It looks like javascript is disabled. In order to use this site, you must have javascript enabled.
After enabling javascript, please click here or reload the page.
Be Prepared
impact to the organization (i.e., the
number of users, databases and systems
that were affected), which data was
compromised, and an estimate of the time
and resources required to investigate and
recover from the attack.
The California Office of Emergency
Services published an excellent resource,
the California Joint Cyber Incident Response
Guide (calcpa.org/cyberincidentresponseguide)
that details a methodology to conduct
an impact analysis comprising of three
components. The functional impact measures
the effect on services to the users; the
information impact evaluates the degree
sensitive information was disclosed, modified
or destroyed by unauthorized persons; and the
recoverability impact determines the amount
of time and resources required to recover
from the incident.
Postmortem
Meeting Questions:
• Were the present corrective actions
sufficient to deal with the incident?
• Did members of the response team clearly
understand their roles and responsibilities?
• Was the internal and external
communication clear, timely and useful?
•
Is additional training required for users or
members of the response team?
3. Recovery
According to the NIST Special Publication
800-61, Computer Security Incident Handling Guide,
after detecting and assessing an incident,
the priority for an organization should be to
contain the threat to prevent further damage.
This containment could include taking a
compromised server offline, disabling user
accounts or removing an infected desktop
from the corporate network. By containing
the threat, the organization gains time
to review its recovery options and gather
evidence to file a cyber insurance claim, report to local and federal
authorities or to retain as legal evidence.
After the threat has been contained, in most cases, the next step is
• Could better detection technology have
uncovered the threat faster?
• What can be done to prevent or mitigate
this type of threat in the future?
• Were customers, vendors, suppliers or other
stakeholders affected by the attack?
• Are there legal repercussions (i.e., stolen
sensitive customer data)?
• Was sufficient forensic evidence obtained to
satisfy any cybersecurity insurance claims?
incident response plan after a major
breach. Typically, a postmortem meeting should
be held shortly after a significant incident, and
all participants (including third parties that
support the plan) should take part. The objective
is to gather the facts, chronicle a timeline of the
attack and document an unbiased assessment of
the incident.
The fact gathering consists of investigating
the cause of the event, detailing obstacles that
slowed the process down and confirming the
response team followed documented procedures.
Next, the existing process should be re-evaluated
to determine if the response team would do
something different if faced with the same threat
and if there are any changes to operations or key
personnel that could affect the plan.
One best practice is to use a scorecard to
survey the response team after each incident
to gain real-time feedback on strengths and
weaknesses in the process. The scorecard also can
reveal trends in the recovery process that remain
chronic trouble spots from incident to incident.
It also can be used to track key performance
indicators as to whether the organization was able
to recover critical operations within the stated
recovery time objectives.
Other measures can include the adequacy
of tools and resources used to resolve the threat,
the amount of damages (i.e., ransom paid,
downtime, negative customer experience), and
the performance of cybersecurity consultants and
third parties who assisted in the response effort.
to eradicate all instances of the malware and remediating the security
risks exposed from the breach. Some cybersecurity experts recommend
developing an incident response kit that contains the necessary tools
and hardware to eradicate most threats and promptly conduct a digital
forensics investigation during or after an attack.
The NIST Special Publication 800-184, Guide for Cybersecurity
Event Recovery, has several recommendations to help organizations
in the recovery phase. A few suggestions include planning how the
organization can continue operations in a reduced capacity as services
are resumed, ensuring that the recovery effort does not tamper with the
forensic evidence and formally outlining the conditions under which a
recovery plan should be activated.
Vijay Jagar, chief technology officer for the Alameda County
Employees’ Retirement Association, cautions that organizations should
perform regular testing of their backup and recovery process to ensure
that systems can be restored with minimal impact to the operations.
He described a recent ransomware attack where a user clicked on a
link to a malicious file that began encrypting files on the user’s desktop
and a shared drive. With an effective backup and recovery process, the
organization was able to eradicate the ransomware, restore the data and
resume normal operations within a few hours.
4. Postmortem
The purpose of the postmortem is to re-evaluate the effectiveness of the
Final Thoughts
According to Deron T. McElroy, chief of operations of the
Cybersecurity Advisor Program for the U.S. Department of Homeland
Security, it’s essential to have a plan, test and revise the plan, and ensure
everyone understands their role—including senior management. With
constant changes to business processes, personnel and the IT portfolio
of networks, systems and databases, it’s crucial to test the incident
response plan on a periodic basis.
Some cybersecurity experts recommend developing specific cyberbased
scenarios (i.e., ransomware attacks, phishing attacks) and running
through the rigor of a full disaster recovery exercise based on that type
of attack. Other experts recommend creating a “skeleton crew,” a
subset of key individuals from the larger incident response team, who
are tasked with responding to an incident during non-working hours or
on a holiday, when it would be difficult to deploy the entire team.
Establishing an incident response plan that clearly describes the
protocols, necessary communication (internal and external), and roles
and responsibilities is a good start. Preferably, it should tie into the
organization’s disaster recovery plan. Part of an effective risk-mitigation
strategy also should be to share and transfer some risks; therefore,
obtaining cybersecurity insurance should be a cornerstone of the
overall incident response plan.
Harsh Jadhav, CPA is the chief of internal audit at the Alameda County
Employees’ Retirement Association and a member of the CalCPA
Technology Committee. You can reach him at hjadhav@acera.org.
8 2 0 1 8 TECHNOLOGY & BUSINESS RESOUR CE GUIDE CALIFORNIA CPA
www.calcpa.org/TBRG
Right click(Command + click) your mouse on the magazine pages to pop up a Quick Menu of the most used reader features:
To open up additional features, hover over or click on the arrow on the left. You can pin this pull-out menu to have it remain visible (or close by clicking on the push pin ). Included in this tab:
A: Our print feature relies on your web browser's print functionality - and how that browser communicates with your specific printer. If you note that pages are getting cut off, or you are having other issues when printing, it is likely that you need to adjust your printer's settings to scale to fit page.
Alternatively, if there is a PDF Download option available you can download the PDF first and then print using Adobe Acrobat Reader’s print feature. There are known issues in printing fom Internet Explorer 7, so if you are using this browser, you may wish to try a different one. If you are able to print from your browser normally but are having issues specifically with printing pages from the magazine, then please contact technical support.
Thank you for sampling the digital edition of California CPA To continue reading this issue, you must be a subscriber.
If you are a subscriber, you must log-in before you can continue viewing the digital edition.
Click here to log-in
If you are not yet a subscriber:
Click here to join.