Anticipating a Breach – What to do Before, During, and After

Cyber breaches against government agencies seen almost an inevitability these days, it’s less of a question of “if”, but “when?”

So what should your agency do when a breach occurs? That’s the topic of a new whitepaper – Anticipating the Breach – from DLT partner, Symantec.

If security incidents are inevitable, the consequences don’t have to be, says Symantec. As evidenced by the attack against the Office of Personnel Management, most breaches are the result of a lack of early detection, security readiness, and timely response.

Instead of just throwing technology at the problem Symantec suggests that agencies need to move to “a proactive cycle of preparation, detection and response. They need to do more than react from the hip to incidents after they learn from them and instead take a holistic approach that addresses the before, during and after stages of a potential attack.”

Symantec makes the following recommendations for preparing your team before, during and after an attack:

Before an Attack

• Prepare early and often – Develop an incident response program (like the DHS CDM program). Test it and continuously build and refine it so that everyone involved on your cross-functional team has mastered it like a rulebook. Never develop policies in a vacuum.

• Build an effective team – Develop a team that can execute when things go wrong. Make it a priority to always keep growing your team’s skills, identify gaps and train innovatively (make it about engagement and team-building). Symantec also suggests giving your security teams a safe learning environment in which to understand how attackers think, what their motives are, etc.

• Integrate global intelligence – Create a defined intelligence program that informs security leaders, monitoring teams, and incident response teams of emerging threats.

• Institute real-time monitoring – Constant vigilance is necessary. Is your agency staffed around the clock to detect advanced threats? Are you monitoring technical and adversary intel to help detect and respond faster? Does your security team have visibility into your monitoring teams so that they can share knowledge quickly?

During an Attack

• Apply intelligence – Threat intelligence can help you understand trends and campaigns that may inform what threat actors are targeting your agency. With the right intel, organizations can be put on the offensive and seek out indicators in their environment.

• Detect threats early – Who will apply this threat intel? While technologies can detect threats, these logs can be overwhelming on their numbers. Which ones should you investigate? How can you prioritize alerts and focus on the critical few?

After an Attack

• Contain and remediate – Act quickly so that when an incident occurs it doesn’t result in a breach. It can take time for hackers to exfiltrate data, this is where your incident response program kicks in. With the right people and processes in place, response times are much quicker.

• Conduct a post-mortem – Once an attack has been thwarted, conduct a lesson learned session with IT and program executives.

For more insight into these pointers, download the Symantec whitepaper: Anticipating the Breach.