Cyber Defense eMagazine November Edition for 2021

● Stop the bleeding: Segregate the system or systems from the networks so you can reduce
the damage and keep other parts of your business running.
● Maintain backups: Be sure you regularly review backups of your data so that you can
recover with as little loss as possible. If a full restore will take longer than you can tolerate,
prioritize the data and applications to be restored in order of importance.
● Create and update response plans: These strategies should include such things as
immediate containment tasks, chain of command, disaster recovery processes and more. Update
these regularly whereas new threats are constantly emerging, personnel can leave key posts and
infrastructure changes.
● Assess and test: Perform risk assessments and network penetration tests. This includes
conducting table-top exercises so IT and executives can define and refine the response plan.
● Go phishing: Employees are often the way into a company’s network, particularly now
whereas remote workers often have lax security. Test them with fake phishing attempts and be
sure to regularly conduct preventative training.
Fuel for thought
Some attacks I’ve seen have been investigated internally, but typically, these efforts don’t include a
forensic chain of custody that provides the chronological electronic evidence needed for a court of law. I
make this distinction because I believe it’s very difficult for a company to get all the data that they need
in order to take legal action that may result from a ransomware or other type of attack.
If an organization uses a managed services provider (MSP) to get the cloud-based services they need,
they likely won’t need to hire a forensic investigator to delve deeper. For that matter, an MSP can defray
a lot of costs, concerns and aggravation, particularly if they cater to industries that deal with financial and
sensitive data. MSPs tend to have the best security in place, constantly invest in new technology and
have experts versed in best practices and fast recovery. And, it doesn’t hurt to have a team that can take
a calm, collected approach during chaos.
The Colonial Pipeline attack has indeed given CIOs “fuel for thought.” In a way, that’s good, after all, the
frequency of ransomware and other threats is on the rise. Your organization could be next – so be sure
you’re ready.
Cyber Defense eMagazine – November 2021 Edition 45
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.