Tag Archives: incident response

New Security Metrics to Consider – 24/72 and 1/10/60

Once a new bug is publicly announced, it takes, on average, seven days for bad guys to figure out how to weaponize it.

Experts say that this means that you need to harden your systems against that new attack within 72 hours.  That is not very long, even for the best of operations.

How long does it take the average organization to close holes?

On average – 102 days or 15 times the amount of time it takes to weaponize it.

Once a vulnerability is disclosed, it is a race between the good guys and the bad guys to either  fix it or abuse it.

Some examples:

Microsoft patched Bluekeep, a bug that was very well publicized in May 2019.   It was also explained why it was critical to patch.  In December 2019, there were at least 700,000 machines publicly exposed and still vulnerable.

Remember Wannacry?  Sophos says that there are still a large number of machines not patched against it – two years later.

Zero day attacks are even worse – best practice says that they should be patched in 24 hours.

To add to the complexity of the problem for IT, these fixes need to be tested.

So if the benchmark for MEAN TIME TO HARDENING is 24 HOURS FOR ZERO DAYS AND 72 HOURS FOR OTHER FIXES, IT has got a lot of work to do.

The cousin of this is incident response.  Crowdstrike sets the benchmark at 1/10/60.

For those of you not familiar with this benchmark, it means:


These two goals really important and also really hard.  Almost no organizations can currently do this.

These two goals interact with each other.  If we can close off enough holes then we make it harder for the bad guys.  This allows IT to focus on the remaining attacks.

For IT, the battle is basically the need for speed.

So here are the recommendations:

24/72 (hours) for patching

1/10/60 (minutes) for incident response

For almost all organizations, this is a big project.  Everybody ready?

Source: Threatpost

77% of Orgs Lack a Cybersecurity Incident Response Plan

The fourth annual benchmark on cyber resilience authored by  Larry Ponemon and paid for by IBM shows that 77% of the organizations surveyed do not have a cybersecurity incident response program applied consistently across the organization.

Does your organization have an effective, trained and tested cybersecurity incident response program (CSISP) that works across all parts of your organization?

For organizations that said that they do have an CSIRP,  54% said that they do not test it regularly.   Not testing it regularly is the equivalent of not having one.  That is more than half.

Other results from the study include:

  • Less than 25% of the organizations say that they use significant automation in responding to breaches.
  • Only 30% said that they had sufficient cybersecurity staffing.
  • 62% said that aligning cybersecurity and privacy is critical to achieving cyber resilience.

There are some pretty clear recommendations that can be drawn from these results:

1. The three-quarters of organizations that do not have incident response plans need to create one (having one reduces the cost of a breach significantly according to another study).

2. Organizations need to test their plans regularly. 

3. Automation improves the speed and consistency of response.  Not having automation makes response more problematic.

4.  Staffing is still an issue and staffing with the right skills is a problem.

5. With all of the new privacy regulations (such as CCPA, GDPR and others), privacy incident management and security incident management need to be tightly aligned.

How well does your organization do?

Contact us if you need assistance in improving your program.

For more information on the study, go to Help Net Security‘s web site.

Norsk Hydro Ransomware Attack Impacts Price of Aluminum

Update:  The Washington Post pointed out that malware probably did not spread from Norsk’s IT network to it’s plant floor or OT network since they were able to run some plants manually.  This is where network segmentation is really important, even within the IT network.  They also pointed out that Norsk was very public about what was going on, even though it had a (likely) short term impact on their stock price.  They definitely should get gold stars for that.  Source: The Washington Post.

Aluminum Giant Norsk Hydro was hit with a ransomware attack this week.

The attack has forced the company to shut down several plants and take other other plants offline to stop the spread of the attack.

Other plants were operating in “manual” mode.

The Norwegian company employs 35,000 employees in 40 countries.  They report that their entire worldwide network is down affecting production and office  operations.

While some smelting operations can run manually, the company has had to shut down some of its extrusion plants.

The company says that it doesn’t plan to pay the ransom and plans to restore its systems from backups.

