# Presentation: 430439

## Developing and Implementing a CIRT Team

- Nanette S. Poulios, CISSP, CISM
- Senior Training Consultant
- Easy i

## Today’s Agenda

- Why does anyone need a CIRT?
- How do you create a CIRT?
- What do you need to manage and train a CIRT?
- Impediments to a successful CIRT
- Case Studies

## Why Does Anyone Need a CIRT?

## Incidents on the Rise

- Number of incidents reported to CERT/CC increased:
- 21,756 in 2000
- 52,658 in 2001
- 82,094 2002
- 137,529 in 2003 **
- ** http://www.cert.org/stats/cert_stats.html

## Legal and Regulatory CIRT Requirements

- HIPAA 45 C.F.R. Part 164.308(a)(6)
- FTC Safeguards Rule C.F.R. 314.4(b)(3)
- “*Detecting, preventing and responding to attacks, intrusions, or other systems failures**”*
- OCC Safety and Soundness Standards C.F.R. Part 30 Appendix B III (c)(g)
*“**Response programs that specify actions to be taken when the bank suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies**”*

## Legal and Regulatory CIRT Requirements (2)

- GLB Act
- Sarbanes-Oxley
- Basel Principle 14
*“**To ensure effective response to unforeseen incidents, banks should develop:*
*    **Incident response plans to address recovery of e-banking systems and services under various scenarios, businesses and geographic locations. Scenario analysis should include consideration of the likelihood of the risk occurring and its impact on the bank. E-banking systems that are outsourced to third-party service providers should be an integral part of these plans”*

## Best Practices CIRT Requirements

- ISO 17799
***6.3.1 Reporting security incidents***
*“**Security incidents should be reported through appropriate management channels as quickly as possible. A formal reporting procedure should be established, together with an incident response procedure, setting out the action to be taken on receipt of an incident report.”*

## Best Practices CIRT Requirements(2)

***8.1.3 Incident management procedures***
*“**Incident management responsibilities and procedures should be established to ensure a quick, effective and orderly response to security incidents (see also 6.3.1). The following controls should be considered.*
*a) Procedures should be established to cover all potential types of security incident,including:*
*1) information system failures and loss of service;*
*2) denial of service;*
*3) errors resulting from incomplete or inaccurate business data;*
*4) breaches of confidentiality**.”*

## Best Practices CIRT Requirements(3)

- “The Federal Information Security Management Act (FISMA) of 2002 requires Federal agencies to establish incident response capabilities.” *
- Requires the agency to select a team
- Staff the team
- Train the team
- *NIST COMPUTER SECURITY INCIDENT HANDLING GUIDE SP800-61

## Best Practices CIRT Requirements(4)

- OMB Circular No. A-130, Appendix III,
- “ensure that there is a capability to provide help to users when a security incident occurs in the system”

## Business Practices Requiring a CIRT

- Fiduciary Responsibility
- Liability Avoidance
- Survivability

## Security Event Definition

- Not just attacks
- My include any negative or unexpected behavior
- System crashes
- Policy violations
- Examples:
-  Denial of Service,
- Malicious Code,
- Unauthorized access,
- Inappropriate usage

## How Do You Create a CIRT?

## Authority

- Corporate/Agency policy must provide for CIRT creation
- Board of Directors approval is recommended
- Top level management supports the CIRT and releases a formal statement
- CIRT reports to upper level management, not IT

## Mission of the CIRT

- Provides clear understanding of goals and objectives
- Communicates these goals and objectives to others
- Prevents misunderstandings in a crisis situation
- Optional purpose statement to gain support

## Sample Mission Statement

*“**The objective of the CIRT is to investigate apparent intrusion attempts and report their findings in a timely manner to executive management.  The CIRT provides a centralized approach to managing computer security incidents so that current incidents can be controlled as quickly as possible to avoid serious damage to XXX systems and future incidents can be prevented.  Additionally, the CIRT will provide increased security awareness so that XXX’s computer systems will be better prepared and protected in the future.”*

