Michael N. Dundas » Incident Response http://michaeldundas.com A place to record my thoughts and musings. Tue, 20 Jul 2010 03:13:20 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 Authorized to shutdown the data center, update http://michaeldundas.com/2010/01/13/authorized-to-shutdown-the-data-center-update/ http://michaeldundas.com/2010/01/13/authorized-to-shutdown-the-data-center-update/#comments Thu, 14 Jan 2010 03:20:21 +0000 Clear2Go http://michaeldundas.com/?p=1413 I posted a couple weeks ago about operators monitoring systems and discovering a serious exploit in progress and determining what to do if no one was available to make a call such as shutting down a service.  What metrics are in place such as length of time, number of phone calls, seriousness of incident, that allow an individual to make a call that might affect the business confidently.  My example was one where it was discovered that a hacker was slowly siphoning off account information at a financial institution. I don’t know what this particular institutions procedures were, but turns out my fictional example happened.  Not surprised as it is a valid scenario in todays world, but thought it was worth commenting.

]]> http://michaeldundas.com/2010/01/13/authorized-to-shutdown-the-data-center-update/feed/ 0 Authorized to shutdown the data center http://michaeldundas.com/2009/12/22/authorized-to-shutdown-the-data-center/ http://michaeldundas.com/2009/12/22/authorized-to-shutdown-the-data-center/#comments Tue, 22 Dec 2009 15:42:09 +0000 Clear2Go http://michaeldundas.com/?p=1317 theBorderKissAndCrySladeEmergShutdown2The picture on the right is taken from a Canadian television series called “The Border“.  It follows a team of Canadian customs agents saving Canada from threats.  In this particular episode called “Kiss and Cry“, Slade who is their technical wizard agent discovers that the Chinese secret service has installed a trojan in their system allowing them to monitor their activities.  Upon investigation, discovery of the trojan, and a quick assessment of the risk, he immediately initiates a system wide shutdown of all services.  Given the sensitivity of data they have in their systems, the type of data their systems have access to,  and the nature of their business it was the right call, however I found it interesting that Slade made it.

Although this is a fictional television series, this scene got me thinking about my clients.  I can not think of any client large or small that is prepared for or has a single staff member onsite that could authorize a system wide shutdown quickly.  As an example, let’s take a large financial institution.  One of the technical staff is doing some routine system checks and discovers that every time a customer logs into their bank accounts, the customers login and password information along with other helpful data such as birth date and postal code is transmitted externally to a range of servers.  Being a large financial institution there is presently a new customer login average of one per second.  What should she do?  Should she shutdown all customer access immediately?  Should she investigate?  If she investigates, how long should she investigate for?  Can she get hold of someone who can authorize the shutdown?  What if that person is unavailable?  Can she make the call to shutdown services then?  It is obviously critical.  Should she keep trying others?  If so for how long?  If from discovery through investigation to authorization it takes 10 minutes, that is 600 client compromises in this scenario.

What is important is that the staff clearly understand what they can and can not do in any situation.  They need to feel comfortable they have done the right thing and will not be punished for doing what they ‘perceive’ as the right thing.  In the scenario above, if you asked your employees what they would do in this scenario, do you know what they would answer?  Would they be comfortable answering the questions above and more importantly would the business be comfortable with the answers and the risks associated with those responses?

I know many business people that would indicate this is fictional or ‘far fetched’.  While I would have agreed to some degree a few years ago, I wouldn’t today.  What I would suggest is that they go to a recent technical (not business) security conference or ask your technical team or consultants about latest research into threats and vulnerabilities and their availability.  Don’t ask the vendors (or at least be careful), they are trying to sell you results and are never as advanced as the bad guys.  Also keep in mind that even research is behind.  There are many malicious pieces of software that are ‘underground’, but you don’t need to look there.  Just look at some of the available off the shelf tools available for purchase.

Is your business realistically aware of the current threats to its data?  Are the risk assessments accurate?  Do you have the appropriately qualified staff and procedures in place to deal with current threats and do they have the appropriate authorization to make the necessary calls in the event of an emergency or unexpected event?  Is the business comfortable and accepting of the risk exposure associated with these decisions?

]]> http://michaeldundas.com/2009/12/22/authorized-to-shutdown-the-data-center/feed/ 1