Incident Response Fight 35342

Published on February 2017 | Categories: Documents | Downloads: 90 | Comments: 0 | Views: 715
of 28
Download PDF   Embed   Report

Comments

Content

 

Interested in learning more about security?

SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission.

Incident Response: How to Fight Back

Copyright SANS Institute Author Retains Full Rights

 

Incident Response: How to Fight Back

A SANS Survey Written by Alissa Torres  Advisor: Jacob Williams Williams

August 2014

Sponsored by  AccessData,  Access Data, AlienVault, AlienVault, Arbor Networks, Bit9 + Carbon Black, HP and McAfee/Intel McAfee/Intel Security  ©2014 SANS™ Institute

 

Executive Summary Highly public breaches at companies such as Target, Target, Evernote and Living Social, which collectively compromised more than 200 million customer records, records, are pushing many organizations to develop in-house incident response (IR) capabilities to prevent such data breaches.

Key Results • Many IR professionals feel their organizations’ IR capabilities are ineective.

IR teams, typically operating under a formalized IR plan, are designed to

• Broad denitions of an incident  place  place a strain on IR teams. • Lack of time to review review and practice IR procedures is a primary barrier to eective IR. • Lack of formalized IR plans and dedicated sta plague most organizations.

detect, investigate and, when necessary, remediate organizational assets in the event of a critical incident. SANS conducted a survey focused on the current state of IR during May and June 2014, polling security professionals from more than 19 industries and various-sized companies and organizations. The goal was to get a clearer picture of what IR teams are up against today—the types of attacks they see and what defenses they have in place to detect and respond to these threats. In addition, the

• Organizations need to implement collection and correlation of threat intelligence.

survey measured the IR teams’ perceived perceived effectiveness and obstacles to

• Security information and event management (SIEM) tools are the focus for those working to improve their IR capabilities.

Of the 259 survey respondents, 88% work in an IR role, making this a

incident handling.

target audience for soliciting close to real-time data on the current state of IR. Respondents represented 13 different regions and countries and

work in management (28%), or as security analysts (29%), incident responders (13%) and forensic examiners (7%). This This broad representation helps shed light on both present and future IR capabilities. Some of the key findings from the report include the following: • More than one-quarter of IR professionals (26%) are dissatised dissatised with their current organization’s organization’s IR capabilities, calling them ineffective. Only 9%

categorize their processes as very effective. Notable impediments to IR include lack of time to review and practice procedures (62%) and lack of budget for tools and technologies (60%). • The denition of an incident remains broad, increasing increasing the workload for already understaed IR teams. The breadth of incident types is immense and

not limited solely to network breaches and malicious software. IR teams are often tasked with handling unauthorized accesses from external and internal sources, distributed denial of service (DDoS), insider misuse and data loss. • Ecient response to security security incidents is hindered by by lack of time to review and practice IR procedures procedures.. The most cited obstacle to effective IR processes was

lack of time to practice response procedures (62%), speaking to the need for both hands-on walk-throughs and mock exercises that test written policies and aid in standardizing triage and response in enterprise incidents.

SANS ANALYST PROGRAM

1

Incident Response: How to Fight Back

 

Executive Summary  (CONTINUED) • Lack of formal IR response plans and dened dened team structures were were identied as detriments to ecient incident handling. Lack of formal IR plans and

proceduress present obstacles to 43% of respondents. Fifty-five percent of procedure respondents identified the lack of a formal IR team as an obstacle to effective response. The The majority (61%) draw in additional assistance from their internal IT staff to address their IR surge needs. • Organizations have have not yet implemented the collection and correlation of threat intelligence. Only 31% of respondents are attempting to perform attacker

attribution as part of their analysis of incidents affecting their organizations, crippling their capability to detect the same adversary upon his or her next targeted campaign. • Automation and SIEM integration integration tools remain the focus to improve IR processes. Projected improvements improvements in IR capabilities focus on increasing analysis

and reporting capabilities through automation and expanding SIEM integration, selected by 68% of respondents. Tools Tools that increase visibility visibilit y into threats and how they apply to their environment, including scoping and remediation capabilities, are where teams are spending their budgets.  This report includes these and other findings. findings.

SANS ANALYST PROGRAM

2

Incident Response: How to Fight Back

 

About the Survey Respondents A total of 19 industries are represented in the survey. Of the 259 respondents, 15% are from the technology/IT sector and 14% are from the financial services s ervices industry. Education and health care/pharmaceuticals are each represented by at least 8% of respondents, as illustrated in Figure 1.  

