13.2.2.13 Lab - Incident Handling

Lab – Incident Handling
Objectives
Apply your knowledge of security incident handling procedures to formulate questions about given incident
scenarios.
Background / Scenario
Computer security incident response has become a vital part of any organization. The process for handling a
security incident can be complicated and involve many different groups. An organization must have standards
for responding to incidents in the form of policies, procedures, and checklists. To properly respond to a
security incident, the security analyst must be trained to understand what to do, and must also follow all of the
guidelines outlined by the organization. There are many resources available to help organizations create and
maintain a computer incident response handling policy, but the NIST Special Publication 800-61 is specifically
called by the CCNA CyberOps SECOPS exam topics. This publication can be found here:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Scenario 1: Worm and Distributed Denial of Service (DDoS) Agent Infestation

Study the following scenario and discuss and determine the incident response handling questions that should
be asked at each stage of the incident response process. Consider the details of the organization and the
CSIRC when formulating your questions.
This scenario is about a small, family-owned investment firm. The organization has only one location and less
than 100 employees. On a Tuesday morning, a new worm is released; it spreads itself through removable
media, and it can copy itself to open Windows shares. When the worm infects a host, it installs a DDoS agent.
It was several hours after the worm started to spread before antivirus signatures became available. The
organization had already incurred widespread infections.
The investment firm has hired a small team of security experts who often use the diamond model of security
incident handling.
Preparation:
I'll check all forms of malware and the IP address to ensure that all PCs are safe,
_______________________________________________________________________________________
set up trusted anti-virus, keep track of any update, and do a lot of research on
_______________________________________________________________________________________
current worms to learn how they function.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Page 1 of 3 www.netacad.com
Detection and Analysis:

My first step in detecting and analyzing threats is to run anti-virus software to
_______________________________________________________________________________________
identify viruses and verify that all software is up to date. After that, I'll look for the
_______________________________________________________________________________________
next target by scanning the IP address. Adjacent IP addresses are a good place and
_______________________________________________________________________________________
look to see if a host is compromised. Every legal program, in general, runs in a
_______________________________________________________________________________________
specific network location. Worms, on the other hand, must locate a target. We can
_______________________________________________________________________________________
safely conclude that the worm has been identified if the number of IP addresses
_______________________________________________________________________________________
scanned by the host reaches a certain threshold.
_______________________________________________________________________________________
Containment, Eradication, and Recovery:
Any mechanism that exhibits abnormal behavior will be quarantined immediately.

_______________________________________________________________________________________
After isolating the process, it must be controlled for a period of time that
_______________________________________________________________________________________
corresponds to the process's erratic behavior. The mechanism can be released if it
_______________________________________________________________________________________
does not exhibit deviant behavior during monitoring. It is quarantined and labeled
_______________________________________________________________________________________
as a worm if it exhibits the same activity repeatedly.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Post-Incident Activity:
To decide if any confidential information has been compromised, the device log file
_______________________________________________________________________________________
must be examined. To detect the virus, I must immediately alert the customer.
_______________________________________________________________________________________
Before being able to link to the network, hosts that are not currently on the network
_______________________________________________________________________________________
must be found and scanned.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Scenario 2: Unauthorized Access to Payroll Records

Study the following scenario. Discuss and determine the incident response handling questions that should be
asked at each stage of the incident response process. Consider the details of the organization and the CSIRC
when formulating your questions.
This scenario is about a mid-sized hospital with multiple satellite offices and medical services. The
organization has dozens of locations employing more than 5000 employees. Because of the size of the
organization, they have adopted a CSIRC model with distributed incident response teams. They also have a
coordinating team that watches over the CSIRTs and helps them to communicate with each other.
On a Wednesday evening, the organization’s physical security team receives a call from a payroll
administrator who saw an unknown person leave her office, run down the hallway, and exit the building. The
administrator had left her workstation unlocked and unattended for only a few minutes. The payroll program is
still logged in and on the main menu, as it was when she left it, but the administrator notices that the mouse
appears to have been moved. The incident response team has been asked to acquire evidence related to the
incident and to determine what actions were performed.
The security teams practice the kill chain model and they understand how to use the VERIS database. For an
extra layer of protection, they have partially outsourced staffing to an MSSP for 24/7 monitoring.
Preparation:
I'll see that equipment, such as surveillance cameras, are mounted on the device.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Detection and Analysis:
I'll attempt to gain access to the access control and security camera systems in
_______________________________________________________________________________________
order to obtain evidence if an intruder is present.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Containment, Eradication, and Recovery:
I_______________________________________________________________________________________
scanned for facts and reported on who was involved as well as the aftermath. Take
steps to reduce the effect, inform the appropriate agency, and preserve evidence if
_______________________________________________________________________________________
necessary.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Post-Incident Activity:
I'll teach people who manage organizational information how to prevent similar
_______________________________________________________________________________________
accidents in the future, and I'll recommend increased personal security and improved
_______________________________________________________________________________________
access control.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________

13.2.2.13 Lab - Incident Handling

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

13.2.2.13 Lab - Incident Handling

Uploaded by

Copyright:

Available Formats

Lab – Incident Handling

Scenario 1: Worm and Distributed Denial of Service (DDoS) Agent Infestation

Detection and Analysis:

Any mechanism that exhibits abnormal behavior will be quarantined immediately.

Scenario 2: Unauthorized Access to Payroll Records

You might also like