* Microsoft white paper goes into what do to when responding to an attack
According to Mary Landesman, technical editor for Microsoft Security Research and Response, “A significant evolution has occurred in the malware landscape over the past five years – a change of intent from amateur virus writers seeking attention to professional criminals seeking profit.”
I heard essentially the same thing from Dave Cole, director of Symantec Security Response. He told me that in the Internet Security Threat Report, Symantec’s semi-annual review of the threat landscape, “Symantec has observed a change in Internet attack activity away from status-oriented attacks and towards criminal activities motivated by profit. The current threat environment is characterized by an increase in data theft, data leakage, and the creation of malicious code that targets specific organizations for information that can be used for financial gain.”
Increasingly, according to both Microsoft and Symantec, criminals are targeting individuals within enterprises as the entry point to corporate data rather than the now old-fashioned worms and viruses. Phishing attacks, keyloggers and Trojan horse programs are becoming the preferred methods for malware purveyors.
So how can you protect your organization’s assets?
Microsoft has a white paper available, “Responding to IT Security Incidents,” that can help you prepare for the time when you will need to respond to an attack. And it isn’t “if,” but “when” that attack will come.
The first suggestion is, of course, to “Minimiz[e] the Number and Severity of Security Incidents.” You’ll note that there’s no thought of eliminating or preventing them outright. The paper does offer a set of what might be called “best practices” that can ensure that you aren’t actually easing the way for the attacks to occur, though.
Next, you’ll learn about forming a Computer Security Incident Response Team (CSIRT). This is the core of the paper, and could be very instrumental in limiting losses when a security incident occurs. All organizations, no matter their size, should have a CSIRT. It might be that in very small companies the CSIRT lead is also the head of IT but the real work (after a security incident) is handled by the associate members of the team.
According to the white paper, “…you should have a number of specific individuals who handle and respond to particular incidents. Associate members will come from a variety of different departments in your organization. They should specialize in areas that are affected by security incidents but that are not dealt with directly by the core CSIRT. Associate members can either be directly involved in an incident or serve as entry points to delegate responsibility to a more appropriate individual within their departments.” It goes on to recommend areas that should be covered by the associate members – IT, Legal, PR and upper management. Fixing the breach is most likely an IT problem. But dealing with the aftermath often has little to do with computers, software and services.
If you don’t have procedures in place to deal, company-wide, with IT security breaches then don’t delay in getting this paper, reading it, passing it on to your upper management, security personnel (if you have them) and whichever legal folks and public relations mavens do that work for your organization. An incident will occur at some point. Those who aren’t prepared will suffer the worst.
