Incident Response Exercise & Report
Your Task
You have been assigned to work incident clean-up as part of the Sifers-Grayson Blue Team. Your task is to assist in analyzing and documenting the incident described below. The Blue Team has already created a set of enterprise architecture diagrams (see figures 1-4) to help with your analysis of the incident and preparation of the incident report as required by the company’s contracts with the federal government. After completing their penetration tests, the Red Team provided Sifers-Grayson executives with a diagram showing their analysis of the threat environment and potential weaknesses in the company’s security posture for the R&D DevOps Lab (see figure 5).
Your Deliverable
Complete and submit the Incident Report form found at the end of this file. Consult the “Notes to Students” for additional directions regarding completion of the form.
Overview of the Incident
Sifers-Grayson hired a cybersecurity consulting firm to help it meet the security requirements of a contract with a federal agency. The consulting firm’s Red Team conducted a penetration test and was able to gain access to the engineering center’s R&D servers by hacking into the enterprise network through an unprotected network connection (see figure 2). The Red Team proceeded to exfiltrate files from those servers and managed to steal 100% of the design documents and source code for the AX10 Drone System. The Red Team also reported that it had stolen passwords for 20% of the employee logins using keylogging software installed on USB keys that were left on the lunch table in the headquarters building employee lounge (see Figure 3). The Red Team also noted that the Sifers-Grayson employees were quite friendly and talkative as they opened the RFID controlled doors for the “new folks” on the engineering staff (who were actually Red Teamers).
The Red Team continued its efforts to penetrate the enterprise and used a stolen login to install malware over the network onto a workstation connected to a PROM burner in the R&D DevOps lab (See Figure 3). This malware made its way onto a PROM that was then installed in an AX10-a test vehicle undergoing flight trials at the Sifers-Grayson test range (See Figures 1 and 4). The malware “phoned home” to the Red Team over a cellular connection to the R&D center. The Red Team took control of the test vehicle and flew it from the test range to a safe landing in the parking lot at Sifers-Grayson headquarters.
Background
Sifers-Grayson is a family owned business headquartered in Grayson County, Kentucky, USA. The company’s physical address is 1555 Pine Knob Trail, Pine Knob, KY 42721. The president of the company is Ira John Sifers, III. He is the great-grandson of one of the company’s founders and is also the head of the engineering department. The chief operating officer is Michael Coles, Jr. who is Ira John’s great nephew. Mary Beth Sifers is the chief financial officer and also serves as the head of personnel for the company.
Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its R&D DevOps and SCADA labs operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS) including section 252-204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information, provided by the federal government and stored on computer systems in the Sifers-Grayson R&D DevOps and SCADA labs, is protected from unauthorized disclosure. This information includes software designs and source code. The contract requirements also mandate that Sifers-Grayson report cyber incidents to the federal government in a timely manner.
SCADA Lab
The SCADA lab was originally setup in 1974. It has been upgraded and rehabbed several times since then. The most recent hardware and software upgrades were completed three years ago after the lab was hit with a ransomware attack that exploited several Windows XP vulnerabilities. At that time, the engineering and design workstations were upgraded to Windows 8.1 professional. A second successful ransomware attack occurred three months ago. The company paid the ransom in both cases because the lab did not have file backups that it could use to recover the damaged files (in the first case) and did not have system backups that it could use to rebuild the system hard drives (in the second case).
The SCADA Lab is locked into using Windows 8.1. The planned transition to Windows 10 is on indefinite hold due to technical problems encountered during previous attempts to modify required software applications to work under the new version of the operating system. This means that an incident response and recovery capability for the lab must support the Windows 8.1 operating system and its utilities.
R&D DevOps Lab
The R&D DevOps Lab was built in 2010 and is used to develop, integrate, test, support, and maintain software and firmware (software embedded in chips) for the company’s robots, drones, and non-SCADA industrial control systems product lines. The workstations in this lab are running Windows 10 and are configured to receive security updates per Microsoft’s monthly schedule.
Enterprise IT Operations
The company uses a combination of Windows 10 workstations and laptops as the foundation of its enterprise IT capabilities. The servers in the data center and the engineering R&D center are built upon Windows Server 2012.
