In her return to her Security Patrol post, Carol Woodbury discusses the ways you can prepare for the unthinkable.

I'd like you to imagine the unthinkable—that your organization's been hacked. Please entertain that thought with me for a few minutes. Let's pretend that you've just been notified that the personal data of your organization's customers has been posted to an underground website where it's up for sale. In addition to fighting back a severe case of nausea, what do you do? You'd reach for the printed copy of your organization's incident response plan, right? What do you mean there is no such document? Are you telling me that you have never thought through this scenario and documented the steps to take in the case your organization experiences a breach?

Unfortunately, I believe the majority of the IBM i shops—large and small—are unprepared should their networks and/or systems be breached. I believe it's because most organizations think it will never happen to them. If that's your attitude, start reading the news. A new article about another company being breached appears almost daily. I'm guessing that the former (note, I said "former") CIO of Target never thought her organization wouldn't be breached either. Look how well that worked out for her.

This month's Security Patrol talks about preparing an incident response plan, that piece of paper that's pulled out of a drawer should you get that dreaded phone call.

Assembling the Incident Response Team

Assembling the right team is critical to successfully responding to an incident. A section of your incident response is the list of people who need to be called for each type of incident. You'll want to designate a team leader and include individuals who can represent information security, internal audit, risk management, fraud detection, as well as administrators from all system types—firewall, servers, IBM i, AIX, Linux, etc. Selected management and, depending on the type of incident, representatives from the business side of the organization may also be required.

Depending on the size of your organization, several of the areas described previously may be filled by the same person. That's not a problem as long as, in the case of an event, they are physically able to fulfill all of the roles in the stress-filled situation of investigating and handling an incident. It's not the number of people assigned to the team that's important. What's important is to assemble the right skills to handle the incident, keeping in mind the personalities of the various team members. The team needs to be able to work well together and be able to handle the stress this type of event produces.

Two other critical members of the team are a representative from your organization's legal counsel and a public relations/media contact. Legal counsel is required to ensure the company is complying with the law as well as to protect the company and its contracts (e.g., Service Level Agreements, aka SLAs) with customers and vendors. The media contact is vital if you have to make a public announcement about the breach. If a breach of your data occurs, your organization's reputation and image is at risk; therefore, the situation must be handled carefully. The media representative may not be the one who actually appears in front of a TV camera, but he or she would be the one to field all media inquiries, write any statements being released to the public, as well as prepare the person who makes the public statements.

You'll want to assemble this team prior to an incident and work out the details of how you'd respond to various types of incidences. The people called and actions taken will likely be different depending on, for example, whether your network comes under a denial-of-service attack vs. your personnel file is posted on a public website.

The Correct Response

One reason it's so important to be prepared ahead of a breach is because it's vital that your response be appropriate. Not only do you want to stop the attack as quickly as possible but you want to do so in a way that preserves information so that forensics can be performed. This is important, not just to discover how the breach occurred, but also to preserve evidence so the guilty parties can be identified and prosecuted.

I highly recommend that you consider having on retainer a company that specializes in investigating data breaches. These companies have the expertise to investigate and stop the breach as well as preserve evidence along the way.

Another reason it's important to respond correctly—especially to a data breach—is so that your organization doesn't violate any laws that govern the lost or stolen data. For example, depending on the state or country in which you do business, you may have to notify individuals if their personal data is lost or stolen. Your legal counsel will have to provide input on how you respond to certain types breaches.

Data Preservation

Critical to an incident investigation is data preservation. How data is preserved depends on the type of computer. For a PC, tools exist that let you obtain a mirror image of the contents of the PC's hard drive without affecting the files' dates. Again, consider having a company specializing in this type of investigation on retainer. If you have no experience in using these types of tools, the last thing you want to be doing in the midst of a breach is negotiating a contract to bring in the expertise you lack but you need onsite immediately.

