When there is a suspected data breach, the course of action a chief
information security officer (CISO) should be analysing the situation and
making sure the correct tools and solutions are being implemented. Its
also very important to build the correct team and have ongoing reports
sent out. Management of data should be accessed again. Other data
systems should be restricted from being used and patches should be
resolved as well and real time analysis of the breach should be
completed as well. Depending on the data breach bases what type of
action to take. If the data is/was stolen, the contacting person associated
with the data should be contacted immediately. If its based on passwords
this could mean a key logger is being used so the keystrokes of
the keyboard should be checked. One data breach and steps to avoid
it would be phishing. Phishing is when someone sends a malicious
link in an email or installs malicious software. Steps to take would
to be to install an antivirus, or web filters can be used to block
malicious pages on the web. A lot of people aren't even sure of
what a CISO is being that it has only been around for the last
decade or so. A CISO is simply the senior level executive that
handles the execution and the overseeing of the company's cybersecurity
strategy. In case of a suspected data breach, the course of action of
the chief information security officer should take is first of all planning
for disaster recovery. Ensuring the privacy and security of customer data
is another strategy that will help in case of a data breach. Managing
responses to cybersecurity incidents and monitoring the IT environment
for vulnerabilities and abnormal events are also some great strategies
that a chief information security officer (CISO) can take in the case
of a suspected data breach. Developing secure business policies and
practices, hiring IT security staff, conducting employee security awareness
training, verifying the company’s compliance with laws and regulations
should also be some of the first things a CISO should look into
when possibly facing a suspected data breach.The type of data breach
affects the actions because it affects what needs to be done, it affects
your strategy. You wouldn't use the same strategy you used towards
identity theft when facing malware. In a scenario in which a data
breach occurs, the CISO would have to take action in order to in
best case scenario stop the information from getting into the hands of
the intended party. They would do this by increasing their responsibilities
and expanding their ow role within the company. Their first step would
be to stop the leak, by locating the source and containing it. They
would make sure that no more information is released as well as
take preventative measures against potential malware being installed on
the company’s data base. The organization targeted would be contacted
by the CISO to inform them of the breach and to also refresh them
on the correct procedures and protocols to handle the situation. Locking
down access to the network database will be crucial to access the
level of damage dealt. The security incident response team would be
next on the list to contact, they will be crucial to determine how
the attack was implemented, the amount of data leaked, what was
damaged, and which data was targeted. They will also investigate
suspicious behaviors of employees to help determine the parties involved
in the attack. After this the team and the CISO will put together
new software to prevent the attack from happening again. If a suspected
data breach were to take place, the CISO will be required to take
on additional roles and responsibilities in order to prevent the threat
from reaching its intended target or the loss of important data due
to damage or leaks. The CISO would first locate and contain the
threat, preventing it from accessing anymore files or data then it may
already have or releasing malware into the database. During this time,
the CISO should contact the organization to inform them of the possible
threat and refresh them on the approved protocol/steps that will take
place. The CISO should then temporarily lockdown any access to the
network database to determine how serious the threat may be and what
damage has been done already. The next step is to inform and update
the Security Incident Response Team about the situation. Together, the
team will gather data and information about how the breach was able
to slip through security, what data was targeted, damaged, leaked or
lost, employees data will be scanned for suspicious activity. The CISO
and their team will pick the threat apart to create a new software
that will be prepared for a similar attack and alert security before
the threat is able to access the database. In case of a suspected
data breach, the CISO should first secure the operation. By stabilizing
the whole operation, you are protecting any further data from being
stolen. The CISO should lock down all physical access points and
change all all access codes. The CISO Should also shutdown all
network connection temporarily, in case the source of the attack is
coming from the network. Once all of the area's of the operation has
been secured, The CISO should deploy Computer Security Incident
Response Team to help identify where the source of the breach
occurred. This team should be able monitor all networking traffic, all
source of communication, and other areas of vulnerability. Once, the
threat has been identified and neutralized, the CISO should look to
strengthen that area of weakness. Whether it's transferring all the sensitive
data to a more secure source, monitor network traffic stricter , granting
less access to important information, or installing IDS.The type of branch
effects this action because each threat needs to be handled in different
manner. If the threat is coming from an phishing email, then company
would have to start monitoring the companies email traffic and address
it company wide to prevent others from sending out information to a
malicious source.One type of data breach would be account hacking. A
few remedies for an account being hacked is to change the passwords
on the account, backup all sensitive data, or deactivate account/ start
a new account. In a case of a suspected data breach, the CISO
would first need to contain the threat without panic and with a quick
response time. After containing the threat they would need to see how
much they can retain that was not loss as they can, and shut down
the system and all servers. The next step would be to figure out if
the breach was internal or external and why the breach occurred.