Issues Summary:
- Newly won government contracts now require compliance with DFARS §252.204-7008, 7009, and 7012
– http://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm
– http://www.acq.osd.mil/se/docs/DFARS-guide.pdf
- Derivative requirements include:
– Implementation of and compliance with NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf
– Compliance with DFARS 252.239-7009 Representation of Use of Cloud Computing and 7010 Cloud Computing Services (see https://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm#252.239-7009
- Additional Contractual Requirements for Lab Operations include:
– Incident Response per NIST SP-800-61 (Computer Security Incident Handling Guide)
– SCADA Security per NIST SP 800-82 (Guide to Industrial Control Systems Security)
– Software / Systems Development Lifecycle (SDLC) Security per NIST SP 800-64 (Security Considerations in the System Development Life Cycle)
– Configuration Management per NIST SP 800-128 (Guide for Security-Focused Configuration Management of Information Systems)
Notes to Students:
1. Your final deliverable should be professionally formatted and should not exceed 10 pages. The goal is to be clear and concise in your reporting of your analysis of this incident. This report should reflect your learning and analysis. For that reason, the citation rules are relaxed and you may write from your own knowledge as an “expert.” BUT, if you paste exact phrases, sentences, or paragraphs from another document or resource, you must cite that source using an appropriate citation style (e.g. footnotes, end notes, in-text citations).
2. You may include annotated diagrams if necessary to illustrate your analysis and/or make your point(s). You may use the figures in this assignment as the foundation for diagrams in your final report (no citations required).
3. Use the NIST Incident Handling Process (see Table 1) to guide your incident analysis. You do not need to cite a source for this table.
4. You may assume that the company has implemented one or more of the IT products that you recommended in your Case Studies for this course. You may also assume that the company is using the incident response guidance documents that you wrote for your labs and that the associated operating systems utilities are in use (e.g. you can assume that system backups are being made, etc.).
5. DOCUMENT YOUR ASSUMPTIONS about people, processes, and technologies as if they were fact. But, don’t change any of the factual information provided in the incident report from the Red Team.
6. Use the incident report form that appears at the end of this file. Copy it to a new MS Word document. Insert a title page at the beginning of your file and include the title of the report, your name, and the due date.
7. After you perform your incident analysis, fill in the required information in the provided form (see the end of this file). Attach the file to your assignment folder entry, and submit it for grading as your final project.
8. For section 1 of the form, use your own name but provide reasonable but fictitious information for the remaining fields.
9. For section 2 of the form, assign IP addresses in the following ranges to any servers, workstations, or network connections that you need to discuss.
a. R&D Center 10.10.120.0/24
b. Test Range 10.10.128.0/24
c. Corporate Headquarters 10.10.135.0/24
10. For sections 2, 3, and 5, you should use and interpret information provided in this file (Overview, Background, Issues Summary). You may use a judicious amount of creativity, if necessary, to fill in any missing information.
11. For section 4 of the form you may provide a fictitious cost estimate based upon $100 per hour for IT staff to perform “clean-up” activities. Reasonable estimates are probably in the range of 150 to 300 person hours. What’s important is that you document how you arrived at your cost estimate.
12. Discuss the contract requirements and derivative requirements for cybersecurity at Sifers-Grayson in 3 to 5 paragraphs under “Section 6 General Comments.”
Words for the Wise …
Do not let “perfection” be a barrier to completing this assignment. It’s more importation to be on-time and provide SOME analysis in a professional format than to find and document every single possible vulnerability.
Figure 1. Overview of Sifers-Grayson Enterprise IT Architecture
Figure 2. Combined Network and Systems Views:
Sifers-Grayson Headquarters, R&D Center, and Data Center
Figure 3. Combined Network and Systems View for Sifers-Grayson R&D DevOps Lab
Figure 4. Combined Communications and Systems Views for Sifers-Grayson Test Range
Figure 5. Threat Landscape for Sifers-Grayson R&D DevOps Lab
NIST Incident Handling Checklist by Phase
Detection and Analysis
1.
Determine whether an incident has occurred
1.1
Analyze the precursors and indicators
1.2
Look for correlating information
1.3
Perform research (e.g., search engines, knowledge base)
1.4
As soon as the handler believes an incident has occurred, begin documenting the investigation and gathering evidence
2.
