customize and prioritize useful artifacts.</code></p>
<ul>
<li>Running Processes</li>
<li>Running Services</li>
<li>Executable Hashes</li>
<li>Installed Applications</li>
<li>Local and Domain Users</li>
<li>Listening Ports and Associated Services</li>
<li>Domain Name System (DNS) Resolution Settings and Static Routes</li>
<li>Established and Recent Network Connections</li>
<li>Run Key and other AutoRun Persistence</li>
<li>Scheduled tasks and cron jobs</li>
<li>Artifacts of past execution (e.g., Prefetch and Shimcache)</li>
<li>Event logs</li>
<li>Group policy and WMI artifacts</li>
<li>Anti-virus detections</li>
<li>Binaries in temporary storage locations</li>
<li>Remote access credentials</li>
<li>Network connection telemetry (e.g., netflow, firewall permits)</li>
<li>DNS traffic and activity</li>
<li>Remote access activity including Remote Desktop Protocol (RDP), virtual private network (VPN), SSH, virtual network computing (VNC), and other remote access tools</li>
<li>Uniform Resource Identifier (URI) strings, user agent strings, and proxy enforcement actions</li>
<li>Web traffic (HTTP/HTTPS)</li>
</ul>
<h2 id="analyze-evidence">Analyze Evidence</h2>
<ul>
<li>Prioritize based on the investigative plan</li>
<li>Analyze and triage live response data</li>
<li>Analyze memory and disk images (<em>i.e.</em>, conduct forensics)</li>
<li>Analyze malware</li>
<li><em>OPTIONAL:</em> Enrich with research and intelligence</li>
<li>Document new indicators of compromise (IOCs)</li>
<li>Update the case file</li>
</ul>
<h3 id="example-useful-indicators">Example Useful Indicators</h3>
<p><code>TODO: Customize and prioritize useful indicators.</code></p>
<ul>
<li>Unusual authentication behavior (<em>e.g.</em>, frequency, systems, time of day, remote location)</li>
<li>Non-Standard formatted usernames</li>
<li>Unsigned binaries connecting to the network</li>
<li>Beaconing or significant data transfers</li>
<li>PowerShell command line requests with Base64-encoded commands</li>
<li>Excessive RAR, 7zip, or WinZip activity, especially with suspicious file names</li>
<li>Connections on previously unused ports.</li>
<li>Traffic patterns related to time, frequency, and byte count</li>
<li>Changes to routing tables, such as weighting, static entries, gateways, and peer relationships</li>
</ul>
<h2 id="iterate-investigation">Iterate Investigation</h2>
<p><a href="#update-investigative-plan-and-incident-file">Update the investigative plan</a> and repeat until closure.</p>
<h1 id="remediate">Remediate</h1>
<p><strong><a href="#investigate">Investigate</a>, <a href="#remediate">remediate</a>, and <a href="#communicate">communicate</a> in parallel, using separate teams, if possible.</strong> The Incident Commander will coordinate these activities. Notify the Incident Commander if there are steps the team should consider</p>
<h2 id="update-remediation-plan">Update Remediation Plan</h2>
<ol type="1">
<li>Review the incident file at {{INCIDENT_FILE_LOCATION}} using the <a href="#name-the-incident">incident name</a></li>
<li>Review applicable <a href="#playbooks">playbooks</a>.</li>
<li>Review the <a href="#reference-response-resource-list">Response Resource List</a>).</li>
<li>Consider which attacker tactics are in play in this incident. Use the MITRE <a href="https://attack.mitre.org/wiki/Main_Page">ATT&amp;CK</a> list (<em>i.e.</em>, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Execution, Collection, Exfiltration, and Command and Control), or similar framework.</li>
<li>Develop remediations for each tactic in play, as feasible given existing tools and resources. Consider remediations to <a href="#protect">Protect</a>, <a href="#detect">Detect</a>, <a href="#contain">Contain</a>, and <a href="#eradicate">Eradicate</a> each attacker behavior.</li>
<li>Prioritize based on <a href="#choose-remediation-timing">timing strategy</a>, impact, and urgency.</li>
<li>Document in incident file.</li>
</ol>
<p>Use <a href="https://www.nist.gov/cyberframework">information security (infosec) frameworks</a> as inspiration, but <strong>do not use incident remediation as a substitute for an infosec program with an appropriate framework.</strong> Use them to supplement one another.</p>
<h3 id="protect">Protect</h3>
<blockquote>
<p>“How can we stop tactic X from happening again, or reduce risk? How can we improve future protection?”</p>
</blockquote>