However with different data breach's steps may change because if a
consumer information was hacked they would then need to get there
team to contact consumers. However some data breach's will be much
more serious with more extensive steps for example government top
secret information. A cloud data breach is far more damaging than a
regular computer, because multiple users information will be in the hands
of an attacker in single breach. Furthermore the same steps should be
taken, shut down system until the source of breach is found and
resolved. Most cloud data breach is due to the customers negligence .
If there was a data breach the CISO would first need to contain
the threat. Having an intrusion detection system would be beneficial to
minimize the amount of damage a breach could cause. Next, they
should shut down access to any compromised data/servers. The CISO
should know exactly what data or information was compromised and
what information was taken. They should deploy the disaster recovery
plan and team. The CISO should be aware if individual’s private
information was compromised and make appropriate notifications if so.
Depending on the type of breach the actions may not be as extensive
and time consuming. Some may be internal mistakes and the CISO
would have to adapt or make new policies and procedures for
employees. One example of a data breach could be caused by phishing.
You would need to identify where the email came from and who
opened it. Obtain a copy of said email as well. Ensure all employees
are aware of the phishing email, where it came from, and not to
open it. After it is contained and you have made sure there are no
longer any threats, you should have said employees change their
passwords. Provide further security training for employees. If I was
CISO and there was a security data breach first I must remember
not to panic. Second, I would identify that breach, contain the breach
before any more damages occurs. Then, I would create a team of
data analysts to identify the severity of the breach then create another
team to create a plan of action in case this were ever happen again.
There are many different types of data breaches that can affect the
action plan of the analysts. For example, when it comes to data
breaches there are some are intentional and unintentional once they
identify the right course of action for the breach. One of the most
common types of breaches is phishing. Phishing is when hackers create
a website that replicates a legit website and asking the user to login
into their account when in reality you have just given someone your
account information. The course of the action I would take is to
identify where the phishing raised from, second identify what was
affected; contain it and then create a plan of action on what to do
if the issue wherever to a raise. The role of the CISO is to
Establishing the right security and governance practices. Enabling a
framework for risk-free and scalable business operations. In case of a
data breach the chief information security officer should contain the
breach. If you react to a breach by panicking and reacting too
quickly, you could make some costly mistakes. Once you have determined
where the breach originated, it is crucial that you contain it. If the
breach spreads to other areas of your organization, it will become a
lot more difficult to handle. To reducing the risk of a data breach,
you need to understand where the risk is coming from. There are
two major risk factors, people and devices. A type of data breach
could be Malware. Malware is a common form of cybersecurity attacks.
They are a type of software that infects your entire system. They
are caused by tricking a user into clicking on something such as a
pop-up ad that leads to the download of the software onto the system.
This can lead to systems being severely slowed down, or completely
crashed. To prevent future attacks is remedy whatever caused the initial
breach to happen. Consult and understand what kind of protection you
need. The first thing a Chief information security officer should take
after a suspected data breach is to isolate the issue and make sure
it is contained. The next step is to shut down the network and
internal servers to make sure there are no other issues. After that
there should be some investigation done to determine what type of
data breach it was and how this affected the company assets.
For example, if there was a data breach that was the result of a
phishing scam it would be a high priority to educate employees and
make them more aware of security issues like malware/phishing scams.
Knowing about cyber attacks and preventative actions is meaningless
unless the information is shared with the rest of the company.
Just recently our company sent out a test phishing email to see if
employees would click on it. I would guess at least 25% of our
team clicked on it. Even with all of our continued education and
trainings around this and still this many employees fell for it. In
case of a suspected data breach, the course of action a chief
information security officer should take would be to have previously
implemented backup servers, or copies of important data for the
organization to continue operating if needed, but most importantly,
immediately turn off the power source to the computer, disconnect the
computer from the network, and/or reinstalling the systems application.