Prioritize handling the incident based on the relevant factors (functional impact, information impact, recoverability effort, etc.)
3.
Report the incident to the appropriate internal personnel and external organizations
Containment, Eradication, and Recovery
4.
Acquire, preserve, secure, and document evidence
5.
Contain the incident
6.
Eradicate the incident
6.1
Identify and mitigate all vulnerabilities that were exploited
6.2
Remove malware, inappropriate materials, and other components
6.3
If more affected hosts are discovered (e.g., new malware infections), repeat the Detection and Analysis steps (1.1, 1.2) to identify all other affected hosts, then contain (5) and eradicate (6) the incident for them
7.
Recover from the incident
7.1
Return affected systems to an operationally ready state
7.2
Confirm that the affected systems are functioning normally
7.3
If necessary, implement additional monitoring to look for future related activity
Post-Incident Activity
8.
Create a follow-up report
9.
Hold a lessons learned meeting (mandatory for major incidents, optional otherwise)
Source: NIST SP 800-61r2
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST SP 800-62 rev. 2). http://dx.doi.org/10.6028/NIST.SP.800-61r2
SIFERS-GRAYSON CYBERSECURITY INCIDENT REPORT FORM
1. Contact Information for the Incident Reporter and Handler
– Name
– Role
– Organizational unit (e.g., agency, department, division, team) and affiliation
– Email address
– Phone number
– Location (e.g., mailing address, office room number)
2. Incident Details
– Status change date/timestamps (including time zone): when the incident started, when the incident was discovered/detected, when the incident was reported, when the incident was resolved/ended, etc.
– Physical location of the incident (e.g., city, state)
– Current status of the incident (e.g., ongoing attack)
– Source/cause of the incident (if known), including hostnames and IP addresses
– Description of the incident (e.g., how it was detected, what occurred)
– Description of affected resources (e.g., networks, hosts, applications, data), including systems’ hostnames, IP addresses, and function
– If known, incident category, vectors of attack associated with the incident, and indicators related to the incident (traffic patterns, registry keys, etc.)
– Prioritization factors (functional impact, information impact, recoverability, etc.)
– Mitigating factors (e.g., stolen laptop containing sensitive data was using full disk encryption)
– Response actions performed (e.g., shut off host, disconnected host from network)
– Other organizations contacted (e.g., software vendor)
3. Cause of the Incident (e.g., misconfigured application, unpatched host)
4. Cost of the Incident
5. Business Impact of the Incident
6. General Comments
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In This Scenario Hackers Launch Cyber Attacks That Affect Several Parts Of The
/in Uncategorized /by developerIn this scenario, hackers launch cyber attacks that affect several parts of the nation’s financial infrastructure over the course of several weeks. Specifically, sensitive credit card processing facilities are hacked and numbers are released to the Internet, causing 120 million cards to be canceled; automated teller machines (ATMs) fail nearly simultaneously across the nation; major companies report payroll checks are not being received by workers, and several large pension and mutual fund companies have computer malfunctions so severe that they are unable to operate for more than a week. Identify the countermeasures that need to be implemented to prevent these cyber attacks from occurring in the future.Start a discussion thread and discuss what type(s) of countermeasures need to be implemented to prevent the cyber attack described above from occurring in the future. Be specific in recommending countermeasures for this scenario.
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Voltaire S Tale Candide Travels Across The Known World Witnessing The Horrif
/in Uncategorized /by developerIn Voltaire’s tale, Candide travels across the known world witnessing the horrific brutalities that humans commit against one another in the name of religion, power, or simple greed. Having witnessed and experienced this violence, which puts into doubt Candide’s belief that life has a purpose and is primarily good, Candide comes to the conclusion that he and his friends must devote themselves to cultivating their garden. What does Voltaire mean by the phrase “cultivate our garden?” How effective of response is it to the incredible violence and despair present throughout the rest of the book?
