7. Security Toolkit: When you Experience an Incident

When You Experience an Incident

Every cyber incident is different if for no other reason that each provider's technology environment and user practices are different than sister organizations. The process of dealing with and responding to an incident will vary. Here, we've outlined some of the common things to consider if (or when) an incident occurs. This outline is not one-size-fits-all. Instead, you can use these bullet points to think through what questions to ask and what actions to take. This outline can help organizations develop plans before an attack has ever occurred, and it can help organizations experiencing an attack to determine what to do next.

1. Investigate whether you have been attacked/compromised immediately
   
   1. Helps to have a well-trained team of staff and volunteers who can serve as an early warning team on any suspicious behavior or changes to their environment
   2. Assume that any significant changes in performance, account access, or notifications from other organizations, your Internet or cloud providers that indicate strange behavior (e.g., lots of spam from your org, network congestion from your ISP, unusual Internet traffic patterns, etc.) are potentially signs of either an attack (DDOS) or a compromise (successful attack). 
   3. Attacks or compromises might be seemingly limited but assume that they will grow/get worse.
   4. Move quickly to assess and act; be prepared to take action before you are certain your systems have been compromised – may have a false positive which isn’t the worse thing in the world. 
   5. Before an attack, your executive team should collect and verify contact information (personal email addresses and phone numbers) for all staff members. In the initial stages of a security incident, most systems will be considered untrusted and/or locked down thus preventing normal methods of communication.
   6. Work with your security provider, your EDR vendor, your SIEM vendor or even use your firewall and system logs to help identify/confirm problems.
   7. An attack with cryptoware may be noticed by users before it has completed its spread and encryption – so shutting down or cutting off access may limit damage.
       
2. Consult and follow your cyber security incident response policy.
    
3. If you don’t have a cyber incident response policy, consider:
   
   1. Communicating with your leadership via out-of-band phone, text, chat, etc.
   2. What your IT and leadership team understand about how the attack was able to gain access the environment is tentative knowledge and may be wrong.
   3. If you have cybersecurity insurance, contact your agent.
   4. If you have cybersecurity counsel or general counsel, contact them.
   5. Designating an incident captain, coordinator, or manager - typically/ideally not someone from the IT team.
   6. Communicating with your staff as appropriate on what they can expect and what they can communicate to others.
   7. With respect to communications, despite any initial conclusions with respect to the nature of the incident and its impact, the organization should expect those conclusions may be wrong or may represent only a partial understanding of the incident.
   8. Generally, don’t communicate about a potential incident publicly or with third parties until advised by your leadership or counsel.
   9. Talking to your tech team / tech partners for additional assistance.
   10. Attempting to isolate and shutdown access to systems.
       1. Where possible maintain remote connectivity for IT to manage access.
       2. Restrict inbound and outbound firewall traffic to only IT personnel/remote connectivity from trusted public Ips.
       3. Limit or stop traffic across all endpoints. For instance, on virtual servers, disable the virtual NIC.
       4. Talk with your cloud service providers about limiting or stopping traffic (case management, document management, email, etc.)
       5. Reset all passwords, including administrators, users, service accounts, temp accounts, guest accounts, etc.
       6. Review user accounts for anything that may have been suspiciously added.
       7. Talk with your cloud service providers about doing the same (case management, document management, email, etc.).
       8. Collect and backup all log information from all systems including servers, firewalls, VPNs, email, etc.
       9. If there is a ransomware note or a malicious email, get a copy of it.
       10. Take screenshots of any unusual activity, such as logins from unknown accounts, antivirus/EDR pop-ups, configuration changes, etc.
       11. Create a detailed timeline of all events from the moment you became aware of the security incident.
       12. Be careful not to alter/delete any potential evidence that can be used by the forensics company.
       13. Attempt to identify the source of the security breach. The compromise may have occurred from malware, phishing email, misconfigured firewall rule, zero-day exploit, easily guessable password, etc. Check all servers and networking devices (i.e., firewalls, VPNs, email, etc.) for suspicious login activity.
   11. If you don’t have cybersecurity insurance, you will likely need to:
       
       1. Get IT and legal help from partners who have worked on cyber incidents. 
   12. Working quickly to mitigate the damage.
   13. Getting outside expertise to Investigate the incident, determine the extent of the damage, determine, to the extent possible, whether there was data access or exfiltration.
   14. Decide whether and how to negotiate with the criminals involved - there are firms that specialize in these negotiations.
   15. Plan for and securely restore technology services:
       1. Consult with your insurance/security/legal teams before proceeding.
       2. May need to do this on alternative physical or virtual network and system environment in case confidence is low that the security breach has been identified or if you need the affected environment for forensic analysis.
       3. Will likely need to greatly expand logging and monitoring of the environment.
       4. Likely need to install EDR software.
          
