Digital Forensics and Incident Response: Your Team After the Breach

It is Cybersecurity Awareness Month again. Along with the ubiquitous ads hawking pumpkin spice this and pumpkin spice that, it is also the time of the year where you become inundated with why you should employ cybersecurity and what could, and will, happen if you don’t. Given the volume of data your organization protects and the value of that data, every day should be cybersecurity day. Threat actors evolve their attacks daily, finding new vulnerabilities and exploiting them to breach your systems. IT defenders need to keep pace, or their organizations risk significant financial loss.

Prepare yourself now: a breach will happen. Publicly available examples abound of companies and organizations that thought themselves to be adequately protected and were breached. There are companies out there right now, maybe even yours, that are winging it and are hoping for the best. Your IT systems may be running fine today, whether a rock-solid security team or the “winging it” approach described above is keeping everything afloat. Just like a car or house, regular maintenance and upgrades are necessary to keep your company and all the information you hold safe from the ever-growing list of bad actors. So, you need to have a plan.

Your plan needs four parts: defensive, offensive, preparatory and picking up the pieces after a breach. The most robust policies and the latest technology are only as good as their execution. Without it, even a minor breach can end catastrophically.

Once you identify a breach, follow your policies, call your cyber breach attorney, call your cyber insurance company, and then call your Digital Forensics and Incident Response (DFIR) team. Remaining calm and sticking to your breach response plan will pay significant dividends in the end.

Incident response creates two competing priorities that pit IT personnel against digital forensics personnel: 1) quarantine and remediation of breached systems, and 2) preservation, analysis and investigation. IT personnel, and by extension company management, want to get systems back online as quickly as possible to stop the loss of revenue. That means wiping the systems and restoring them to their pre-breach state as soon as possible. The DFIR personnel want to preserve evidence on the servers via digital forensic images and log file preservation, analyze for lateral movement to identify any additional infected devices, and investigate to determine the vector of the breach, and, if possible, identify the threat actor.

These two priorities can both be met when your in-house IT personnel and the DFIR team coordinate and cooperate. The DFIR team is comprised of individuals with expertise and knowledge to navigate you through the aftershocks of an intrusion into your systems. This team is aware of the competing priorities and the need to get systems back online as soon as possible and can work with your team to get the needed evidence, remediate your systems, and get you back online. While catching the bad actors is the top priority, the harsh reality is that a security breach may require informing employees, clients and investors of a potential leak of sensitive information. Without proper data preservation, analysis, and reporting, your company could be left between a rock and a hard place.

Conclusion

You most likely have a business continuity plan. Your cybersecurity incident response plan should be included in that plan. Planning for the inevitable breach will have you better prepared when the time comes. As the saying goes, it is better to have it and not need it than to need it and not have it. And when you need it, your DFIR team will be ready to assist.

Withum’s Cybersecurity Consulting Services Team helps organizations build and test incident response plans, assess and strengthen their security posture, and carry out the digital forensics and incident response work that follows a breach.