Incident Management

The IT Infrastructure Library (ITIL) developed and released a series of agile incident management processes in the ITIL version 4. This most recent version discusses the 5 steps you should be following throughout an incident management lifecycle:

1. Incident identification
2. Incident logging
3. Incident categorization
4. Incident prioritization
5. Incident response

Overall, incident management is the process of addressing IT service disruptions and restoring the services according to established service level agreements (SLAs). What starts with a user reporting an issue should ideally end with the service desk fixing the issue as fast as possible.

When it comes to the major incident management best practices, they’re best understood when you zoom out and look at the whole picture.The digitalization of the modern world has forced companies to reevaluate their security posture and how they respond to major incidents like network outages. 

As more organizations adopt cloud computing solutions into their IT infrastructure, there is a greater need to strengthen cloud security. The NIST provides recommendations for optimizing cloud security to help organizations safeguard their cloud computing assets. Read on to learn how a cloud security policy NIST recommendations can bolster your cloud security.

Everyday the threat landscape evolves, and your organization has to adapt or die. Preparing for the onslaught of attacks that occur on a daily basis is fundamental to that adaptation. A well thought out, rehearsed plan allows your organization to counter new technologies and methodologies in the hands of hackers. This plan is formally called a Computer Security Incident Response Plan (CSIRP), and every company must have one. In fact, if your organization does business with the government, such as working for the DoD, it is a legal requirement.

Systems for preventing and mitigating cyberattacks are constantly adapting to attackers’ innovations and ways of bypassing or undermining protections. This is one reason that password spraying emerged as a threat, in response to one of the most effective defenses against brute force attacks. So, what is password spraying, and how can you prevent it?

Whether you have a small, medium, or large cybersecurity infrastructure, reducing its attack surface minimizes your risk of being compromised. Implementing attack surface management is critical to securing your assets, mitigating cyberattacks, and reducing the likelihood of data breaches. Read our blog to learn more.

As social engineering attacks like vishing become more prevalent, many organizations are now  asking, “what is vishing, and how can we prevent it?” Cybercriminals use phone calls and other vishing tactics to compromise sensitive data from unsuspecting individuals. Read on to learn more about these attacks and how to prevent them.

 

What is Vishing? A Primer to a Common Social Engineering Scam

Cybercriminals who deploy vishing attacks are motivated and have plenty of techniques to increase their chances of success. Staying informed about these attacks will help mitigate them from compromising your organization’s sensitive data. To that effect, this blog will cover:

• The definition of vishing in cybersecurity
• How to prevent vishing attacks

Protecting your sensitive digital assets from vishing attacks doesn’t stop at defining “what is vishing in cybersecurity?” By partnering with an incident management services provider, you will effectively develop and implement effective anti-vishing practices.

 

What is Vishing in Cybersecurity?

In cybersecurity, vishing is a type of phishing and is the short form for “voice phishing.”

Phishing attacks are the most common social engineering scams today, impacting many individuals and organizations caught unaware when these attacks unfold. Like other phishing attacks, vishing pretexts unsuspecting individuals into divulging sensitive information to a cybercriminal. When vishing perpetrators deploy these attacks, they leverage psychological tactics to convince their targets that these requests are legitimate.

Overall, vishing attacks are designed to manipulate human behavior based on emotions.

Understanding the psychology behind these attacks will help your organization effectively prevent vishing attempts from becoming serious threats.

 

Assess your Incident Management plan

 

Common Vishing Attack Scenarios

The best way to describe what is a vishing attack is to use examples of vishing scenarios.

Some vishing attacks are simple, whereas others are more nuanced and sophisticated. For instance, a perpetrator may call an employee in your organization pretending to be a remote support technician requesting access to a sensitive data environment. By creating a false sense of urgency (e.g., scaring the employee into believing there is a serious technical issue), a vishing attacker can successfully compromise your access controls and steal sensitive data.

In other instances, vishing attempts are more subtle. The attacker may call your unsuspecting employees and politely ask questions that reveal sensitive information. For example, the perpetrator may ask who is the best contact for a request to modify certain IT privileges. 

Without knowing, an employee may share insider information that the vishing perpetrator can then use to deploy another more sophisticated phishing attack. And vishing attacks are not only targeted towards organizations. Many vishing perpetrators are interested in stealing personal information from individuals so they can access their finances or other sensitive data.

Best Practices for Mitigating Vishing Attacks

So, how can you stop vishing attacks from impacting your staff and the broader organization? The most effective vishing cyberdefenses improve security awareness, starting from your top-level executive leadership all the way to the most junior-level employees.

With security awareness training, your staff will learn how to identify potential vishing attacks based on signs such as:

• Phone call requests for sensitive data, including:
  • Personally-identifiable information (PII) (e.g., social security numbers, bank account information)
  • User account IDs and passwords
  • Corporate financial information
  • Contact information for other staff in the organization
• A caller’s unusual sense of urgency
• Callers claiming to be Internal Revenue Service (IRS) or Social Security Administration (SSA) representatives

Even with security awareness training, vishing attacks can still be successful. Your organization is best protected when additional security controls are implemented to mitigate vishing attacks.

For instance, vishing attacks may be deployed simultaneously with other social engineering scams like email phishing, text message phishing (smishing), or whaling.