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Unit Vii You Will Develop Your Final Presentation Which Will Be Focused On T
/in Uncategorized /by developerIn Unit VII, you will develop your final presentation, which will be focused on the protection of a selected critical infrastructure from a terrorist incident. The two parts in this assignment will work as the foundation for the Unit VII Course Project. Part 1: Project Topic Select the critical infrastructure for which you will develop your plan; you can use the same critical infrastructure that you used for your Unit II Project, or you can select a different critical infrastructure that is briefed on the webpage below: U.S. Department of Homeland Security. (n.d.). Critical infrastructure sectors. Retrieved from https://www.dhs.gov/criticalinfrastructure-sectors After selecting a critical infrastructure, develop a brief essay that meets the criteria below: The Critical infrastructure I select is Food-and-Agriculture-sector
The Department of Agriculture and the Department of Health and Human Services are designated as the co-Sector-Specific Agencies for the Food and Agriculture Sector.
Provide the background on the selected critical infrastructure/target. Please describe the infrastructure in your own words; do not copy the description from the webpage.
Provide examples of potential targets (e.g., a power supply plant, water resources, a military base, a shopping mall, a full stadium during an event, government buildings, an airport, a city center).
Briefly explain why the location is vulnerable to an attack.
Discuss what type of terrorist event will hypothetically take place at the critical infrastructure. You can select any type of terrorist event that has been discussed in this course. Some examples include chemical, biological, radiological, nuclear, or explosive (CBRNE) events. If you select a chemical or biological agent, be specific, and name the agent that the terrorist(s) will use in the hypothetical scenario.
Identify the federal, state, and local agencies that will be activated in response to your incident, and briefly summarize their roles and responsibilities in terrorism planning and preparedness.
Identify the homeland security programs that should be involved in planning the response to the incident. Your essay should be at least one page in length. HLS 3305, Disaster Planning and Management 3
Part 2: Annotated Bibliography In the same document, provide an annotated bibliography, which summarizes at least three scholarly resources that will be used for your Unit VII Course Project. An annotated bibliography lists citations of books, articles, and/or documents. Each citation is followed by a descriptive and evaluative paragraph that identifies what the resource is about and why it is of value to your research; this is called the annotation, which can contain 100-150 words. The purpose of the annotation is to inform the reader of the relevance, accuracy, and quality of the sources cited. The annotated bibliography will help you to organize your sources that will be used for your final presentation due in Unit VII. Each annotated bibliography entry consists of two parts: the APA-formatted reference citation followed by the summary for that reference. The annotated bibliography should be at least 2 pages in length. You are encouraged to view the annotated bibliography presentation linked below, which shows how an annotated bibliography should be formatted: Waldorf University. (n.d.). Annotated bibliographies: How to write an effective annotated bibliography. Retrieved from https://columbiasouthern.adobeconnect.com/_a1174888831/annotatedbibwaldorf/ Parts 1 and 2 should be combined into one document (three-page minimum requirement), which you will submit in Blackboard
Please read it and understand it. This is Homeland Security Work. Please do own words. I have already pick the Critical Infrastructure Sectors. There is a Part 1 & Part 2 to this paper.
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Week 2 You Were Introduced To The Bystander Effect Darley Latan 1968 The Per
/in Uncategorized /by developerIn Week 2, you were introduced to the bystander effect (Darley & Latané, 1968). The perceived diffusion of responsibility makes bystanders less likely to intervene in an emergency situation. It might be tempting to assume that aggressors and the bystanders who do nothing to intervene are just “bad” people; however, the reasons for how and why these behaviors occur are much more complex. In this assignment, you will consider how factors such as obedience to authority, perceived power, and diffused responsibility in the presence of others may explain varied responses to potential or actual harm to others.
By Day 7
Submit a 2 page paper that addresses the following:
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In What Part Of The Mitochondrion Does The Electron Transport System Take Place
/in Uncategorized /by developer. In what part of the mitochondrion does the electron transport system take place?
Solution:In general the mitochondria in eukaryotes consist of two parts and that can be named asthe inner and the outer mitochondria membranes. Usually in eukaryotes the electron transportchain…
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Your Own Words 50 75 Words Define The Term Historical Context If You Use Any
/in Uncategorized /by developer“In your own words (50-75 words), define the term “historical context.” If you use any outside sources, cite them in current Turabian format.”Try more general keywords.
