Incident Response (IR)¶
IR.L2-3.6.1 – Incident Handling¶
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Assessment Objectives¶
Source: NIST SP 800-171A, p. 36.
Determine if:
- [a] an operational incident-handling capability is established;
- [b] the operational incident-handling capability includes preparation;
- [c] the operational incident-handling capability includes detection;
- [d] the operational incident-handling capability includes analysis;
- [e] the operational incident-handling capability includes containment;
- [f] the operational incident-handling capability includes recovery; and
- [g] the operational incident-handling capability includes user response activities.
Potential Assessment Methods and Objects¶
Source: NIST SP 800-171A, p. 36.
Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; procedures addressing incident response assistance; incident response plan; contingency plan; system security plan; procedures addressing incident response training; incident response training curriculum; incident response training materials; incident response training records; other relevant documents or records].
Interview: [SELECT FROM: Personnel with incident handling responsibilities; personnel with contingency planning responsibilities; personnel with incident response training and operational responsibilities; personnel with incident response assistance and support responsibilities; personnel with access to incident response support and assistance capability; personnel with information security responsibilities].
Test: [SELECT FROM: Incident-handling capability for the organization; organizational processes for incident response assistance; mechanisms supporting or implementing incident response assistance].
Discussion¶
Source: NIST SP 800-171 Rev. 2, p. 26.
Organizations recognize that incident handling capability is dependent on the capabilities of organizational systems and the mission/business processes being supported by those systems. Organizations consider incident handling as part of the definition, design, and development of mission/business processes and systems. Incident-related information can be obtained from a variety of sources including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including mission/business owners, system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive. As part of user response activities, incident response training is provided by organizations and is linked directly to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, regular users may only need to know who to call or how to recognize an incident on the system; system administrators may require additional training on how to handle or remediate incidents; and incident responders may receive more specific training on forensics, reporting, system recovery, and restoration. Incident response training includes user training in the identification/reporting of suspicious activities from external and internal sources. User response activities also includes incident response assistance which may consist of help desk support, assistance groups, and access to forensics services or consumer redress services, when required. NIST SP 800-61 provides guidance on incident handling. SP 800-86 and SP 800-101 provide guidance on integrating forensic techniques into incident response. SP 800-161 provides guidance on supply chain risk management.
Further Discussion¶
Incident handling capabilities prepare your organization to respond to incidents and may:
- identify people inside and outside your organization you may need to contact during an incident;
- establish a way to report incidents, such as an email address or a phone number;
- establish a system for tracking incidents; and
- determine a place and a way to store evidence of an incident.
Software and hardware may be required to analyze incidents when they occur. Incident prevention activities are also part of an incident-handling capability. The incident-handling team provides input for such things as risk assessments and training. OSAs detect incidents using different indicators. Indicators may include:
- alerts from sensors or antivirus software;
- a filename that looks unusual; and
- log entries that raise concern.
After detecting an incident, an incident response team performs analysis. This requires some knowledge of normal network operations. The incident should be documented including all the log entries associated with the incident. Containment of the incident is a critical step to stop the damage the incident is causing to your network. Containment activities should be based on previously defined organizational priorities and assessment of risk. Recovery activities restore systems to pre-incident functionality and address its underlying causes. Organizations should use recovery activities as a means of improving their overall resilience to future attacks.
Examples¶
- Your manager asks you to set up your company’s incident-response capability [a]. First, you create an email address to collect information on possible incidents. Next, you draft a contact list of all the people who need to know when an incident occurs. You document a procedure for how to submit incidents that includes roles and responsibilities when a potential incident is detected or reported. The procedure also explains how to track incidents, from initial creation to closure [b].
Potential Assessment Considerations¶
- Is there an incident response policy which specifically outlines requirements for handling of incidents involving CUI [a]?
Key References¶
- NIST SP 800-171 Rev. 2 3.6.1
IR.L2-3.6.2 – Incident Reporting¶
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Assessment Objectives¶
Source: NIST SP 800-171A, pp. 36-37.
Determine if:
- [a] incidents are tracked;
- [b] incidents are documented;
- [c] authorities to whom incidents are to be reported are identified;
- [d] organizational officials to whom incidents are to be reported are identified;
- [e] identified authorities are notified of incidents; and
- [f] identified organizational officials are notified of incidents.
Potential Assessment Methods and Objects¶
Source: NIST SP 800-171A, pp. 36-37.
Examine: [SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentation; procedures addressing incident reporting; incident reporting records and documentation; incident response plan; system security plan; other relevant documents or records].
