Forensic Readiness for Effective Incident Management

Transcription

1 A Poit of View Foresic Readiess for Effective Icidet Maagemet Abstract Bakig ad fiacial istitutios today face several iformatio security related threats. There is a visible surge i cyber-attacks, which is leadig to a icrease i issues related to legal, regulatory, ad privacy compliace. The lack of proper foresic readiess also pushes up the cost of ivestigatio of cyber security icidets ad results i legal ad compliace issues for orgaizatios. The ability to idetify, ivestigate, ad mitigate such security icidets, while esurig legal ad regulatory compliace, has thus become a orgaizatioal imperative. This paper discusses the compoets of a effective foresic readiess program, the implemetatio strategy, ad the costs ivolved, while highlightig potetial beefits. Cyber-attacks: A growig area of cocer The recet cyber-attacks o baks, fiacial istitutios, ad paymet processors are a validatio of the icreasig techical expertise of cybercrimials ad their ability to cause sigificat damage while orchestratig remotely. From mobile malware to bakig Trojas, ad poit-of-sale (POS) ad retail breaches, the threat ladscape cotiues to evolve. At the same time, paymet risks associated with retailers ad paymet processors are raisig cocers. Our experiece idicates that POS breaches, such as the oes that struck Target Corporatio ad Neima Marcus, illustrate the average cost of the complexities ivolved i esurig the security of fiacial trasactios across multiple ivestigatio ad cleaup etities. Distributed Deial of Service (DDoS) attacks, spear phishig, mobile malware, activities followig a security rasomware, ad isider threats, cotiue to edager bakig ad fiacial istitutios. icidet has icreased Give the circumstaces, a ideal approach is to focus o detectig, recoverig, ad maifold over the last few mitigatig cyber security risks across multiple chaels. A poorly maaged security icidet years. This icrease is maily ca adversely impact a orgaizatio by icreasig dowtime, escalatig the cost of attributed to a lack of ivestigatio, ad attractig legal liability ad sactios besides resultig i egative publicity. readiess to idetify, collect, How should baks ad fiacial istitutios prepare themselves to deal with such security icidets ad avoid egative cosequeces such as cost of ivestigatio, litigatio, ad busiess dowtime? The solutio lies i deployig a digital foresic readiess program. ad aalyze proper evidece to mitigate the impact of cyber-attacks. How Digital Foresic Readiess Ca Come to the Rescue Foresic sciece is the applicatio of sciece ad techology to resolve legal problems. Digital foresics is a brach of foresic sciece that deals with acquirig, autheticatig, ad aalyzig digital evidece i a legally acceptable maer. Digital foresics is commoly employed as a post security icidet respose to Digital foresics has moved uderstad the 'what, why, who, where, ad whe' of a icidet, but ca come i hady as a from a reactive to a proactive preemptive tool as well. Orgaizatios ca hugely beefit from collectig, autheticatig, practice ad has become a ad preservig the evidece before the occurrece of a icidet. The foresic readiess cocept essetially implies collectig credible digital evidece ad miimizig the itegral part of iformatio ivestigatio cost durig a icidet respose. It also covers a orgaizatio's ability to use security. digital evidece to its maximum potetial while reducig the cost of ivestigatio.

2 Case i Poit I respose to a moey lauderig ivestigatio, a leadig bak was asked to produce relevat digital evidece by the law eforcemet agecies. Additioally, the bakig regulatory authority issued the bak a otice to coduct a third party ivestigatio ad submit a report. To maitai its reputatio ad safeguard the iterests of its stakeholders, the bak egaged with a service provider to ivestigate ad idetify the modus operadi of the icidet, violatio of KYC orms if ay, status of security cotrols, ad so o. The absece of a holistic foresic readiess program made it impossible for the bak to produce the digital evidece required for ivestigatio ad electroic evidece which ca stad to the scrutiy of court leadig to pealties to the tue of USD 1.25 millio, ad a sigificat ivestigatio cost as well. To prevet recurrece of such icidets, we advised the bak to deploy soud data collectio, retetio ad retrieval policies, such as electroic discovery service to aalyze differet types of data available o the bak's servers. A Cost versus Beefit Aalysis of a Digital Foresic Readiess Program Some typical costs related to the implemetatio of a digital foresic readiess program arise from: Policy makig: The orgaizatio's data collectio ad retetio, cyber security ad icidet respose policies ad procedures should be evaluated ad updated accordigly. Assessig the icidet respose maturity of the orgaizatio is a prerequisite. Executio: A seamless mechaism for collectig, storig, retrievig, ad retaiig digital evidece, eeds to be deployed. I additio, advaced aalytics capabilities eed to be built i to the system. Persoel traiig: Employees eed to be traied o iformatio security maagemet, security awareess, icidet respose, ad digital foresic capability. Persoel traiig Policy makig Executio Legal ad regulatory compliace Seamless Collectio of evidece Risk mitigatio Digital Foresic Readiess Program 2