One expert suggested that the attacker(s) might have gained domain admin access and then installed a malicious executable on the domain controllers.  From there it gets downloaded to any machine that logs on to the network – workstation or server.  That is why they had to completely shut down the network.

The interesting thing is that they said that this attack is so big that it is affecting the spot price of aluminum on the world market.

So what does this have to do with you?

Let’s assume that you got hit with a ransomware attack.  Not a great thought but not impossible either.

Now assume that you had to shut down the entire company network.   Maybe computers can be powered up, but maybe not.  Since the network is down, the cloud based phone system doesn’t work.  No email and your cell is only useful as a phone.  As long as it doesn’t need WiFi access to work.

How will your company operate?

Are you prepared for an event like this?

Do you have a plan?  Have you tested it?  When?

This is not an isolated event.  We hear about it all the time.  Most of the time it doesn’t affect the spot price of materials on the world market.  That doesn’t mean that it won’t hurt you.

Your cyber incident response plan, program and training is critical.  Are the external third party resources that you may need identified?  Have you reviewed the contracts that will need to be signed?  

Do you have backup plans for how your business will operate when you no longer have a network or an Internet connection?

What happens when your web site goes down?  Will visitors just get a message that your site can’t be found?  What will they think if that happens?

In the case of Norsk it was a ransomware attack, but it could be a failure of your Internet provider, a fire in your building, a burst water pipe in your data center or any number of other possible situations.

In their case, they can afford the millions of dollars they are spending to deal with the situation.  Can you afford that?

Will your cyber risk insurance cover all of this?  Many times companies come to us after discovering that their insurance won’t cover the loss and we look at the policy.  The insurance company is right.  It doesn’t cover it.  That is because cyber insurance is like the wild west and if your agent does not write a lot of coverage, you may or may not get what you need.  This is very different than almost EVERY other form of insurance.  In Colorado and many (most) other states, cyber risk insurance is not regulated by the Department of Insurance.

If you are not prepared then now is the time to get prepared, because it is not a matter of if, but rather how, how bad and when.  

Plan now or deal with it later and dealing with it later will not be pretty.  Take it from someone who knows.

Information for this post came from Threatpost.


Dolce and Gabbana Needs a Better Incident Response Program

Stefano Gabbana is known for very edgy ads and posts on social media.  Some people say over the edge – way over the edge.

The brand ran a series of commercials of Chinese people eating pizza and other Italian foods with chopsticks on the eve of a star-studded fashion show in Hong Kong.  I suspect someone thought that it was something the Chinese would find funny (?).

Then Gabbana’s Instagram account sent out racist taunts to people who were complaining about the ad campaign.

The company’s response was to claim that both Stefano’s and the Company’s Instagram accounts were hijacked.  Few people believed that.  Stefano posted this note on his instagram account after.

If there is one thing the Chinese are, it is loyal to their country.  Models pulled out of the show. Next celebrity guests pulled out.  The show was cancelled less than 24 hours before it was scheduled to go on.

Now D&G merchandise is being pulled from store shelves and removed from web sites.  A full scale disaster for the company.

So what lessons are there to learn from this?

The obvious one is that if your strategy for getting attention is edgy commercials and racist social media posts, you might want to rethink that, especially in certain countries.

In reality, most companies don’t do that, at least on purpose.

The bigger issue is how to respond to cyber incidents.

Lets assume their accounts were hijacked.  It is certainly possible.  Obviously, you want to beef up your social media security if you are doing things that might attract attackers, but more importantly, nothing is bulletproof in cyberspace, so you need an incident response program to deal with it. 

That incident response program needs to deal with the reputational fallout of events that may or may not be in the company’s control.  Crisis communications is a key part of incident response.

The Incident response team needs to be identified and then the team members need to be trained.  That can be done with “table-top” exercises.

Bottom line -prepare for the next cyber event. Information for this post came from SC  Magazine and the New York Times.


Cathay Pacific is Beginning to Fess Up and it Likely Won’t Help Their GDPR Fine

As a reminder, Cathay Pacific Airlines recently admitted it was hacked and lost data on over 9 million passengers.  Information taken includes names, addresses, passport information, birth dates and other information

They took a lot of heat for waiting 6 months to tell anyone about it (remember that GDPR requires you to tell the authorities within 72 hours).

