Incident Reponse: What Not To Do

12 March 2009 by Jeff Hayes.

In my ITT Tech Windows Server and security class this week, I had my students read and discuss an anonymously written article from the February and March issues of CSO magazine:  “Undercover:  The Company That Did Everything Wrong.”

It was written from a security consultancy’s perspective. It was brought in two days after a phishing email opened up the entire organization to a Russian hacking group. This group was using the targeted company as a hacking demonstration from a hacker conference in St. Petersburg. Some of the lessons learned were:

• Have an IT staff large enough to support the size, scope and mission of the company.
• Routers, firewalls, servers all keep logs: don’t turn logging off, secure regular back-up copies, and make a habit of reviewing the logs on a somewhat regular basis.
• Educate employees on email phishing.
• Have an incident response plan.

It is impossible to plan for everything, but a little bit of planning can go a long way when an incident does occur.

Most of my students will handle a full range of IT functions in a small company, less than 100 employees. They will be tasked from everything from desktop and server configuration to switch and router ownership, from firewall and overall information security to physical security. Not a week goes by that I do not hammer home the importance of a) thorough and well-written security policies, b) a test bed for all supported systems and c) an incident response plan that is re-evaluated, updated and assessed on a regular basis.

The California company in this two-part article did everything wrong. But they were smart enough to bring in some people that could assess the situation and take corrective action. Learning from our mistakes should be the common denominator for all of life’s mishaps.

Posted in Incident Response | Print | 1 Comment »