You need to quickly contain the problem considering which part of kill chain your adversary is in. You to need contain and neutralize the impact of the incident by possibly shutting down specific services/servers/segments.
With the rush for Working From Home, organizations are overwhelmed with employees using video conferencing technologies, from Slack, Skype and Discord to GoToMeeting, Zoom and Webex. What are your security teams supposed to do when incidents like Fairfax school strike? Do they have the basic steps and planned approach to handle the events?. In this page we cover the top tips to analyze and mitigate/contain/remediate […]
Companies need to respond to a data breach in such a way that it’s crystal clear to all related. Lets explore state-of-art remediation practices.
If short on time directly jump to the playbooks section. Summary Any attempt to compromise a system and/or steal information by tricking a user into responding to a malicious message. The most common phishing attacks involve emails armed with malware hidden in attachments or links to infected websites, although phishing can be conducted via other methods such as voicemail, text messages, and social media, too. […]
Most major cyber attacks have a lot of early warning signals coming in, so early detection helps a lot and gives time for incident response. Logs for Incident Response https://www.first.org/resources/papers/conference2008/chuvakin-anton-slides.pdf Best practises for Event Logging Benefits of continuous and aggressive monitoring of your Event Logging:Enhanced Visibility: Gain a deeper understanding of network activity and potential threats.Faster Incident Response: Early Detection and quick response to security […]
Enterprises are going to adopt a wide range of Generative AI use cases. The security teams need to understand them, and how they are built so they can eventually protect it better. Here we are learning from the perspective of Incident Response to cyber attacks on the AI platforms. Case study 1 – A great CTI tool – Neutocti This project gives a great insight […]
There is no excerpt because this is a protected post.
Case studies help a lot in understanding how other companies respond to a crisis situation. What is the learning our organisation can take from it? Can we do a table top exercise using this as a scenario? Our approach – Reuse as much operational knowledge gained by your peers who have already handled attacks. Most of them are kind enough to help you provided you […]
Preparedness is key to handling a massive cyber attack. Below are steps that we believe will aid you to be confident and respond effectively. Our approach of using visually easy and simple Playbooks will aid in developing the strong muscle memory required while mitigating an attack. First, know whom to call. Please first ensure you are able to quickly mobilize all the help required and […]
The art of understanding what a crisis is and managing it is key. Enterprises need to have clear Blueprints and Frameworks established to respond to a crisis like a Ransomware attack:1. Incident Response Plans with defined roles and responsibilities2. Playbooks with the course of actions (CoA) to respond – both technical and management levels.3. A system to regularly conduct TableTops and drills – clear after-action […]
FlexibleIR in association with DSCI and CERT India has created a unique Ransomware Rapid Response 2-day Bootcamp program. Tens of organisations are better prepared for a crisis!. Here we conduct drills and build Playbooks to ensure the organization is prepared technically and from the management perspective too. Key points on the BootCamp1. BYOP – Build your own visual playbooks for Rapid Response and compare them […]
A visually easy Incident Response Playbook to defend against cyber attacks related to current Geo-Political conflict – https://board.flexibleir.com/b/Pijsre9DwPMtSgBNY/templatenistv01 The current conflicts could increase the number of cyberattacks. Organizations could be directly targeted or be collateral victims in most cases. GOAL: Every organization — large and small — must be prepared to respond to disruptive cyber activity.
If short on time directly jump to the playbooks section. It is key to follow new reports continuously as newer discoveries and developments are happening. Ensure to see article time stamps. Quick SANS video – https://www.youtube.com/watch?v=oC2PZB5D3Ys Playbook Mitigations Apply Patch Log4j versions upgraded to log4j-2.15.0-rc1. Test first on non-production systems. In case not able to apply the patch For version >=2.10: set log4j2.formatMsgNoLookups to true. […]
If under attack, quickly do the scoping and plan for containment. Download an Authoritative Write-Up (if available) for the Specific Ransomware Variant(s) Encountered. Harvest additional Indicators from the Report(s). Mobilize the team and remember to take as much help as possible. Ransomware operations will mostly have similar patterns of attack frameworks, tools, and techniques across victims. They will also have similar operations as other Ransomware […]
Be prepared for a cyber attack. Gain access to best practice playbooks. Get updates.