These steps to reacting to the security breach will minimize any
damage. The reaction time is crucial considering any breach so some
type intrusion detection system would be beneficial to detect abnormal
behavior within the network. This can help manage and automate security
reactions to intruders. Once the incident is under control, forensic security
team would investigate the incident. Documenting and identifying all
parties involved and how the security breach occurred, and the course
of action to resolved the issue. Depending on the type of breach, if
the organization’s security was compromised and couldn’t prevent further
damage to the data breach, some type of procedure or escalation for
this new type of breach would have to take place to find the
appropriate solution/course of action and be implemented for security
moving forward. If a data breach is suspected, the CISO’s response
time is critical due to longer the response time the higher possibility
of extensive damage occurring. Reacting to the incident involves the
anticipation of attacks as well as planning measures to be taken to
help restore the services. The incident is to be isolated by terminating
the power supply to the computer in question. The computer is to
be taken off the network to help reduce the chances of higher
damage, then the system applications are reinstalled as an attempt to
have the computer back to its proper operating condition. All data
breaches can not be reacted to in the same manner due to some
may be intentional while others may be accidental. Either way the use
of an antivirus and or an IDS can help monitor the network to
help reduce the chances of intentional attacks through the cyber domain.
When it comes to physical security using security password requirements
to access the data along with encryption are the best possibility. A
type of data breach would be a worm, these are the most used
type of malware that enters an operating system to spread malicious
code. It is self-replicating and consumes excessive bandwidth, deletes files,
or sends files through email which are infected. To reduce the risk
of a worm attack, the user account should be running as “limited”
to prevent installation, modification, or removal of software. Second
firewalls should limit unauthorized network activity with the operating
system set to automatically install system updates. Lastly, an anti-virus
software should be installed and set to scan and update automatically,
a paid for antivirus program will have more benefits and features in
comparison to a free program. In the case of a suspected breach, the
CISO should detect a breach fast and discover the details. Whenever
there is a breach, the CISO should be able to detect it at the
earliest, before it causes big damages to the organization. Next, the
CISO should assemble the team quickly, and prepare a plan to recover
from the breach. Whenever there is a cybersecurity breach, the CISO
should be able to assemble the Computer Security Incident Response
Team (CSIRT), and get a plan ready to tackle the cyber crisis,
gathering information for detailed analysis, ensuring involvement at all
levels. The next step would be to contain the breach effectively and
promptly. Once a breach is detected and the team is ready to tackle
it, the CISO should first seek to plan ways to contain it as
effectively as possible without losing any time. The CISO's role also
includes informing the public and customers. The CISO should also plan
to address the security issue with the public, especially since this is
an important step as regards mitigating damages caused by the incident.
Last, the CISO is responsible for taking steps to prevent further attacks.
Once a cybersecurity issue is detected and resolved, plans have to be
made and steps have to be taken to ensure that the same attack
wouldn't happen again and also ensure that other attacks are also
prevented.
In the event of a network-based breach, the CISO must make sure
that the incident response plan is in place, and limit the ability of
the attacker to access your network. This step includes blocking IP
addresses utilized by known threats or denying servers and critical
infrastructure the ability to directly communicate with the internet. The
next course of action would be to eliminate the files that caused the
infection, including removing the service/application that created the
vulnerability, and deleting or disabling the process/protocol used to launch
the cyber attack. The last course of action would be to remove
affected devices from the environment. This includes restoring affected
devices to a known-good state via backups or snapshots, and powering
off the device and disconnecting it from the network. In the case of
a suspected data breach the first thing the CISO should do is to
isolate the incident. After they have isolated the incident they should
try to prevent as much loss as possible. Then they need to investigate
what was taken in the breach. They then need to notify if any
personal information was taken from consumers. If found that the breach
was internal instead of external, they need to have the workers change
their passwords in order to protect from future attacks.
The CISO after knowing what type of breach has occurred if preventable
in the future should change policy in order to prevent future breaches.