          1. May need to prioritize which services to restore.
       5. May want to avoid restoring unnecessary or out-of-date, insecure systems or network infrastructure.
          
          1. Assume that accounts and access can be compromised again.
          2. Consider MFA deployment across all systems on an expedited basis.
          3. Review privileges and limit to the extent feasible.
          4. Modify password policies to be more stringent, if necessary.
          5. Consider modifying any sharing policies/configurations that were previously in place (i.e., disable sharing via anonymous links).
          6. Adjust or implement stronger email security systems to protect against malicious attachments/links and email security attacks such as phishing and business email compromises (BEC).
          7. Provide users with security awareness training.
          8. Restrict who has remote access (if that is even possible with COVID).
          9. Review firewall rules for any old/unused rules and disable them.
          10. Revise firewall rules to be more restrictive.
       6. Monitor electronically and with all users on high alert.
       7. Decide what changes to make to improve security (to avoid a repeat attack).
   16. Work on communications/compliance as necessary (regulators/government entities, funders, clients, employees, and the public).

3. Complications
   
   1. Backups are not comprehensive, up-to-date, and accessible.
      
      1. Not certain whether the backups have backed-up the security compromise – might be restore access/backdoor.
   2. Not enough capacity in the environment to setup the restored environment.
   3. It may take a long time to recover massive data, especially when restoring from cloud-based backups on slow internet connections.
   4. Criminals are posting exfiltrated data on the dark web/shame sites.
   5. Criminals sell reconnaissance information to other criminals. There is potential for another attack.
   6. Forensic analysis is inconclusive.
   7. Not enough/inaccessible IT documentation to rebuild the environment. May be missing installer packages for critical software or detailed configurations needed for certain connections/applications.
   8. Outdated IT credentials to access systems or networking devices.

Have Insurance

Cyber insurance is essential in helping your organization recover after a data breach. Insurance can help with costs that can include business disruption, equipment damage, legal fees, public relations expenses, forensic analysis, and costs associated with legally mandated notifications. Insurance also helps companies comply with state regulations that require a business to notify customers of a data breach involving personally identifiable information.

Cybersecurity insurance policies can also cover customer notifications in the event of a breach, an option to monitor the information of anyone impacted for a specified period, and payment of costs incurred in the recovery of compromised data.

Identification of an Incident

Typically, most legal aid providers identify a possible incident when system performance or access issues, including access to files, becomes an issue that users bring to their IT team.  It also happens that another user working for another organization in the community gets spam from the legal aid organization contacts the users they typically work with to alert them, or some law enforcement agency reaches out to inform the provider that they may be a victim of an incident.  (It is important that such a notification by third parties be screened as possible cyber-attack itself.)

Generally, the earlier an incident is identified, the better.  Early identification helps limit access, damage, and costs while improving the ability of forensic experts to determine the cause of the incident and the security lapses that need to be addressed.  Increasingly, organizations are using more sophisticated tools, such as endpoint detection and response (EDR) software, and security services, such as third-party provided security information and event management (SIEM) services, to monitor and identify incidents earlier and intervene more quickly to stop an incident before the access or damage is more significant.  Any monitoring might lead to false positives that might in term lead to unnecessary stress and response.  It is important to work with your IT team/partner to tune any monitoring tools to reduce the number of false positive alerts.  Typically, this work takes weeks or possibly longer after new systems are implemented.  Similarly, training users on cyber security awareness will help improve the quality of user reporting on odd email and performance issues. 

Common Cyber Attacks

The FBI recently released its 2022 report on 2021 Internet Crime that is worth reading or skimming to get a better sense of the prevalence of different cybercrime.  Another great resource is from Fortinet, a security hardware, software and services firm, on the top 20 cyber-attack types.  Visit their web page for a plain language understanding of the different attack types and what organization can do to help prevent them. 

Exercise: Sample Incident and Response

Below is a fact pattern describing a typical data breach. It outlines several actions taken by a member of staff in one column, and in the second column it outlines a list of places to review from the toolkit while considering the fact pattern. Try to spot the things the member of staff has done that increase risk. Think about what you would do in that situation. Use the fact pattern as a tool for discussing security with the rest of your office.