## Responsibilities of CIRT

- Vary by organizational needs
- Proactive Examples
- Awareness programs
- Technical publications
- Advisories
- Vulnerability and Penetration testing
- Reactive
- Incident Response
- Malicious Code analysis
- Liaison with law enforcement
- Incident Post-mortem and Reporting

## Operating Policies and Procedures

- CIRT should be governed by organizational and regulatory policies
- Approved by management
- CIRT should follow a standard operating procedure
- Provide complete and concise documentation
- Review periodically for updates
- Revise after post-mortem review

## Team Composition

- Core Members
- Determine if the incident warrants further investigation
- Categorize the security incident
- Add support members to the investigation if  necessary
- Support Members
- Provide needed technical expertise as required
- Member of the team for the duration of the incident

## Core Members

- IT Audit
- IT Security
- Corporate Security
- Legal

## IT Audit Member Role

- Ensure that best practices are followed
- Ensure the auditability of the investigation process
- Ensure that chain of custody procedures are followed correctly
- Maintain accountability for all evidence collected during the investigation
- Document investigation

## IT Security Member Role

- Inform all other users that are affected by the security incident of the necessary actions to control the incident.
- Perform appropriate backtracing, forensic analysis and other technical tasks required by the investigation
- Provide an analysis of the incident including root causes
- Compile the final report and recommendations of the CIRT
- Be available as an expert witness

## Corporate Security Member Role

- Provide a liaison with law enforcement
- Ensure that investigative best practices are followed
- Contain the incident locale as appropriate
- Manage the interview process for witnesses and suspects

## Legal Member Role

- Brief other core and support members on privacy, 4th Amendment, search and seizure and wiretap issues
- Ensure that suspects’ rights are protected appropriately
- Act as spokesperson with the media
- Review any press releases before they are released to the media
- Review any management reports
- Act as liaison with outside legal counsel

## Support Members

- Platform Specialist
- Financial Auditor
- Fraud Examiner
- Personnel
- Public Information Officer/Public Relations

## Platform Specialist Support Role

- Review audit logs and report any unusual or suspect activities
- Report any unusual behaviors of the critical systems
- Be prepared to brief the CIRT on operations procedure
- Protect evidence of incident according to organizational guidelines and instructions of the core team

## Platform Specialist Support Role (2)

- Assess and report damage to system and/or data to CIRT
- Aid in the determining the scope of the intrusion
- Aid in identifying the point of access or the source of the intrusion
- Make recommendations to close the source or point of access of  the intrusion

## Financial Auditor Support Role

- Be prepared to brief the team on financial procedures
- Be prepared to conduct a financial audit if the core team deems it necessary for investigative reasons
- Report findings to the CIRT
- Follow investigative procedures as determined by the CIRT

## Fraud Examiner Support Role

- Aid the core members of the CIRT in discovery and recognition of fraud
- Follow guidelines for lawful search
- Follow organizational and legal privacy policies/requirements
- Aid in identifying objects and materials used to commit suspected fraud

## Fraud Examiner Support Role (2)

- Preserve, using CIRT guidelines, any evidence collected until transported to CIRT
- Transport evidence to CIRT for safekeeping until resolution of investigation
- Report findings to the CIRT

## Personnel Support Role

- Advise the core members on personnel policies and procedures
- Make recommendations for handling sensitive employee information

## Public Information Officer Support Member

- Act as a single point of contact  for the media.
- Obtain legal advice before any interview or press release is given to the media
- Obtain approval from the CIRT that any interview or press release will not 	interfere with the investigation.
- Inform all other affected users to refer any media inquires to the Public 	Information Officer.