<p>Use the following as a starting point for protective remediation:</p>
<ul>
<li>Patch applications.</li>
<li>Patch operating systems.</li>
<li>Update network and host IPS signatures.</li>
<li>Update endpoint protection/EDR/anti-virus signatures.</li>
<li>Reduce locations with critical data.</li>
<li>Reduce administrative or privileged accounts.</li>
<li>Enable multi-factor authentication.</li>
<li>Strengthen password requirements.</li>
<li>Block unused ports and protocols at segment and network boundaries, both inbound and outbound.</li>
<li>Whitelist network connections for critical servers and services.</li>
</ul>
<h3 id="detect">Detect</h3>
<blockquote>
<p>“How can we detect this on new systems or in the future? How can we improve future detection and investigation?”</p>
</blockquote>
<p>Use the following as a starting point for detective remediation:</p>
<ul>
<li>Enhance logging and retention for system logs, particularly critical systems.</li>
<li>Enhance logging for applications, including SaaS applications.</li>
<li>Enhance log aggregation.</li>
<li>Update network and host IDS signatures using IOCs.</li>
</ul>
<h3 id="contain">Contain</h3>
<blockquote>
<p>“How can we stop this from spreading, or getting more severe? How can we improve future containment?”</p>
</blockquote>
<p>Use the following as a starting point for containment remediation:</p>
<ul>
<li>Implement access lists (ACLs) at network segment boundaries</li>
<li>Implement blocks at the enterprise boundary, at multiple layers of the <a href="https://en.wikipedia.org/wiki/OSI_model">OSI model</a>.</li>
<li>Disable or remove compromised account access.</li>
<li>Block malicious IP addresses or networks.</li>
<li>Black hole or sinkhole malicious domains.</li>
<li>Update network and host IPS and anti-malware signatures using IOCs.</li>
<li>Remove critical or compromised systems from the network.</li>
<li>Contact providers for assistance (<em>e.g.</em>, internet service providers, SaaS vendors)</li>
<li>Whitelist network connections for critical servers and services.</li>
<li>Kill or disable processes or services.</li>
<li>Block or remove access for external vendors and partners, especially privileged access.</li>
</ul>
<h3 id="eradicate">Eradicate</h3>
<blockquote>
<p>“How can we eliminate this from our assets? How can we improve future eradication?”</p>
</blockquote>
<p>Use the following as a starting point for eradication remediation:</p>
<ul>
<li>Rebuild or restore compromised systems and data from known-good state.</li>
<li>Reset account passwords.</li>
<li>Remove hostile accounts or credentials.</li>
<li>Delete or remove specific malware (difficult!).</li>
<li>Implement alternative vendors.</li>
<li>Activate and migrate to alternate locations, services, or servers.</li>
</ul>
<h2 id="choose-remediation-timing">Choose Remediation Timing</h2>
<p>Determine the timing strategy—when remediation actions will be taken—by engaging the Incident Commander, the system SMEs and owners, business unit SMEs and owners, and the executive team. Each strategy is appropriate under different circumstances:</p>
<ul>
<li>Choose <strong>immediate</strong> remediation when it is more important to immediately stop attacker activities than to continue investigating. For example, ongoing financial loss, or ongoing mission failure, active data loss, or prevention of an imminent significant threat.</li>
<li>Choose <strong>delayed</strong> remediation when it is important to complete the investigation, or important not to alert the attacker. For example, long-term compromise by an advanced attacker, corporate espionage, or large-scale compromise of an an unknown number of systems.</li>
<li>Choose <strong>combined</strong> remediation when both immediate and delayed circumstances apply in the same incident. For example, immediate segmentation of a sensitive server or network to meet regulatory requirements while still investigating a long-term compromise.</li>
</ul>
<h2 id="execute-remediation">Execute Remediation</h2>
<ul>
<li>Assess and explain risks of remediation actions to stakeholders. <code>TODO: Customize remediation risk approval procedure, if necessary.</code></li>
<li>Immediately implement those remediation actions with little or no affect on the attacker (sometimes called “posturing actions”). For example, many of the <a href="#protect">protection</a> and <a href="#detect">detection</a> actions above are good candidates.</li>