If it were an external device that was the root cause having a
policy in place about personal drives in work computers would help
prevent future breaches. If it was a physical theft of information
making sure that updates are made to the security around that device
to prevent further thefts. If found to be an employee breach limiting
access to information that is not crucial to the job that they perform.
A CISO would and should isolate the breach and mitigate the damage
where possible. A CISO will also analyze the data breach after the
attack has been contained in order to assess why it occurred and
resolve any vulnerabilities found.
The type of data breach will determine what actions are taken. A
breach in Confidentiality can result in exposure to personal data. This
could be due to a lack of encryption use for storing and transmitted
data. The law requires for the organization to notify parties who were
exposed and mitigation of the risk in the future requires different
policies and technology. A breach in Integrity can result in data being
altered. The cause of this integrity breach can be the result of a
lack of anti-virus on computers or the lack of application/hardware
controls. The CISO would potentially have to find a means to restore
data that is damaged by the breach and mitigate any future risks by
installing controls mentioned earlier. A breach in Availability can result
in a loss of access to information resources. The CISO would have
to identify where and why the loss of access occurred and determine
if there is a redundant means to get users back online.
One specific course of action to mitigate a breach of Availability is
to create redundancies in your organizations infrastructure. This can be
done via the network or server level. For instance, an organization can
decide to have a primary and back up circuit connection to the
internet so that if one connection is lost then the back up kicks in.
For the perspective of the server, redundancy would translate into having
a RAID for your storage device. In the case of a suspected data
breach, a chief information security office has a few priorities: safety,
security, and awareness. Safety comes in the form of ensuring all
systems and people are safe from harm. Harm could be destruction of
property, acquired information endangering someone's physical safety, or
potential financial losses due to compromised information. Security requires
a CISO getting to the root of the breach, determining to what extent
the problem is, resolving up the problem, and placing in safeguards to
prevent such breaches from happening again. Awareness is alerting all
persons whose information could have been compromised. In some cases,
that's as simple as resetting all users' passwords. In other cases, the
remediation process is more complicated and requires more of a payout.
Different types of breaches (cyber, stolen paper receipts and banks
statements, recovered pin numbers and passcodes) require different
reactionary responses and carry different levels of responsibility. In the
case of a cyber data breach, a CISO would need to locate the entry
point into the system of the breach, sure up the system defenses and
install programs to prevent similar breaches, and send out virtual alerts
to all users on the platform to be aware and change passcodes. The
role of CISO is the overall management of security for the information
technology and report to the CEO of potential risk associated with
their information technology. The CISO will give out responsibilities to
handle the breach. In data breaches, the first thing is assess the
severity of the breach. Depending on the type of attack, they will
launch a counterattack plan. After they have taken action against the
attack, they will launch recovery actions to retrieve the loss of
information or analyze for any data corruption. At the end, they will
evaluate the cause of the breach and the monetary value of the attack
to the business. The CISO will have to implement the new findings
if any into the policies to prevent future similar breaches. They will
train the employees to the new procedures.
One type of breach is the Phising attacks. They are attacks that
imitate a legitimate site and trusted source created by hackers to trick
users into voluntarily inputting their sensitive information. They could ask
for usernames, passwords, or other information. The links could lead to
unknown sites that give hackers control of the information. They should
notify the information security teams so they are aware of the situation.
Another time sensitive step would be to run a full security scan on
the device used to catch lingering malware or intrusion of viruses that
could corrupt the data. Then the users must immediately change passwords
or information that was given out. If credit cards are compromised the
course of action is to cancel or change the cards. For SSN theft
notify the credit bureau to lock the SSN to avoid identity theft. The
next step is to evaluate the attack and the cost associated and conduct
proper training for future attacks. we have to understand that the reason
why we would expect the CISO to handle the suspected security
breach, is because he/she is the second at hand after the CEO. With
that being said normally the CISO would have various measures in
place to make sure this doesn't happen. In the case that it does
happen the CISO will have to gather is team together to pull the
data where the breach was formed. Advise all parties that were effected
by the breach and the measures that are to be taken to get it
under control.The type of breach varies widely based on the company
that it has effected. For example, credit card breach which holds a
lot of personal data can hit consumers the hardest causing them not
to have access to there funds when needed due to cards being locked
hoping to avoid fraud and identity theft. SOP's(Standard Operational
Procedures) if not already should be put into place so that everyone
will know how to handle these case as the come to surface. There
are many different types of data breaches. These range from stolen
information to DDoS. The most common types of data breaches and
one of the most important to protect against is stolen information. This
could include anything from stolen email addresses to passwords to
credit card information. Stolen information is one of the most devastating
types of data breaches that can happen to a company. This can have
a lasting impact on a company and could even send them out of
business and into bankruptcy. ransomware is another type of data
breaches that could happen to a company. This is when a company
is breached and their information on computers and servers is locked
and the only way to get it back is to pay the ransom fee. One
large data breach was back in 2014 when eBay was breached by
someone having access to 3 different coorperate employees credentials.