3 Digital foresic readiess offers beefits across multiple busiess operatios, such as: Seamless collectio of evidece: The program eables orgaizatios to gather evidece i a legally acceptable maer, ad without disruptig busiess processes. It also esures that the collected evidece is relevat to the case, thus havig a positive impact o the outcome of the ivestigatio. Risk mitigatio: Accurate idetificatio of locatio of potetial digital evidece helps orgaizatios decrease the impact of cyber security icidets. Busiess dowtime ad ivestigatio costs ca be sigificatly reduced. Legal ad regulatory compliace: The program helps orgaizatios esure requisite legal compliace, thus buildig a positive image amog customers, which i tur icreases their cofidece durig cotractual discussios. It also eables effective maagemet of litigatio issues or whe the court orders for the ivestigatio data to be preseted. I a utshell, the beefits of implemetig a foresic readiess program clearly outweigh the costs associated with it. Compoets of a Digital Foresic Readiess Program The three pillars of a digital foresic readiess program are strategy, policy ad procedures, ad techology. Digital Foresic Readiess Program Strategy Determiig scearios that require collectio of digital evidece Idetifyig the sources of digital evidece Assessig persoel ad resource requiremets Budgetig for creatig, implemetig, ad maitaiig a foresic readiess pla Policy & Procedures Techology Determiig the eed for coductig a iteral ivestigatio, ad defiig the roles ad resposibilities of the stakeholders i collectig, preservig, ad maitaiig digital evidece Equip themselves with the ecessary software ad hardware tools to idetify, collect, preserve, ad foresically aalyze digital evidece from various types of data sources. Idetifyig the circumstaces i which the digital evidece eeds to be collected, preserved, ad retaied for a specific period of time, as well as defiig the circumstaces i which it eeds to be subjected to legal review Sources may iclude firewalls, itrusio detectio systems (IDS), itrusio prevetio systems (IPS), security iformatio ad evet maagemet (SIEM) applicatios, servers, laptops, desktops, ad so o. Idetifyig the sources ad types of digital evidece withi the orgaizatio Aligig digital foresic readiess with the existig icidet respose maagemet procedure 3

4 Coclusio Bakig ad fiacial istitutios o loger view cyber security as a fiacial burde or a compliace hurdle, but cosider it a vital busiess eabler that ehaces customer cofidece ad brigs i more busiess. As a result, orgaizatios attitude to cyber security ivestmets has chaged. Orgaizatios should exted this shift to foresic readiess programs as well to better respod to security icidets ad mitigate their impact. By itegratig a effective digital foresic readiess framework with the iformatio security ad goverace strategy, orgaizatios ca miimize the cost of collectig evidece i a foresically soud maer besides reducig litigatio ad busiess dowtime. About the Author Krisha Sastry Pedyala Krisha Sastry Pedyala heads the Fraud Maagemet ad Digital Foresics group with the Eterprise Security ad Risk Maagemet (ESRM) uit at Tata Cosultacy Services (TCS). With over 23 years of experiece i this field, Krisha has played a pivotal role i safeguardig critical atioal iformatio ifrastructure, proactively ad reactively, agaist cyber threats. Before joiig TCS, he worked with the Miistry of Home Affairs, Govt. of Idia, as a digital foresic ivestigator where he maaged cyber security icidets ad crime ivestigatios of atioal ad iteratioal importace. 4

5 About TCS' Bakig ad Fiacial Services Busiess Uit With over four decades of experiece workig with the world's leadig baks ad fiacial istitutios, TCS offers a comprehesive portfolio of domai-focused processes, frameworks, ad solutios that empower orgaizatios to respod to market chages quickly, maage customer relatioships profitably, ad stay ahead of competitio. Our offerigs combie customizable solutio accelerators with expertise gaied from egagig with global baks, regulatory ad developmet istitutios, ad diversified ad specialty fiacial istitutios. TCS raked #2 i the 2013 FiTech 100 rakigs of top global techology providers to the fiacial services idustry ad couts 12 of the top 20 global fiacial istitutios amog its clietele. From retail ad corporate bakig, capital markets, market ifrastructure, ad cards, to risk maagemet ad treasury, TCS helps orgaizatios achieve key operatioal ad strategic objectives. About TCS Eterprise Security ad Risk Maagemet (ESRM) Uit Leveragig our rich experiece i eterprise security, TCS helps global eterprises across verticals maage risks, esure regulatory compliace, proactively protect critical iformatio assets agaist emergig threats, achieve resiliece, ad recover rapidly from security icidets. TCS has a successful track record of executig umerous egagemets globally, deliverig domai itegrated security solutios fully aliged with cliets' objectives. Our global service ifrastructure, icludig the shared services Security Operatios Ceter (SOC) ad Foresics Labs, backed by the capabilities of our certified security cosultats, make TCS a strategic parter of choice for early half of the Fortue 500 compaies. Our Security Iovatio labs foster research ad iovatio i the field of data privacy, ad have yielded multiple patets ad itellectual properties i data protectio ad cryptographic products. We leverage our alliaces with all major security vedors, icludig IBM, CISCO, ad Oracle, to deliver ed-to-ed services ad solutios across the security ladscape, from cosultig to implemetatio ad maaged services. Cotact For more iformatio about TCS' Bakig ad Fiacial Services or ESRM, us at bfs.marketig@tcs.com global.esrm@tcs.com About Tata Cosultacy Services Ltd (TCS) Tata Cosultacy Services is a IT services, cosultig ad busiess solutios orgaizatio that delivers real results to global busiess, esurig a level of certaity o other firm ca match. TCS offers a cosultig-led, itegrated portfolio of IT ad IT-eabled ifrastructure, egieerig ad assurace services. This is delivered through its uique Global Network Delivery ModelTM, recogized as the bechmark of excellece i software developmet. A part of the Tata Group, Idia s largest idustrial coglomerate, TCS has a global footprit ad is listed o the Natioal Stock Exchage ad Bombay Stock Exchage i Idia. IT Services Busiess Solutios Cosultig All cotet / iformatio preset here is the exclusive property of Tata Cosultacy Services Limited (TCS). The cotet / iformatio cotaied here is correct at the time of publishig. No material from here may be copied, modified, reproduced, republished, uploaded, trasmitted, posted or distributed i ay form without prior writte permissio from TCS. Uauthorized use of the cotet / iformatio appearig here may violate copyright, trademark ad other applicable laws, ad could result i crimial or civil pealties. Copyright 2014 Tata Cosultacy Services Limited TCS Desig Services I M I 11 I 14 For more iformatio, visit us at