What is the most effective way to prioritize systems during the incident containment and eradication process?

Containment and eradication are crucial components of incident response. By swiftly identifying the scope and impact of the incident, organizations can effectively implement short-term measures to mitigate the immediate threat while simultaneously strategizing long-term solutions to prevent future occurrences. Analyzing and restoring affected systems is essential for returning operations to normalcy, while thorough documentation and reporting ensure that lessons are learned and best practices are established for future incidents.

Let me leave me an interesting industry urban legend from many years ago that I have heard: One of the system engineers / administrators has openly admitted to a fraud and demanded a ransom. The way he has done it, is through tainting all the systems he had access to (meaning - all of them), that stolen data was going through. I'll leave up to the reader further implications for the organization, as part of reporting it to the law enforcement and decision that could have been taken by the management of that organization, as well as lesson for the future for system design and importance for segregation of duties.

Prioritization is a key aspect of incident containment and eradication, as it helps to allocate resources and efforts efficiently and effectively. Prioritization can be based on several factors, such as impact, severity, ease of spreading, value and/or sensitive of the data involved, etc. By prioritizing systems according these factors, the incident response team can focus on the most critical and urgent tasks, such as containing the most dangerous or widespread threats, eradicating the most persistent or harmful malware, and recovering the most essential or vulnerable systems. Prioritization can also help to reduce the overall damage and cost of the incident, as well as to improve the quality and timeliness of the incident response.

Eradication should focus on eliminating threat access points and applying a permanent fix like patching or reconfiguration. It’s crucial to document every action during this phase for future reference. Heimdal Security offers insights into the eradication phase, emphasizing the importance of thorough documentation and a comprehensive understanding of attack vectors

Prioritizing isn't the same for every situation. It relies on different things like how serious the problem is, how the systems are set up, and what the business needs. To figure out what comes first, think about stuff like how important the systems are, how long the problem has been going on, whether it could spread to other parts, what you can do to stop it, and how much it would hurt if things stayed down or data got lost. So, it's about weighing all these factors to decide what to tackle first and how to do it.

Again, here's another use case where traditional IT-centric plans -MUST- consider impacts to operational technology (OT) and industrial control systems (ICS) in certain environments. I've unfortunately worked with CISOs and business continuity specialists with fantastic incident response and disaster recovery plans... that completely ignored their ICS assets and networks. Understanding dependencies, as well as safety and reliability impacts, requires inviting operations stakeholders. This cannot be done in a vacuum. Work across the IT-OT divide to create, validate, and sustain your incident response efforts.

Microsoft’s incident management strategies suggest a thorough analysis to inform eradication techniques. Decisions on how to evict adversaries and mitigate vulnerabilities are made considering the business impact, nature of the incident, and penetration depth

All is about dependencies. You need to have defined simple goal(s), i.e. contain the data leak, restore availability of system, contain the impact. Usually this is should be pre-assessed and pre-planned and practised at least on a high level, for possible major incident scenarios. Use consolidated metrics (but often more granular) as the security pillars: confidentiality, integrity, availability. You need to identify critical path, and split resources (i.e. time, people, money) among that path. Every time there is a new avenue for analysis opening, you need to quickly assess if it is worth investing limited resources, and take it from elsewhere. Answering question if it is laying on critical path, helps to set priority for the right area.

1. Have a "scribe". If the incident is held via conferencing, leverage transcription for post-mortem analysis. 2. Note on people's capacity and plan for it properly. Plan and assess if you should involve all the people at once for quicker incident resolution, or you see it will be a bigger one and you need to work on a incident for multiple days on a rotation basis? 3. Learn from the best. Airline industry has the bests safety protocols from all industries. Get familiar with methodologies used there. 4. Ensure readiness - check if your inventory is up-to-date, practice emergency procedures. Perform tabletop exercises for major incidents and get management familiar with classes of decisions that they should be prepared to take.

Prioritizing incidents based on impact helps streamline the response, ensuring critical systems are addressed first, reducing downtime, and helping maintain business continuity. The benefits extend to recovery as well, where prioritization ensures a structured and efficient return to normal operations

Prioritizing systems during the incident containment and eradication process is crucial to minimizing damage and restoring operations efficiently. The most effective way to do this involves: * A combination of understanding the Impact of the incident. * The criticality of affected systems to business operations. * The resources available for response. By taking a comprehensive and structured approach to prioritize systems during incident containment and eradication, organizations can focus their efforts where they will have the most significant impact, thereby minimizing downtime, reducing the scope of the breach, and ensuring a quicker return to normal operations.

Maintaining robust documentation throughout the incident response process is imperative. Not only does it help in pressing charges if the incident is criminal, but it also provides valuable lessons for improving future responses. Cynet’s blog emphasizes the importance of a well-documented incident response that includes all actions taken