{"id":1523,"date":"2017-03-08T21:42:00","date_gmt":"2017-03-08T21:42:00","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1523"},"modified":"2017-03-08T21:46:50","modified_gmt":"2017-03-08T21:46:50","slug":"security-incident-response-matters","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2017\/03\/security-incident-response-matters\/","title":{"rendered":"Security Incident Response Really Does Matter"},"content":{"rendered":"

Incident response is one of those things you really hope you’ll never have to use, but know you will. Or at least you should know! Even with the best security,\u00a0there will come a day when you are up to your eyes in chaos. Either a live security incident or, worse still, picking up the pieces after a breach.<\/p>\n

This has stood out a couple of times recently. Someone appears to\u00a0have breached<\/a> the US Central Intelligence Agency and, at the opposite end of the spectrum, a small business in the UK\u00a0looks seriously hacked. Two events which, although unrelated, show that whoever you are, security events are inevitable. Equally inevitable, some will turn into a full blown incident. At this point you realise you have either planned and prepared properly or suffer the consequences.<\/p>\n

The UK angle – SME hacked<\/h2>\n
\"Incident
Incident Impact – Chiltern Seeds<\/figcaption><\/figure>\n

Chiltern Seeds <\/a>is a UK based, family run business offering seeds and plants with a personal touch from a small team. They have a web presence which enables them to service customers across the UK. From the available information, they didn’t cut corners. A custom built website supports customers. Payments go to a dedicated provider. Good web practices.<\/p>\n

All of this is good stuff. It isn’t enough to guarantee never having an incident though.<\/p>\n

At the end of February, they suffered a web outage, followed over the next few days with customers (and curiously some non-customers) getting a very well phrased phishing email. This\u00a0took them to a page trying to steal payment card information. Details<\/a> of this stage of the incident are online and well worth reading.<\/p>\n

This is a terrible situation for any business, especially a small one who is unlikely to have a dedicated incident response (IR)\u00a0team. The problem is that\u00a0this is fairly common. Equally common is the lack of IR preparation. This is where “bad” gets worse. No preparation basically means no real incident response.<\/p>\n

There is more pain for Chiltern Seeds\u00a0with IR work happening in the public domain. Customers (admittedly tech savvy ones) are looking into the incident and drawing conclusions. Customers are challenging the claims made by Chiltern Seeds and for a time at least, they have lost control of the narrative. A bad situation is at risk of spiralling out of control.<\/p>\n

IR is there to stop this.<\/p>\n

Incident Response –\u00a0do better!<\/h2>\n

This post cant cover every possible situation or every possible response scenario. If we tried, it would still fail because IR has to align to your business. However, there are principles to follow.<\/p>\n

Plan. Then plan. And then plan some more.<\/h3>\n
\"Hacked?
Hacked? Time for incident response…<\/figcaption><\/figure>\n

First of all, if you take no other action, come up with an incident response plan. Decide right now what you will do if bad things happen. Don’t try to plan for every possible incident, just plan for high level events. Involve key stakeholders <\/a>are ensure everyone has an idea of what to do. This is essential if you don’t want to panic when something goes wrong in the middle of the night.<\/p>\n

Examples of high level events you should plan for:<\/p>\n