Interview: [SELECT FROM: Personnel with incident monitoring responsibilities; personnel with incident reporting responsibilities; personnel who have or should have reported incidents; personnel (authorities) to whom incident information is to be reported; personnel with information security responsibilities].
Test: [SELECT FROM: Incident monitoring capability for the organization; mechanisms supporting or implementing tracking and documenting of system security incidents; organizational processes for incident reporting; mechanisms supporting or implementing incident reporting].
Discussion¶
Source: NIST SP 800-171 Rev. 2, pp. 26-27.
Tracking and documenting system security incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Reporting incidents addresses specific incident reporting requirements within an organization and the formal incident reporting requirements for the organization. Suspected security incidents may also be reported and include the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, Executive Orders, directives, regulations, and policies. NIST SP 800-61 provides guidance on incident handling.
Further Discussion¶
Incident handling is the actions the organization takes to prevent or contain the impact of an incident to the organization while it is occurring or shortly after it has occurred. The majority of the process consists of incident identification, containment, eradication, and recovery. During this process, it is essential to track the work processes required in order to effectively respond. Designate a central hub to serve as the point to coordinate, communicate, and track activities. The hub should receive and document information from system administrators, incident handlers, and others involved throughout the process. As the incident process moves toward eradication, executives, affected business units, and any required external stakeholders should be kept aware of the incident in order to make decisions affecting the business. Report to designated authorities, taking into account applicable laws, directives, regulations, and other guidance. Specify staff responsible for communicating about the incident to internal and external stakeholders.
Examples¶
- You notice unusual activity on a server and determine a potential security incident has occurred. You open a tracking ticket with the Security Operations Center (SOC), which assigns an incident handler to work the ticket [a]. The handler investigates and documents initial findings, which lead to a determination that unauthorized access occurred on the server [b]. The SOC establishes an incident management team consisting of security, database, network, and system administrators. The team meets daily to update progress and plan courses of action to contain the incident [a]. At the end of the day, the team provides a status report to IT executives [d,f]. Two days later, the team declares the incident contained. The team produces a final report as the database system is rebuilt and placed back into operation.
Potential Assessment Considerations¶
- Is there an incident response policy that directs the establishment of requirements for tracking and reporting of incidents involving CUI to appropriate officials [a,d]?
- Is cybersecurity incident information promptly reported to management [e,f]?
Key References¶
- NIST SP 800-171 Rev. 2 3.6.2
IR.L2-3.6.3 – Incident Response Testing¶
Test the organizational incident response capability.
Assessment Objectives¶
Source: NIST SP 800-171A, p. 37.
Determine if:
- [a] the incident response capability is tested.
Potential Assessment Methods and Objects¶
Source: NIST SP 800-171A, p. 37.
Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident response testing; procedures addressing contingency plan testing; incident response testing material; incident response test results; incident response test plan; incident response plan; contingency plan; system security plan; other relevant documents or records].
Interview: [SELECT FROM: Personnel with incident response testing responsibilities; personnel with information security responsibilities; personnel with responsibilities for testing plans related to incident response].
Test: [SELECT FROM: Mechanisms and processes for incident response].
Discussion¶
Source: NIST SP 800-171 Rev. 2, p. 27.
Organizations test incident response capabilities to determine the effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, simulations (both parallel and full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response. NIST SP 800-84 provides guidance on testing programs for information technology capabilities.
Further Discussion¶
Testing incident response capability validates existing plans and highlights potential deficiencies. The test should address questions such as what happens during an incident; who is responsible for incident management; what tasks are assigned within the IT organization; what support is needed from legal, public affairs, or other business components; how resources are added if needed during the incident; and how law enforcement is involved. Any negative impacts to the normal day-to-day operations when responding to an incident should also be identified and documented.
Examples¶
- You decide to conduct an incident response table top exercise that simulates an attacker gaining access to the network through a compromised server. You include relevant IT staff such as security, database, network, and system administrators as participants. You also request representatives from legal, human resources, and communications. You provide a scenario to the group and have prepared key questions aligned with the response plans to guide the exercise. During the exercise, you focus on how the team executes the incident response plan. Afterward, you conduct a debrief with everyone that was involved to provide feedback and develop improvements to the incident response plan [a].
Potential Assessment Considerations¶
- Does the incident response policy outline requirements for regular incident response plan testing and reviews of incident response capabilities [a]?
Key References¶
- NIST SP 800-171 Rev. 2 3.6.3