What is your company’s company’s primary industry?

   s    e    c     i    v    r    e    s     T     I     /    y    g    o     l    o    n     h    c    e     T

   s    e    c     i    v    r    e    s     l    a     i    c    n    a    n     i     F

   n    o     i    t    a    c    u     d     E

    l    a    c     i    t    u    e    c    a    m    r    a     h     P     /    e    r    a    c     h    t     l    a    e     H

   t    )    s    n   y    e     i    e   r    t    a     i    t     l     i     i    m     l     i    t    n    r   m     U     /    e    v    d    y    g    o   n    r     G   a    e    t     E    n    n    e    m    e    c    r    o     f    n    e    w    a     l     (

   r    e     h    t     O

    /   e    g   s    n   n     i    t   o     l    u   p    s   s    n   e    r    o   t    c   n    s   e     i    c     d    s    i    n   c    n     i    e    r    o     F

    )     /     /   r    y    m   s   e    r    e    s   r    n     d    a     i     fi    o    n    t     i     l    t   v    g    i     i    o    o    a    p    n     i    c   r    m    s    p    t     i     l    n    e    r    n   e    o    t   u    u    c    s    n    n   n     i     (    v    t    e   c    o    m    r    e    n     d     i     S    o    e    c   s    c    c    n     i    m     I    s     l    e    n    n    e    r     T    e    e    r    v    o    o     F     G

   g    e    n    c     i    n    r    a    u    r    t    u    c    s    a     f    n    u     I    n    a     M

    l     i    a    t    e     R

   t     fi    o    r    p    n    o     N     /    s    u     i    o    g     i     l    e     R

   r    e     d     i    v    o    r    p    e    c     i    v    r    e     S     /    g    n     i    t    s    o     H     /     P     S     I

    /   s    e   e    c    i    c     i    t   v    c   r    a    r   e    p   s    t    r    w    a   o    p     L   u    p    s     l    a    g    e     L

   n    o     i    t    a    t    r    o    p    s    n    a     T    r

   e    c    a    p    s    o    r    e     A

   n    o     i    t    c    u    r    t    s    n    o     C     /    g    n     i    r    e    e    n     i    g    n     E

Figure 1. Industries Represented 

Respondents represented 13 regions and countries, with many from companies having a global presence. Most (72%) work for companies that have a presence in the United States (see Figure 2). In what countries or regions does your organization perform incident response activities?  Select all that apply.

   s    e    t    a    t     S     d    e    t     i    n     U

   e    p    o    r    u     E

   a     i    s     A

   a     d    a    n    a     C

   t    s    a     E    e     l     d     d     i     M

   a    c     i    r    e    m     A     h    t    u    o     S

    /    d    a   n     i     l    a    a    l    r    t   a    s   e     Z    u     A   w    e     N

   a    c     i    r     f     A

   r    e     h    t     O

Figure 2. Countries and Regions Represented 

SANS ANALYST PROGRAM

3

Incident Response: How to Fight Back

 

About the Survey Respondents  (CONTINUED) Most respondents (88%) are involved in their organization’s organization’s IR process. To To this point, 33% have led the remediation of incidents, 23% have assisted in detection, 20% have assisted in remediation efforts and 12% have participated par ticipated in discovery or reporting of incidents. Figure 3 illustrates the roles respondents played in the IR process. Did you play a role in any of the above incidents’ detection, analysis or remediation? If so, what was that role? Please select the most appropriate answer.

  Led remediation process   Assisted with identication of incident   Assisted in remediation   Discovered and reported   Didn’t play a role   Didn’t play a role, but observed   Other

88%

Figure 3. Participant Roles in Incident Handling

Input came from professionals of varying roles. Security analysts (29%) made up the greatest portion of participants. However, forensic examiners (7%) and incident

Percentage of respondents involved in the IR process

responders (13%) were well represented, as were supervisory roles (28%), including security manager/director/CISO/CSO manager/director/CISO/CSO or IT manager/director/CIO, manager/director/CIO, as illustrated in Figure 4. What is your primary role in the organization, regardless of whether you are considered an employee or consultant?

   t    s    y     l    a    n    a    y    t     i    r    u    c    e     S

    /    r    O    e    S    g    I    a    C     /    n    O    a    S    m     C     /    y    t    r     i    t    r    o    u   c    e    c   r    e    i     S    D

   r    e     d    n    o    p    s    e    r    t    n    e     d     i    c    n     I

    O     I     C     /    r    o    t    c    e    r     i     D     /    r    e    g    a    n    a    m     T     I

   t    s     i     l    a     i    c    e    p    s    s    c     i    s    n    e    r    o     f     l    a    t     i     i    g     D

   r    e     h    t     O

   r    o    t    a    r    t    s     i    n     i    m     d    a      m    e    t    s    y     S

   r    o    t    a    g     i    t    s    e    v    n     I

    /    r    r    o    e    i    t    c    d     ffi   u    o    A    e    c    n    a     i     l    p    m    o     C

   s    n    o     i    t    a    r    e    p    o     k    r    o    w    t    e     N

    /    t    n    a    n    i    e    i    c    g   n    a    h     k   c    s    e    e    T     d    p     l    e     H

    l    a    n    o     i    s    s    e     f    o    r    p     l    a    g    e     L

Figure 4. Organizational Roles SANS ANALYST PROGRAM

4

Incident Response: How to Fight Back

 

About the Survey Respondents  (CONTINUED) Given that all survey respondents stated they work in an IR role, this illustrates the wide range of skills required to successfully tackle an incident. Organizations should look to increase both breadth and depth in their IR teams. Representation was strong from large companies of more than 20,000 employees (24%) and smaller companies with fewer than 100 employees (17%). Figure 5 illustrates the balanced representation from varied sizes of organizations. How large is your organization’s workforce, including both employee and contractor sta?