Institution NameArticle NameType of SubmissionDepartmentBy{Author}Date 1 Historical ContextHistorical context refers to the attitudes, moods and conditions that prevailed in a certain…
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Your Own Experience What Evidence Do You See Of Government And Its Role In W
/in Uncategorized /by developer“In your own experience What evidence do you see of government and its role in Wal-Mart Superstore?Must be 100 words or more and in own words NO resources just personal experience.
Government might be indirectly responsible for the growth of store and format by various breaksand encouragement it gave to this industry but cannot be stated as preferable treatment to Walmart….
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
In Your Studies This Week You Found That The Optimal Order Quantity Is Achieved
/in Uncategorized /by developerIn your studies this week, you found that the optimal order quantity is achieved at the point at which inventory setup cost per unit of time equals inventory holding cost per unit of time. Knowing this, your employer, a manufacturer of office chairs, asks that you determine the optimal order quantity for two suppliers of coil springs.
Your manufacturing facility operates 50 weeks a year and requires a steady supply of 1000 coil springs per week. Supplier A charges $1 for each spring, and you resell them for $4 each. The set up charge is $20 per order. An inventory carrying charge of 25% is incurred.
Units
Setup costs
Inventory carrying cost
Show equation used with all above values filled in
Optimal order quantity of springs
The Optimal Order Quantities paper:
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
Incident Response Exercise Report Your Task You Have Been Assigned To Work Inci
/in Uncategorized /by developerIncident Response Exercise & Report
Your Task
You have been assigned to work incident clean-up as part of the Sifers-Grayson Blue Team. Your task is to assist in analyzing and documenting the incident described below. The Blue Team has already created a set of enterprise architecture diagrams (see figures 1-4) to help with your analysis of the incident and preparation of the incident report as required by the company’s contracts with the federal government. After completing their penetration tests, the Red Team provided Sifers-Grayson executives with a diagram showing their analysis of the threat environment and potential weaknesses in the company’s security posture for the R&D DevOps Lab (see figure 5).
Your Deliverable
Complete and submit the Incident Report form found at the end of this file. Consult the “Notes to Students” for additional directions regarding completion of the form.
Overview of the Incident
Sifers-Grayson hired a cybersecurity consulting firm to help it meet the security requirements of a contract with a federal agency. The consulting firm’s Red Team conducted a penetration test and was able to gain access to the engineering center’s R&D servers by hacking into the enterprise network through an unprotected network connection (see figure 2). The Red Team proceeded to exfiltrate files from those servers and managed to steal 100% of the design documents and source code for the AX10 Drone System. The Red Team also reported that it had stolen passwords for 20% of the employee logins using keylogging software installed on USB keys that were left on the lunch table in the headquarters building employee lounge (see Figure 3). The Red Team also noted that the Sifers-Grayson employees were quite friendly and talkative as they opened the RFID controlled doors for the “new folks” on the engineering staff (who were actually Red Teamers).
The Red Team continued its efforts to penetrate the enterprise and used a stolen login to install malware over the network onto a workstation connected to a PROM burner in the R&D DevOps lab (See Figure 3). This malware made its way onto a PROM that was then installed in an AX10-a test vehicle undergoing flight trials at the Sifers-Grayson test range (See Figures 1 and 4). The malware “phoned home” to the Red Team over a cellular connection to the R&D center. The Red Team took control of the test vehicle and flew it from the test range to a safe landing in the parking lot at Sifers-Grayson headquarters.
Background
Sifers-Grayson is a family owned business headquartered in Grayson County, Kentucky, USA. The company’s physical address is 1555 Pine Knob Trail, Pine Knob, KY 42721. The president of the company is Ira John Sifers, III. He is the great-grandson of one of the company’s founders and is also the head of the engineering department. The chief operating officer is Michael Coles, Jr. who is Ira John’s great nephew. Mary Beth Sifers is the chief financial officer and also serves as the head of personnel for the company.
Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its R&D DevOps and SCADA labs operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS) including section 252-204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information, provided by the federal government and stored on computer systems in the Sifers-Grayson R&D DevOps and SCADA labs, is protected from unauthorized disclosure. This information includes software designs and source code. The contract requirements also mandate that Sifers-Grayson report cyber incidents to the federal government in a timely manner.