This allowed the breachers to have access to all of it's customers
personal information including emails, passwords, and other personally
identifiable information. eBay attempted to hide this but it was evenually
revealed that the hackers had access to the accounts for more than
229 days. This could have been avoided or at least noticed sooner
if eBay would have had better password renewal process. If an
organization has a data breach, a chief information security officer
(CISO) could take a few approaches, such as; engaging the incident
management team, as well as gaining an understanding of how the
breach took place. A large number of security breaches stem from
unintentional mistakes made by employee carelessness. If an employee is
not aware of the damage he or she can cause simply by opening
an email, and clicking on a link, there is not too much the company
can do about it. However, if the employee took the security training
and education where the harm of clicking on links and downloading
a worm, virus, or spyware was explained in detail, and the employee
electronically signed stating they agree with the information and the
repercussions involved, the organization can use that information in court
if the employee sued them. I work in a company that will not only
explain what the employee did wrong, it may include terminating the
employee for the action. The employee would typically retain a lawyer
and attempt to sue the organization for wrongful termination stating,
"they just did not know". The CISO and Human Resources (HR) could
bring that electronically signed paper to court, and most likely would
dismiss the accusation. A CISO should begin by first analyzing the
alert and determine if it’s a true attack. There are times when
someone could forget a password and used someone else’s login to
finish work or something to that effect. The CISO needs to notify
his response team and have them look to see if the attack is real
once that is determined then the following actions should be take place.
1. Shut off whatever they are using to access information
2. That means either unplugging hardware or executing a shut off
command
3. See what was taken and or damaged
4. Looking for where the leak is how it happen as well while
taking notes
5. Make a report of the incident and catalog all areas of vulnerability
6. Fix where the leak occurred and fortify security
7. Determine if it was an outside attack or fromwith in
8. Deal with the leak if its from within the company
9. Reset all users’ passwords and apply any needed restrictions
10. Notify public of information leak to save face and begin earning
back trust
11. Begin recovery and gaining back trust of those data that was
lost
There are several forms of data breach, like there are different ways
to rob a bank.
1. Employee error
2. The employee opened a phishing email or easy password
3. Cyber attack
4. Coming through internet links or searches using malware
5. Social engineering
6. Employees or other taking information from servers or other data
storage and then trading it to attackers or selling it on the
black-market, and or allowing someone inside that will attack the
organization
7. Unauthorized access
8. Someone allowed to wait at a desk or something akin to that,
they then look for things like personal Data and other HR
related items or attempt to steal company secrets
9. Ransomware
10. It is new but it attacks a company and stea lsdata or locks
out users and demands money to be removed, or information
regarding the decryption key
11. Malicious Insider
12. Someone actively plotting to either steal andor sabotage an
organization
13. Physical theft
14. They steal something
Each one requires a different response and different program to protect.
The bulk is done with physical security and monitoring as well as
cyber to prevent these attacks.
If an employee user information ever become vulnerable and taken the
following actgions need to occur. Immediate access denial and user
deleted then information gathered on what was stolen and taken and
determine if the employee did it on accident or purpose. Then notify
the CISO and being recovery protocols
In case of a suspected data breach, what course of action should
a chief information security officer (CISO) take?
When there is a security breach, it think that the CISO course of
action should be a few things. Building a team that can provide
security analysis who can provide analysis and assess vulnerabilities in
the infrastructure. A system engineering, who can perform security
monitoring. traffic analysis, intrusion detection. Also, installing antivirus
software should be installed, also, contacting the people who the data
breach affected.