From an IBM i perspective, if you believe you know when the incident occurred and you don't have a full backup since the incident, you will want to perform a full system save on new tapes as soon as possible. The intent is to take a "picture" of the system and its configuration in case there are any clues or evidence that can be used in the investigation. Note: you may have to adjust your procedures because you don't want to clear any outqs, message queues, or history logs prior to performing this save; you literally want to save everything.

Once the system has been saved or if the system was already saved, you need to establish the "chain of command" for the save media. In other words, you must clearly document who performed the save and when it was performed. Then you must document where the media goes. You will want to get this set of media into a safe and secured place as quickly as possible.

Finally, if you're using tapes as your save media and you re-use or rotate them, you will want to stop until the investigation has been completed. The incident response team may need to examine the data on those tapes to determine the configuration of the system or previous actions taken by the intruder.

Prepare for Absurd Scenarios

Some of the following scenarios you may have considered in your disaster recovery plan, but my guess is that some you wouldn't stop to consider outside of the context of a breach. Here are some scenarios to consider:

What if your PC was breached—that is, malware was installed on your PC and you aren't allowed to use it much less attach it to your network? Do you have the information written down or available (think passwords and client software and licenses) so you can re-establish a working PC quickly?

What if your network has been compromised and the only connections allowed to your IBM i system—until more investigation can be performed—are directly attached devices? Could you quickly configure a new subnet on your network to allow you to start managing and monitoring your IBM I, or would you have to do all work from the console? Does your business have processes that can be run using old-fashioned paper and pencil should the automated process not be available from the IBM i (not necessarily because the system was compromised but because the network has been taken down)?

If you're using VoIP for your telephone system and your network is hit with a denial-of-service attack, do you have a backup plan for communicating with employees?

What if your mobile phone has been compromised? Do you have key contacts written down on a piece of paper and stored in a place that you'll remember? Be sure to include both phone numbers and email addresses because you don't know which you'll lose.

What if your email server is compromised and you know that some email accounts have been hijacked. You have no idea how many accounts have been compromised. How do you re-establish email for all of your employees?

What if all of the Windows servers in your organization were compromised or could have possibly been compromised? For example, the Admin profile was compromised and malware may have been installed or data could have been deleted or altered. Would you allow those servers to continue to automatically connect to your IBM i? (The correct answer is no.) In that case, what business processes are affected? How important are these processes in the priority of getting processes re-established?

What if the servers where all of your documentation (think vendor contact information, backup copies of software licenses, critical processes, etc.) is located have been compromised and have to be re-built? The information may never be able to be recovered because you don't know how long the servers have been compromised (so you don't know what backups can be trusted). Do you have your critical information in more than one place, perhaps in a good old-fashioned print-out?

Education

Educating your employees and vendors on breach prevention should be a part of preparing for an incident. Employees need to be educated to watch for suspicious behavior. Specifically, users need to be trained to not click on links in unknown emails. Spear-phishing (targeted emails containing a link to malware that is downloaded to the user's PC) is one of the top ways malware makes its way into an organization. Many of the recent breaches were successful because of the malware introduced into the organization's network through spear-phishing.

Be Protactive

Before an incident occurs, assemble the team and role play various types of incidences and breaches. Based on this, create the policy and document the incident-reporting process for each type of incident. It's likely to take several meetings before you have developed the appropriate addition to your policy and have your process defined to the point that it can be followed. Together with your legal counsel, you may want to call in police investigators or federal agencies to understand the data-gathering/preservation requirements of your specific city, state, or country and make sure these are accommodated in your processes.

Summary

I hope that this Security Patrol has caused you to pause and think about whether you're prepared should a breach occur in your organization. If you're not, please do not assume that hackers are going to bypass your organization. In today's world, whether your organization is large or small, you cannot make that assumption. Planning for this type of event will help you recover more quickly. I have been involved with organizations that have experienced a breach. Trust me when I say that you do not want to be in that situation without a plan.

IBM i provides many resources to aid in the investigation of an incident. Next month, I'll discuss specific actions you can take to look for evidence of an intrusion on IBM i.