Don’t Panic! Case Studies of 不要惊慌案例研究 FIRST FIRST.pptx

Don’t Panic! Case Studies of Incident Response from the Field Kristy Westphal Information Security Officer Element Payment Services Agenda Practice practice practice. Look at experiences from incident handling of various types of organizations (financial, health care and government) Walk through the initial scenario. Look at what was done. After which we will discuss what could have been done differently to improve the response. Each scenario will be information security/technically focused. My poor bleeding heart OK, we might have panicked a little here Facts: High impact, widespread vulnerability is published IT/Security take a look; no OpenSSL in production Assessed as no/low risk Then all heck broke loose Customers started asking questions Unsure of path to come up with messaging Needed to get answer quickly After a little chaos, took collective breath, came up with response So…lessons learned? Don’t panic Figure out what truly applies and what does not (e.g., has an incident actually occurred?) Know ahead of time how a response should go out Practice how this will work Stay updated on any new developments Other thoughts? In ITIL terminology, an ‘incident’ is defined as: “An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet impacted service is also an incident, for example failure of one disk from a mirror set. Incident Management is the process for dealing with all incidents; this can include failures, questions or queries reported by the users (usually via a telephone call to the Service Desk), by technical staff, or automatically detected and reported by event monitoring tools.” And how do you define this based on IaaS, PaaS and SaaS? What is an incident? How easy is that to put your finger on? Everything is always an incident Especially when my thing is broken Which makes it even harder to figure out and address the REAL incidents! So what do you do? (groan) You need a p