## What do you need to manage a CIRT?

## Team Leadership

- Management will appoint a team leader from the Core membership of the team
- Duties will include:
- Convene the CIRT
- Contact the Chief Information Officer (or other designated Officer)
- Conduct meetings of the CIRT
- Periodically report status of investigations to the CIO
- Manage investigations

## Team Leadership (2)

- Duties Continued
- Take responsibility for verifying chain of custody of evidence
- Coordinate team activities
- Appoint support members as required for particular investigations
- Present findings to management
- Monitor the investigation

## CIRT Team Responsibilities

- The CIRT is an investigative body only.
- Does not make policy or take action following an investigation
- The CIRT is a completely independent body.
- It receives its direction from the Chief Information Officer, but is accountable directly to the General Manager or the General Manager’s appointee

## CIRT Team Responsibilities (2)

- Determining if an event constitutes an investigative security incident
- Conducting an appropriate investigation to determine the root cause, source, nature, extent of damage and recommended response to a computer security incident.
- Preserving evidence of the incident
- Interviewing witnesses and suspects

## CIRT Team Responsibilities (3)

- Providing appropriate liaison with law enforcement and outside legal counsel
- Managing the release of information to the media
- Managing interaction between Human Resources and witnesses, suspects, organized labor and other appropriate interested parties
- Preparing a report of findings, root causes, lessons learned and recommended actions for management review

## CIRT Team Responsibilities (4)

- Carrying out the directions of management communicated through the Chief Information Officer
- Containing the incident scene to prevent contamination of evidence

## Core Team Training Requirements

- Legal 4th amendment, privacy, and lawful search issues
- Organizational policies and procedures
- Investigative process
- Storing and transporting evidence according to legal guidelines
- Vendor training on all current detection and investigative tools

## Core Team Training Requirements (2)

- Collecting, preserving and analyzing evidence of a computer security incident
- Procedures for coordinating with outside organizations such as CERT, FIRST 	and law enforcement

## Support Team Training Requirements

- Legal 4th amendment, privacy, and lawful search issues
- Review organizational policies and procedures
- Investigative process
- Storing and transporting evidence according to legal guidelines
- Technical training on all platforms, operating systems and applications that member is responsible for including new technologies

## Continuous Training Requirements

- Updates in tools used in their investigations
- Updates in investigative and forensic techniques
- Updates in appropriate technologies
- Updates and changes in laws, regulations and internal policies that affect investigations
- Periodic simulation drills

## Impediments to a Successful CIRT

## Impediments to a Successful CIRT

- Lack of management support
- Lack of procedures and policy
- Lack of access to evidence due to outsourcing
- Lack of event readiness within organization
- Lack of qualified personnel
- Lack of training

## Case Studies

## Case Studies

- Superbowl Slammer Incident
- Watchful Team Incident
- Blackout Incident

## ?

**?**

**?**

**?**

**?**

**?**

**?**

**?**

## Resources

- _[http://www.sei.cmu.edu/pub/documents/98.reports/pdf/98hb001.pdf](http://www.sei.cmu.edu/pub/documents/98.reports/pdf/98hb001.pdf)_
- _[http://www.cert.org/tech_tips/incident_reporting.html](http://www.cert.org/tech_tips/incident_reporting.html)_
- _[http://www.sans.org/rr/papers/27/641.pdf](http://www.sans.org/rr/papers/27/641.pdf)_
- _[http://csrc.nist.gov/publications/nistpubs/800-61/sp800-61.pdf](http://csrc.nist.gov/publications/nistpubs/800-61/sp800-61.pdf)_
- _Investigating Computer-Related Crime_, CRC Press by Peter Stephenson

## Contact InformationNanette S. Poulios, CISSP, CISM

***	******Senior Training Consultant ******Easy I ***
***	***248-705-0710 (direct)
- 	248-375-2315 fax
**	**_[nan.poulios@easyi.com](mailto:nan.poulios@easyi.com)_
**	**_[nspoulios@comcast.net](mailto:nspoulios@comcast.net)_