<li>Schedule and task remediation actions according to the timing strategy.</li>
<li>Execute remediation actions in batches, as events, for maximum effectiveness and minimum risk.</li>
<li>Document execution status and time in the incident file, especially for temporary measures.</li>
</ul>
<h2 id="iterate-remediation">Iterate Remediation</h2>
<p><a href="#update-remediation-plan">Update the remediation plan</a> and repeat until closure.</p>
<h1 id="communicate">Communicate</h1>
<p><strong><a href="#investigate">Investigate</a>, <a href="#remediate">remediate</a>, and <a href="#communicate">communicate</a> in parallel, using separate teams, if possible.</strong> The Incident Commander will coordinate these activities. Notify the Incident Commander if there are steps the team should consider</p>
<p>All communication must include the most accurate information available. Display integrity. Do not communicate speculation.</p>
<h2 id="communicate-internally">Communicate Internally</h2>
<h3 id="notify-and-update-stakeholders">Notify and Update Stakeholders</h3>
<ul>
<li>Communicate with stakeholders as part of the initial and update calls, as well as via event-driven updates on the call and chat.</li>
<li>Coordinate independent updates (<em>e.g.</em>, executive, legal) as required, but as infrequently as practicable, to keep the focus on investigation and remediation.</li>
<li>Focus on the best assessment of the vector, impact, summary, and highlights of the timeline including remediation steps. Do not speculate.</li>
</ul>
<h3 id="notify-and-update-organization">Notify and Update Organization</h3>
<ul>
<li><strong>Do not</strong> notify or update non-response personnel until cleared by the Incident Commander, particularly if there is a risk of an insider threat.</li>
<li>Coordinate updates for teams or the entire organization with executives and business leadership.</li>
<li>Focus on the best assessment of the vector, impact, summary, and highlights of the timeline including remediation steps. Do not speculate.</li>
</ul>
<h3 id="create-incident-report">Create Incident Report</h3>
<ul>
<li>Upon incident closure, capture information in the <a href="#create-incident-file">incident file</a> for distribution using the format at {{INCIDENT_REPORT_TEMPLATE}}. <strong>If the vector, impact, summary, timeline, and activity reports are complete, this can be fully automated.</strong></li>
<li>Distribute the incident report to the following: {{INCIDENT_REPORT_RECIPIENTS}}.</li>
<li><code>TODO: Customize incident report creation and distribution, if necessary</code></li>
</ul>
<h2 id="communicate-externally">Communicate Externally</h2>
<h3 id="notify-regulators">Notify Regulators</h3>
<ul>
<li><strong>Do not</strong> notify or update non-response personnel until cleared by the Incident Commander.</li>
<li>Notify regulators (<em>e.g.</em>, HIPAA/HITRUST, PCI DSS, SOX) if necessary, and in accordance with policy.</li>
<li>Coordinate requirements, format, and timeline with {COMPLIANCE_TEAM{}}.</li>
</ul>
<h3 id="notify-customers">Notify Customers</h3>
<ul>
<li><strong>Do not</strong> notify or update non-response personnel until cleared by the Incident Commander.</li>
<li>Coordinate customer notifications with {{COMMUNICATIONS_TEAM}}.</li>
<li>Include the date in the title of any announcement, to avoid confusion.</li>
<li><strong>Do not</strong> use platitudes such as “we take security very seriously”. Focus on facts.</li>
<li>Be honest, accept responsibility, and present the facts, along with the plan to prevent similar incidents in future.</li>
<li>Be as detailed as possible with the timeline.</li>
<li>Be as detailed as possible in what information was compromised, and how it affects customers. If we were storing something we shouldn’t have been, be honest about it. It’ll come out later and it’ll be much worse.</li>
<li><strong>Do not</strong> discuss external parties that might have caused the compromise, unless they’ve already publicly disclosed, in which case link to their disclosure. Communicate with them independently (see <a href="#notify-vendors-and-partners">Notify Vendors</a>)</li>
<li>Release the external communication as soon as possible. Bad news does not get better with age.</li>
<li>If possible, contact customers’ internal security teams before notifying the public.</li>
</ul>