SCADA Lab
The SCADA lab was originally setup in 1974. It has been upgraded and rehabbed several times since then. The most recent hardware and software upgrades were completed three years ago after the lab was hit with a ransomware attack that exploited several Windows XP vulnerabilities. At that time, the engineering and design workstations were upgraded to Windows 8.1 professional. A second successful ransomware attack occurred three months ago. The company paid the ransom in both cases because the lab did not have file backups that it could use to recover the damaged files (in the first case) and did not have system backups that it could use to rebuild the system hard drives (in the second case).
The SCADA Lab is locked into using Windows 8.1. The planned transition to Windows 10 is on indefinite hold due to technical problems encountered during previous attempts to modify required software applications to work under the new version of the operating system. This means that an incident response and recovery capability for the lab must support the Windows 8.1 operating system and its utilities.
R&D DevOps Lab
The R&D DevOps Lab was built in 2010 and is used to develop, integrate, test, support, and maintain software and firmware (software embedded in chips) for the company’s robots, drones, and non-SCADA industrial control systems product lines. The workstations in this lab are running Windows 10 and are configured to receive security updates per Microsoft’s monthly schedule.
Enterprise IT Operations
The company uses a combination of Windows 10 workstations and laptops as the foundation of its enterprise IT capabilities. The servers in the data center and the engineering R&D center are built upon Windows Server 2012.
Issues Summary:
– http://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm
– http://www.acq.osd.mil/se/docs/DFARS-guide.pdf
– Implementation of and compliance with NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf
– Compliance with DFARS 252.239-7009 Representation of Use of Cloud Computing and 7010 Cloud Computing Services (see https://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm#252.239-7009
– Incident Response per NIST SP-800-61 (Computer Security Incident Handling Guide)
– SCADA Security per NIST SP 800-82 (Guide to Industrial Control Systems Security)
– Software / Systems Development Lifecycle (SDLC) Security per NIST SP 800-64 (Security Considerations in the System Development Life Cycle)
– Configuration Management per NIST SP 800-128 (Guide for Security-Focused Configuration Management of Information Systems)
Notes to Students:
1. Your final deliverable should be professionally formatted and should not exceed 10 pages. The goal is to be clear and concise in your reporting of your analysis of this incident. This report should reflect your learning and analysis. For that reason, the citation rules are relaxed and you may write from your own knowledge as an “expert.” BUT, if you paste exact phrases, sentences, or paragraphs from another document or resource, you must cite that source using an appropriate citation style (e.g. footnotes, end notes, in-text citations).
2. You may include annotated diagrams if necessary to illustrate your analysis and/or make your point(s). You may use the figures in this assignment as the foundation for diagrams in your final report (no citations required).
3. Use the NIST Incident Handling Process (see Table 1) to guide your incident analysis. You do not need to cite a source for this table.
4. You may assume that the company has implemented one or more of the IT products that you recommended in your Case Studies for this course. You may also assume that the company is using the incident response guidance documents that you wrote for your labs and that the associated operating systems utilities are in use (e.g. you can assume that system backups are being made, etc.).
5. DOCUMENT YOUR ASSUMPTIONS about people, processes, and technologies as if they were fact. But, don’t change any of the factual information provided in the incident report from the Red Team.
6. Use the incident report form that appears at the end of this file. Copy it to a new MS Word document. Insert a title page at the beginning of your file and include the title of the report, your name, and the due date.
7. After you perform your incident analysis, fill in the required information in the provided form (see the end of this file). Attach the file to your assignment folder entry, and submit it for grading as your final project.
8. For section 1 of the form, use your own name but provide reasonable but fictitious information for the remaining fields.
9. For section 2 of the form, assign IP addresses in the following ranges to any servers, workstations, or network connections that you need to discuss.
a. R&D Center 10.10.120.0/24
b. Test Range 10.10.128.0/24
c. Corporate Headquarters 10.10.135.0/24
10. For sections 2, 3, and 5, you should use and interpret information provided in this file (Overview, Background, Issues Summary). You may use a judicious amount of creativity, if necessary, to fill in any missing information.
11. For section 4 of the form you may provide a fictitious cost estimate based upon $100 per hour for IT staff to perform “clean-up” activities. Reasonable estimates are probably in the range of 150 to 300 person hours. What’s important is that you document how you arrived at your cost estimate.
