How can you restore a system without causing further damage?

To restore a system without causing further damage is paying attention to the extent of the incident and the loss incurred. To achieve this, you have to first identify the incident and this begins with proper analysis such as the timing of the incident, root cause analysis, incident handling and even lessons learnt which will help you place your priorities right. In incident handling, containing the incident is crucial because this is where proper management of the incident comes in play. This will prevent the attack from spreading to other systems and reduce the risk of further damage or data loss.

O primeiro ponto a partir da existência de um incidente é mapear quais foram os impactos e serviços afetados naquele incidente. A partir desse ponto, podemos acionar os profissionais corretos, assim como ser assertivo nas ações de contenção daquele incidente.

The most important step is to identify which services were provided and test their availability to determine the extent of the incident. 🔽 To do this you will analyze things like ports, network, logs, and use tools like nmap, ping, sql queries for databases etc. 🔽 A host based IDS can be a great help to determine if there was any corruption in files, this will save you a lot of time and energy. After that you can go on and restore from backup or from script. 🔽 However, the most ideal way to do this will be to have a proper BCP which includes a solid DR plan. The plan determines the scope of the services per system and in turn identify the backups and DR system to build. 🔽 If the BCP is tested regularly, then the above will be easier.

The first step of an Incident Response plan is to identify the scope of the incident and determine which systems, networks, and data are affected. You can use tools such as logs, alerts, forensic tools, and network monitoring to gather information and evidence about the attack. You should also document the incident details, such as the date, time, source, type, and impact of the attack. This will help you to assess the severity of the incident and prioritize your actions.

A contenção de um incidente é fundamental para diminuir o escopo e impacto de um ataque. Nesse sentido, em muitos casos é realizado estudo para erradicação antes da contenção, e isso gera impacto nos negócios da organização devido ao tempo de indisponibilidade de um sistema. Por isso, conter e retomar a operação é essencial para que a identificação da causa raiz seja feita com maior segurança e tranquilidade.

Back in 2005 we had a worm attack in our company which had about 300 staff in HQ + branches. 🔽 The worm was infecting new PCs at very high rate, it was a zero-day attack and this sent us to stone ages. We had no help from our AV vendor. 🔽 Out first plan was to isolate the unaffected PCs, so we had to determine how it spreads. We came to know it was through a system process, the worm was copying itself as hidden folders inside user profiles. 🔽 But how was the first PC affected? we came to know from other organizations that there was a specific port which was used to download the worm from the internet, so we blocked the incoming port. 🔽 We shutdown all clean PCs, and removed the worm files from the infected ones. This solved the problem.

Quando se fala de restauração, muitos olhares se voltam a estrutura de backup. Apesar de entender que existem outros aspectos a serem considerados, como um ambiente de DR para momentos de crise, é essencial que o backup esteja integro, testado e validado para esses momentos de crise.

Employing clean, trusted media for the restoration process is vital to avoid reintroducing vulnerabilities. This involves using secure and verified sources for any software or system images needed for the restoration. For instance, during the restoration of an enterprise server, we sourced system images directly from trusted vendors and verified their authenticity through digital signatures, ensuring the restoration process was not compromised by malicious actors. After initial system restoration, it's important to incrementally apply patches and updates to bring the system up to the latest security standards. This process needs to be carefully managed to avoid system instability or compatibility issues.

Preparar equipes para esse momento de crise é fundamental para a jornada de resposta a um incidente cibernético. Profissionais resilientes e preparados para trabalhar sob pressão são essenciais para esses momentos. Devido a complexidade que um incidente pode ter, também possuir profissionais de outras equipes disponíveis para auxílios acelera o tempo operacional de resposta.