<h3 id="notify-vendors-and-partners">Notify Vendors and Partners</h3>
<ul>
<li><strong>Do not</strong> notify or update non-response personnel until cleared by the Incident Commander.</li>
<li>If possible, contact vendors’ and partners’ internal security teams before notifying the public.</li>
<li>Focus on the specific aspects of the incident that affect or implicate the vendor or partner.</li>
<li>Coordinate response efforts and share information if possible.</li>
</ul>
<h3 id="notify-law-enforcement">Notify Law Enforcement</h3>
<ul>
<li><strong>Do not</strong> notify or update non-response personnel until cleared by the Incident Commander.</li>
<li>Coordinate with {{EXECUTIVE_TEAM}} and {{LEGAL_TEAM}} prior to interacting with law enforcement</li>
<li>Contact local law enforcement at {{LOCAL_LE_CONTACT}}.</li>
<li>Contact FBI at {{FBI_CONTACT}} or via the <a href="https://www.ic3.gov">Internet Crime Complaint Center (IC3)</a>.</li>
<li>Contact operators for any systems used in the attack, their systems may also have been compromised.</li>
</ul>
<h3 id="contact-external-response-support">Contact External Response Support</h3>
<ul>
<li>Contact {{INCIDENT_RESPONSE_VENDOR}} to help in assessing risk, incident management, incident response, and post-incident support.</li>
<li>Contact {{PUBLIC_RELATIONS_VENDOR}} for help with PR and external communication.</li>
<li>Contact {{INSURANCE_VENDOR}} for help with cyber insurance.</li>
</ul>
<h3 id="share-intelligence">Share Intelligence</h3>
<ul>
<li>Share IOCs with <a href="https://www.infragard.org/">Infragard</a> if applicable.</li>
<li>Share IOCs with your servicing <a href="https://en.wikipedia.org/wiki/Information_Sharing_and_Analysis_Center">ISAC</a> through {{ISAC_CONTACT}}, if applicable.</li>
</ul>
<h1 id="recover">Recover</h1>
<p><code>TODO: Customize recovery steps.</code></p>
<p><code>TODO: Specify tools and procedures for each step, below.</code></p>
<p><strong>Recovery is typically governed by business units and system owners. Take recovery actions only in collaboration with relevant stakeholders.</strong></p>
<ol type="1">
<li>Launch business continuity/disaster recovery plan(s): <em>e.g.</em>, consider migration to alternate operating locations, fail-over sites, backup systems.</li>
<li>Integrate security actions with organizational recovery efforts.</li>
</ol>
<h1 id="playbooks">Playbooks</h1>
<p>The following playbooks capture common <a href="#investigate">investigation</a>, <a href="#remediate">remediation</a>, and <a href="#communicate">communication</a> steps for particular types of incident.</p>
<p><code>TODO: Create additional playbooks for highly likely or highly damaging incident types.</code></p>
<h2 id="playbook-website-defacement">Playbook: Website Defacement</h2>
<p><strong>Investigate, remediate (contain, eradicate), and communicate in parallel!</strong></p>
<p>Assign steps to individuals or teams to work concurrently, when possible; this playbook is not purely sequential. Use your best judgment.</p>
<h3 id="investigate-1">Investigate</h3>
<ol type="1">
<li>Immediately take the defaced server offline for further investigation
<ul>
<li>This is especially important if the defacement is insulting or triggering in any way. Remove this from the public eye as quickly as possible to avoid harm as well as to mitigate business impact.</li>
<li>The defacement message may also contain false information that could mislead users or put them at risk.</li>
<li>Taking the server offline will allow a deeper investigation of the defacement. This may be necessary as the hacker may have dove depper into the organization accessing application servers, databases, etc.</li>
</ul></li>
<li>Determine the system’s source of vulnerability that was used by the attacker. Common exploits include:
<ul>
<li>SQL injection attakcs
<ul>
<li>This kind of attack occurs when an attacker interferes with an application’s queries to the database. Therefore, this can lead to unauthorized access to private or sensitive data. Read more about SQL injection attacks <a href="https://www.acunetix.com/websitesecurity/sql-injection/">here</a></li>
</ul></li>
<li>Remote File Inclusion (RFI) attacks
<ul>
<li>This kind of attack exploits an application’s referencing function to upload malware from a remote URL. Read more about RFI attacks <a href="https://www.acunetix.com/blog/articles/remote-file-inclusion-rfi/">here</a></li>