Communication/notification of an incident

Where are the tools?

• On the internal network

• On each endpoint (i.e., memory forensics agents)

• Internet service provider

• In the cloud

  • Sometimes with your cloud provider

Things that shape communication plan for IR

• Legal requirements

• Compliance

• Media and public disclosure

• Internal communications

Legalities

Regulations are different for some industry groups

Different countries have different requirements

Privacy may be of concern

Compliance

• HIPAA

• SOX - Sarbanes-Oxley

• PCI

• Others

Communications with media

Should be filtered through legal team and PR team

Who should receive reports (daily updates, etc)?

Internal communications

• Who has the need to know?

• Use standard normal communications?

• Set up separae communication paths

• Dedicated internet connections

• Out-of-band file storage and digital communications between the team

Do we continue to use internal messaging email if that system is compromised?

If the network is compromised, does that potentially include mail servers?

• Bad guys might be monitoring our IR process!

Out-of-band communications

Set up separate email and messaging and file storage system outside the network

Used exclusively for these type of incidents

Consider backup/alternate devices for connectivity to these massaging and storage systems

Reporting

Reports should be treated as highly confidential, distributed as need-to-know only

Daily status report to be shared among incident handlers

Weekly status report for upper management ar a minimum

• Sometimes management will request daily reports, usually depending on the severity of the incident