In mid-November, the Cybersecurity and Infrastructure Security Agency (CISA) released the Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. These playbooks are designed to aid federal civilian agencies to respond to cybersecurity vulnerabilities. The CISA hopes to standardize the approaches federal agencies take to identify, remediate, and recover from cybersecurity vulnerabilities. As the threat of cybersecurity becomes ever more present, these playbooks aid in shutting down the type of attacks that have led to widely publicized incidents that sent ripple effects across the nation.
What Are the Cybersecurity Incident & Vulnerability Response Playbooks?
The Cybersecurity and Infrastructure Security Agency Act of 2018 ordered the creation of CISA under the Department of Homeland Security. The stated mission of the agency is to assist both government agencies and private sector organizations respond to cybersecurity threats. These playbooks are the latest of the agency’s steps in providing that assistance. They include a set of practices and procedures to follow when a cybersecurity incident occurs. This includes steps for both planning and conducting activities to mitigate the damage caused by a cybersecurity threat and to help ensure that similar threats do not reoccur. The release consists of two playbooks: one for incidents and one for vulnerabilities.
Incident Response Playbook
This playbook covers confirmed malicious cyber activity which has already had a major incident declared. It breaks its content down according to the five incident response phases outlined by the National Institute of Standards and Technology’s Special Publication 800-61. These are:
- Preparation
- Detection and analysis
- Containment
- Eradication and Recovery
- Post-incident activities
Vulnerability Response Playbook
This playbook does not replace the existing management programs, but rather builds upon those practices. It prioritizes vulnerabilities previously exploited for an organization to focus their vulnerability response. By creating a standardized response above and beyond whatever other measures may be in place, the document aims to help agencies better understand the impact of these vulnerabilities across the government. Similar to the incident response playbook, this one is split into five major sections:
- Preparation
- Identification
- Evaluation
- Remediation
- Reporting and notification
Why Was the Cybersecurity Incident & Vulnerability Response Introduced?
President Biden signed Executive Order 14028 on May 12, 2021. This comprehensive order, Improving the Nation’s Cybersecurity, provides a lengthy list of steps to help the country better respond to cybersecurity incidents. The executive order itself relates to the cyberattacks that occurred in the early days of the Biden presidency. One category of steps the order outlined is the requirement of several federal agencies. Thus, producing new rules and guidance on how to deal with cybersecurity threats. The playbooks just released by the CISA are two examples of that requirement.
Who Does This Effect?
Although the playbooks remain publicly available, organizations under the authority of the CISA and independent contractors who do work for them are required to follow the procedures. The CISA covers over 100 federal civilian executive branches (FCEB) agencies. Federal government policy requires any information and communications technology service provider contracted with FCEB agencies to report incidents to both the agency they are contracted to and to the CISA.
What Constitutes an Incident?
The playbooks provide two categories of occurrences that constitute an incident. The first is any occurrence that jeopardizes the integrity, confidentiality, or availability of information or an information system. The second is any occurrence that constitutes a violation of law, security policies, security procedures, or acceptable use policies. Both of these definitions extend to include occurrences that pose an imminent, but not yet actualized, threat.
Major incidents include any incident that results in harm to national security, foreign relations, or the economy. This definition extends to incidents that are likely to cause harm to public confidence, civil liberties, or the health and safety of the public.
Understanding the Cybersecurity Incident & Vulnerability Response Playbook
Once an incident occurs, the stakes become significantly higher. This playbook provides a list of steps and best practices to mitigate the damage caused by such incidents and policies and procedures that will help ensure that similar incidents do not occur again.
Preparation
Being ready for a cyber attack isn’t just about prevention. When an attack does occur, preparedness goes a long way in determining how quickly the threat can be minimized. This section outlines the steps to take to monitor for threats, educate staff on how to respond to threats, and improve communications so that your organization can act cohesively should a threat arise.
Detection and Analysis
Quickly detecting and accurately assessing incidents is a vital aspect of reducing the amount of damage that can do to an organization. This section lays out the best practices for incident detection and analysis. It includes policies for determining the scope of the investigation, collecting and preserving data, and performing an analysis on that data. It also includes best practices for reaching out for outside support, if needed.
Containment
Once a threat is detected, the adversary’s access must be quickly shut down and their ability to inflict further damage removed. Because threat containment is such a broad category, where the ideal strategy differs greatly depending on the type of attack, this section keeps things generic. It provides a list of considerations and key containment strategies to evaluate and apply when determining how to best deal with a given threat.
Eradication and Recovery
The final step before normal activities can be resumed is the eradication of any artifacts left from the incident. This includes removing malicious code and re-imaging infected systems. Whatever vulnerabilities allowed for the attack should also be taken care of to prevent reoccurrence. This section of the playbook covers the strategy for executing an eradication plan and recovering the systems after eradication.
Post-Incident Activities
With the immediate cause of a given incident taken care of in the previous phase, there’s still more to do. Any lessons learned about how the failure happened and how the response to it was carried out should be evaluated and applied to future plans. Reports should be made to agency leadership, and to the CISA if required.
Although not directly related to incident response, the final section of this playbook also lays out the policies and procedures for coordinating with the CISA as the response to the incident is underway.
Understanding the Cybersecurity Incident & Vulnerability Response Playbook
This playbook consists of a short introduction on preparation followed by four key steps to take in order to best prioritize an agency’s vulnerability response. In addition to providing a detailed overview of each step, the playbook provides a checklist for each that allows your agency to effectively document its response to each step for each vulnerability encountered.
Preparation
Unlike the more complete section on preparation in the incident response playbook, this section is more of a prologue to the actual procedures for vulnerability response. It’s a brief section that touches on the importance of preparation and what areas it should cover.
Identification
Moving on to the meat and bones of the vulnerability response playbook, we come first to the identification. Because this playbook is all about focusing on current threats that are active in the wild, this section is mostly about monitoring threat feeds and sources so that your response team is always on top of new threats as they emerge.
Evaluation
Once your response team becomes aware of a given threat, evaluate the risk it poses to your organization. Not every threat will apply to every system. The steps in this phase include determining risks to your systems and what dangers they pose if compromised. Should your systems already be compromised, the evaluation phase will also make that known.
Remediation
The most common form of remediation is patching. This updated software and firmware of vulnerable systems so that known threats no longer pose a risk. Some threats require more steps, however. Limiting access, isolating systems, or making permanent configuration changes could also play a role in the proper remediation strategy.
Reporting and Notification
Agencies working together to expose vulnerabilities and help prioritize the most important patches and procedures allow each of them to more effectively make use of their vulnerability response schedule.
Implementing the Cybersecurity Incident & Vulnerability Response Playbooks
While they provide a detailed overview of a response plan, the playbooks avoid great detail about the technical aspects. These playbooks require IT security professionals with the skill and knowledge to apply to real-world scenarios.
Agile IT is a four-time Microsoft partner of the year. We hold 16 gold competencies, including within security. If you need to make sure you’re doing everything you can to reduce the risk of a cyberattack and comply with the best practices and procedures laid out in these playbooks, contact us today for a free security consultation.
Published on: .