How does the type of data breach affect the actions? yy
There are many causes for a data breach, it can affect a business,
whereas, if in the wrong hands,, it can cause the business to loose
financially. Also, if it is customer related, hackers can obtain personal
information from the customer. Personal information that is in the wrong
hands can cause identify theft.
Select 1 type of data breach and the course of action that should
be taken.
A data breach that comes to mind is human error. Sometimes humans
who are very busy can make common mistakes, like sending personal
information to a wrong party. Sometimes in human error, information
can be entered incorrectly as well., Leaving a computer unlocked can
cause someone to obtain information. Talking about a customer's
information or writing specific personal data down and not destroying it
can lead to a data breach. As we know that data breach is an
incident where information is stolen from a system without the knowledge
or authorization of the system's owner. Stolen data may involve sensitive,
proprietary, or confidential information such as credit card numbers,
customer data, trade secrets, pictures or matters of national security.
In this event, The CISO should make sure that all employees of the
organization change their passwords, assemble the team after the disaster
strikes to determine what went wrong in a breach, dealing with those
responsible if they're internal, and planning to avoid repeats of the
same crisis. Physical security is also a major concern. The statistics
discussed earlier reveal that the loss/theft of media such as laptops,
data cards, phones etc. account for major security breach incidents. Since
physical security breaches are the highest among personal devices,
individual users must be careful about securing their computing gadgets.
Data breaches are not always intentional. Users can accidentally send
protected data to the wrong email address or upload it to the wrong
share. Social engineering is very common way for data breach its a
manipulation technique that exploits human error to gain private
information, access, or valuables. In cybercrime, these scams tend to
lure unsuspecting users into exposing data, spreading malware infections,
or giving access to restricted systems. Attacks can happen online, in-
person, and via other interactions. Implementing security applies to any
database whether it was a personal computer or or a large corporation
and by applying the security steps ( precaution, maintenance, and
reaction) if there is a suspected data breach we would be in the
reaction step and the CISO would have to investigate what type of
threat it is and where exactly did it come from to provide the right
course of action, for example if it was internal and a mistake by
one of the employees a new measures of security needs to be
discussed and maybe more training for said employee.Of course the type
of threat would affect the action and the outcome, let say an
organization with a big number of personal data of costumers and the
breach was intended to steal personal info such as banking Info or
credit cards information, the organization would be responsible for any
damage to the costumers and would have to work on developing a
new security plan maybe adding more firewalls or changing anti viruses
as well as using IDS (Intrusion Detection Systems). In case of suspected
data breach, the CISO would gather his team together and have them
analyze the situation and determine if there are any immediate threats.
If a breach has occurred, then the CISO would set a plan into
action to seal off the breach, investigate how it happened and
communicate with the appropriate people about the incident. Once the
breach has been fixed and the investigation has been completed. The
CISO will develop a policy to prevent it from happening again.
Depending on the type of breach, that will determine the policy that
will be put into place. If it was an outside intrusion into the
network, then measure will be put in place to prevent that. That also
goes for user error or a user purposely attacking the company’s network
from the inside. If the breach was caused from an employee stealing
data. A policy can be put in place that would eliminate the use of
any type of electronic storage devices or cameras to prevent data being
taken out of the building. When reading over the chapter I think as
a chief information security officer is to first see how the breach
occurred. The breach could have happen by simply a worker placing
a flash drive in the computer and by them doing that the system
might have caught a virus. We offer see this when we are using
our bank cards and one minute is working and the next it has stop
working. Knowing how the breach happened helps to find where to
start. One solution that should take place is making sure that all
firewall are updated and is also Norton is used. The reason I said
Norton is because it does do a cleaning on the computer and system.
It is real important that the chief let the customer(s) know what is
going on and if their information has been compromised and what
action the company is taking to fix this issues. Giving the customer(s)
a firm solution and understand that this matter is important to the
company. I also think that the information should be back up on a
backup storage system. CISO is a management/leadership position in most
companies. It would NOT normally be the CISO that wades in and
assesses the damage, does forensic analysis, nor puts controls in place
to prevent further attacks. The CISO would set policy, advise, follow-
up, and consult.