12. Discuss the contract requirements and derivative requirements for cybersecurity at Sifers-Grayson in 3 to 5 paragraphs under “Section 6 General Comments.”
Words for the Wise …
Do not let “perfection” be a barrier to completing this assignment. It’s more importation to be on-time and provide SOME analysis in a professional format than to find and document every single possible vulnerability.
Figure 1. Overview of Sifers-Grayson Enterprise IT Architecture
Figure 2. Combined Network and Systems Views:
Sifers-Grayson Headquarters, R&D Center, and Data Center
Figure 3. Combined Network and Systems View for Sifers-Grayson R&D DevOps Lab
Figure 4. Combined Communications and Systems Views for Sifers-Grayson Test Range
Figure 5. Threat Landscape for Sifers-Grayson R&D DevOps Lab
NIST Incident Handling Checklist by Phase
Detection and Analysis
1.
Determine whether an incident has occurred
1.1
Analyze the precursors and indicators
1.2
Look for correlating information
1.3
Perform research (e.g., search engines, knowledge base)
1.4
As soon as the handler believes an incident has occurred, begin documenting the investigation and gathering evidence
2.
Prioritize handling the incident based on the relevant factors (functional impact, information impact, recoverability effort, etc.)
3.
Report the incident to the appropriate internal personnel and external organizations
Containment, Eradication, and Recovery
4.
Acquire, preserve, secure, and document evidence
5.
Contain the incident
6.
Eradicate the incident
6.1
Identify and mitigate all vulnerabilities that were exploited
6.2
Remove malware, inappropriate materials, and other components
6.3
If more affected hosts are discovered (e.g., new malware infections), repeat the Detection and Analysis steps (1.1, 1.2) to identify all other affected hosts, then contain (5) and eradicate (6) the incident for them
7.
Recover from the incident
7.1
Return affected systems to an operationally ready state
7.2
Confirm that the affected systems are functioning normally
7.3
If necessary, implement additional monitoring to look for future related activity
Post-Incident Activity
8.
Create a follow-up report
9.
Hold a lessons learned meeting (mandatory for major incidents, optional otherwise)
Source: NIST SP 800-61r2
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST SP 800-62 rev. 2). http://dx.doi.org/10.6028/NIST.SP.800-61r2
SIFERS-GRAYSON CYBERSECURITY INCIDENT REPORT FORM
1. Contact Information for the Incident Reporter and Handler
– Name
– Role
– Organizational unit (e.g., agency, department, division, team) and affiliation
– Email address
– Phone number
– Location (e.g., mailing address, office room number)
2. Incident Details
– Status change date/timestamps (including time zone): when the incident started, when the incident was discovered/detected, when the incident was reported, when the incident was resolved/ended, etc.
– Physical location of the incident (e.g., city, state)
– Current status of the incident (e.g., ongoing attack)
– Source/cause of the incident (if known), including hostnames and IP addresses
– Description of the incident (e.g., how it was detected, what occurred)
– Description of affected resources (e.g., networks, hosts, applications, data), including systems’ hostnames, IP addresses, and function
– If known, incident category, vectors of attack associated with the incident, and indicators related to the incident (traffic patterns, registry keys, etc.)
– Prioritization factors (functional impact, information impact, recoverability, etc.)
– Mitigating factors (e.g., stolen laptop containing sensitive data was using full disk encryption)
– Response actions performed (e.g., shut off host, disconnected host from network)
– Other organizations contacted (e.g., software vendor)
3. Cause of the Incident (e.g., misconfigured application, unpatched host)
4. Cost of the Incident
5. Business Impact of the Incident
6. General Comments
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"
Inc S Consolidated Balance Sheets From Its 2007 Annual Report Are Presented In
/in Uncategorized /by developerExcel format – please show formulasBest Buy Co., Inc.’s consolidated balance sheets from its 2007 annual report are presented in Exhibit 5-3.(attached) a. Using the balance sheets, prepare a vertical common-size analysis for 2007 and 2006. Use total assetsas a base.b. Using the balance sheets, prepare a horizontal common-size analysis for 2007 and 2006. Use 2006 asthe base.c. Comment on significant trends that appear in (a) and (b).
"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"