Now they are reporting on the breach to Hong Kong’s Legco (their version of Parliament) and they admitted that they knew they were under attack in March, April and May AND it continued after that.  So now, instead of waiting 6 months to fess up, it is coming out that they waited 9 months,

They also admitted that they really didn’t know what was taken and they didn’t know if the data taken would be usable to a hacker as it was pieces and parts of databases.

Finally, they said after all that, they waited some more to make sure that the information that they were telling people was precisely accurate.

Now they have set up a dedicated website at https://infosecurity.cathaypacific.com/en_HK.html for people who think their data has gone “walkies”.

So what lessons can you take away from their experience?

First of all, waiting 6 months to tell people their information has gone walkies is not going to make you a lot of friends with authorities inside or outside the United States.  9 months isn’t any better.

One might suggest that if they were fighting the bad guys for three months, they probably either didn’t have the right resources or sufficient resources on the problem.

It also means that they likely did not have an adequate incident response program.

Their business continuity program was also lacking.

None of these facts will win them brownie points with regulators, so you should review your programs and make sure that you could effectively respond to an attack.

Their next complaint was that they didn’t know what was taken.  Why?  Inadequate logs.  You need to make sure that you are logging what you should be in order to respond to an attack.

They said that they wanted to make sure that they could tell people exactly what happened.  While that is a nice theory, if you can’t do that within the legally required time, that bit of spin will cost you big time.

Clearly there is a lot that they could have done better.

While the authorities in Europe may fine them for this transgression, in China they have somewhat “harsher” penalties.  Glad I am not in China.

Information for this post came from The Register.



Incident Response 101 – Preserving Evidence

A robust incident response program and a well trained incident response team know exactly what to do and what not to do.

One critical task in incident response is to preserve evidence.  Evidence may need to be preserved based on specific legal requirements, such as for defense contractors.  In other cases, evidence must be preserved based on the presumption of being sued.

In all cases, if you have been notified that someone intends to sue you or has actually filed a lawsuit against you, you are required to preserve all relevant evidence.

This post is the story of what happens when you don’t do that.

In this case, the situation is a lawsuit resulting from the breach of one of the Blue Cross affiliates, Premera.

The breach was well covered in the press; approximately 11 million customers data was impacted.

In this case, based on forensics, 35 computers were infected by the bad guys.  In the grand scheme of things, this is a very small number of computers to be impacted by a breach.  Sometimes, it might infect  thousands of computers in a big organization.  The fact that we are not talking about thousands of computers may not make any difference to the court, but it will be more embarrassing to Premera.

The plaintiffs in this case asked to examine these 35 computers for signs that the bad guys exfiltrated data.  Exfiltrated is a big word for stole (technically uploaded to the Internet in this case).  Premera was able to produce 34 of the computers but curiously, not the 35th.  The also asked for the logs from the data protection software that Premera used called Bluecoat.

This 35th computer is believed to be ground zero for the hackers and may well have been the computer where the data was exfiltrated from.  The Bluecoat logs would have provided important information regarding any data that was exported.

Why are these two crucial pieces of evidence missing?  No one is saying, but if there was incriminating evidence on it or evidence that might have cast doubt on the story that Premera is putting forth, making that evidence disappear might seem like a wise idea.

Only one problem.  The plaintiffs are asking the court to sanction Premera and prohibit them from producing any evidence or experts to claim that no data was stolen during the hack.

The plaintiffs claim that Premera destroyed the evidence after the lawsuit was filed.

In fact, the plaintiffs are asking the judge to instruct the jury to assume that data was stolen.

Even if the judge agrees to all of this,  it doesn’t mean that the plaintiffs are going to win, but it certainly doesn’t help their case.

So what does this mean to you?

First you need to have a robust incident response program and a trained incident response team.

Second, the incident response plan needs to address evidence preservation and that includes a long term  plan to catalog and preserve evidence.

Evidence preservation is just one part of a full incident response program.  That program could be the difference between winning and losing a lawsuit.

Information for this post came from ZDNet.