You can minimize the risks of these attacks becoming successful by:

• Conducting phishing simulation exercises (whether via email, voice, or text message) to help employees easily identify potential social engineering scams
• Deploying malware on devices with access to sensitive data environments
• Implementing strong access control measures (e.g., strong password use requirements, quarterly password resets)

Vishing perpetrators are typically persistent when looking to compromise sensitive data and may use various tactics and techniques to improve their odds of success. If your organization becomes a victim of a vishing attack, working with a security incident management partner will help you contain the threat before it impacts the rest of your digital infrastructure.

 

Develop Resilient Social Engineering Defenses

For your organization to develop cyber resilience against vishing and other social engineering attacks, you must understand what you’re up against. A great place to start is to ask, “what is vishing and how can you prevent it?” Another way is to trust an incident management specialist like RSI Security to provide guidance on best practices for mitigating vishing attacks.

To learn more and get started, contact RSI Security today!

 

 

There are any number of things that could happen to disrupt operations, and being able to keep critical tasks on track can have a significant impact on an organization and those who rely on it. That’s why business continuity planning is just as critical to risk management as having effective security measures in place is. The best practices for implementing a business continuity plan for your organization all revolve around remaining ready for both the expected and the unexpected.

The ability to adapt is a necessity in today’s ever-changing world, and how well an organization can respond to change can have a significant impact on long-term growth and success. The term “business resilience” is often used to refer to business continuity and vice versa, but failing to recognize and approach business resilience as the related, but more broad, strategy that it is, can result in a missed opportunity to position your organization for optimal success.

Responding to cybersecurity incidents promptly and thoroughly is crucial to minimizing damage and recovering. The eradication phase is the first step in returning a compromised environment to its proper state. Robust incident management is critical to managing cybersecurity incidents and mitigating potential damage to sensitive data and digital assets. Read this guide to learn essential eradication best practices to ensure a thorough recovery from cybersecurity incidents.

 

The Eradication Phase of Incident Response

Eradication is a critical phase in the incident response process. Thorough recovery from security incidents requires the full removal of any malicious code or other threats that were introduced to the environment during the incident. This is the purpose of the eradication phase.

But while eliminating threats may seem like the most obvious response to an incident, eradication is one of many necessary phases in an effective incident response program.

 

Incident Response Process Phases

Security programs are designed to meet the unique needs of each organization, so the exact phases of incident response may differ slightly from one security program to the next. But the incident response is usually broken down into seven phases. These phases include:

• Preparation – Function with the expectation that an incident will eventually occur and prepare accordingly. Define roles, delegate tasks, and create a plan for responding to different levels of incidents so that everyone knows what to do before one happens.
• Detection – Define and implement measures to detect threats so they can be identified and prioritized appropriately.
• Containment – Quarantine any threats identified during the detection phase to mitigate the impact on the environment.
• Investigation – Once the threat has been contained, find and document the cause of the incident.
• Eradication – Remove any malware or other threats that were introduced to the environment in order of priority.
• Recovery – Do any necessary data and asset recovery to restore systems and assets to their pre-incident state.
• Follow-up – Review the impact of the incident and the results of the response process, and consider whether any improvements are needed to be better prepared for future incident response.

Depending on the severity of the incident, the eradication phase could be very straightforward, or it could require an extensive process to remove all threats from the system.

 

Assess your Incident Management plan

 

What to Consider During the Eradication Phase

Consider the following points during eradication to ensure threats are thoroughly eliminated:

• Results of investigation – The investigation phase uncovers information about the nature of the threats that have been detected and what vulnerabilities led to the incident. Use details about the threats that have been found to determine the best way to remove them.
• Threat risk levels – After threats have been detected and prioritized, address and remove them in order of how much risk they pose to your organization’s IT environment. Some threats may not be able to be safely left in quarantine, so be sure to eliminate any high-risk threats immediately.
• Options for eradication – Some malware may be removed automatically by scanning tools, while other threats require manual intervention. Consider the most efficient options for eradicating each detected threat to streamline this phase of the incident response process.
• Potential service interruptions – Determine whether eradication will limit access to systems or services and notify personnel so they’ll know how their tasks may be affected.
• Best practices – Follow security best practices to prevent any damage during the eradication phase.

Another critical consideration, if varied, is what exactly constitutes eradication—what the area protected includes and where exactly malicious code needs to be removed from, to what extent.

How to Remove Threats During the Eradication Phase of Incident Response

After identifying and analyzing the threats during the other incident phases, complete removal of those threats from your systems and periphery is the critical goal of the eradication phase.

To do so, choose the eradication approach that is most appropriate for the threat, such as:

• Automated removal – If any minor threats can be removed by anti-malware tools, let the software remove them and focus on higher priority threats.
• Reimaging systems – Wipe systems and reimage them to ensure any malware is removed.
• Applying patches – Patch vulnerabilities that may have facilitated attacks or been introduced by threats detected within the environment.
• Migrating resources – Consider removing resources that weren’t affected during the incident to new systems to ensure they remain unaffected throughout the rest of the incident response process.

After all identified threats have been eradicated from your organization’s IT environment, any additional recovery steps can be taken to restore the environment to normal. After full recovery from the incident, review the incident, response, and your organization’s security policy to see what can be improved.

 

Thoroughly Eradicate Threats After Incidents

All incident response process phases are significant in an effective incident response plan. The eradication phase is crucial to resecuring your organization’s environment and getting things back to normal. RSI Security’s incident management experts will help your organization optimize its eradication incident response to mitigate the damage of attacks.

Contact RSI Security today to learn more about effective threat eradication.