No matter the size of the company, organizations are

  Over 20,000

 

  15,000–19,999   10,000–14,999

facing incidents

  5,000–9,999

and require IR

  2,000–4,999

capabilities.

  500–1,999   100–499   Fewer than 100

Figure 5. Organizational Size

So, no matter the size of the company (large or small), organizations are facing incidents and require IR capabilities.  Taking  T aking all of the demographic results together together,, the survey sample provides a good crosscrosssection of those working in security with an emphasis on IR at all levels.

SANS ANALYST PROGRAM

5

Incident Response: How to Fight Back

 

Incidents Happen Incidents are becoming more commonplace. Although 21% of respondents didn’t know if their organization had experienced an incident, 61% reported experiencing at least one incident involving a data breach, unauthorized access, denial of service or malware infection over the past two years. The largest percentage of respondents (48%) experienced up to 25 incidents, as illustrated in Figure 6. Over the past two years, how many critical incidents (such as those resulting in data breach, unauthorized access, denial of service) ser vice) has your organization experienced that required incident response?

   e    n    o     N

   n    w    o

%

61

    k    n    n     U

    5     2   –     1

    0     5   –     6     2

    0     0     1   –     1     5

    0     0     5   –     1     0     1

    0     0     5    r    e    v     O

Figure 6. Critical Incidents in the Past Two Years

Organizational size seems to have little effect on the prevalence of experiencing an

Percentage of respondents who experienced at least one critical incident in the past two years

incident. The same percentage of respondents from organizations with fewer than 100 employees (61%) reported at least one incident, as did the entire sample. This data continues to refute the perception that being a smaller target offers protection against information security incidents. Figure 7 provides a snapshot of such organizations’ experience with incidents. Over the past two years, how many critical incidents (such as those resulting in data breach, unauthorized access, denial of service) ser vice) has your organization experienced that required incident response?

   n    w    o    n     k    n     U

   e    n    o     N

    5     2   –     1

    0     5   –     6     2

    0     0     1   –     1     5

    0     0     5   –     1     0     1

    0     0     5    r    e    v     O

Figure 7. Critical Incidents for Companies with Fewer Than 100 Employees

SANS ANALYST PROGRAM

6

Incident Response: How to Fight Back

 

Incidents Happen  (CONTINUED) Due to widely varying definitions of the term incident , respondents reporting more than 100 security incidents (4%) may be experiencing “scope “scope creep” and use a wider definition of incident , thus increasing the different types of events that fall to IR teams to investigate. These may include additional situations such as equipment loss/theft, employee misuse and data leak.

Incident Type Although many respondents might have experienced equipment loss or other situations, it is no surprise that the most common incident type involved malware (82%), with 18% experiencing more than 20 malware infections over the 24-month duration.  The second most frequent frequent category of incident was was unauthorized access (70%). (70%). Figure 8 illustrates the type and frequency of incidents experienced by respondents.

82%

What was the nature of the incidents? If possible, please provide the frequency for each type of incident or false alarm experienced.

Percentage of respondents indicating malware is their most common incident type

   e    r    a    w     l    a     M

   s    s    e    c    c    a     d    e    z     i    r    o     h    t    u    a    n     U

 1

   s    m    r    a     l    a    e    s     l     F    a

2–5

6–10

    h    c    a    e    r     b    a    t    a     D

10–20

   t    t    n   a    e    e    t    r    s    h     i    t    s    r    e    p     d    e    c    n    a    v     d     A

    l    e    a   c     i    n    i    e   v    r     d   e    s     d    f    e    t    o

   r    e     h    t     O

   u     b     i    r    t    s     i     D

More than 20

Figure 8. Nature and Frequency of Critical Incidents

SANS ANALYST PROGRAM

7

Incident Response: How to Fight Back

 

Incidents Happen  (CONTINUED) Incidents involving false alarms (66%) plagued 15% of respondents who experienced more than 20 over the same time frame. Eliminating false positives is part of IR triage, but today’s over-tasked IR teams can hardly afford to spend valuable cycles alerting on systems that are not compromised. Possible techniques for reducing false alarms include performing scheduled tool and indicator baselining to optimize network sensor alerts and host-based indicators, as well as in-house training for team members to become more familiar with what normal  looks  looks like. As detection tools and IR staff become better attuned to the organization organization’’s unique environment, false-positive alerts will occur less frequently frequently,, optimizing detection and

 As detection tools

response time.

and IR staff become

Another technique to reduce false positives is to use event correlation capabilities with

better attuned to the

SIEM platforms to match criteria and group unique events from disparate devices and

organization’s unique environment, false positive alerts will occur less frequently,

applications as a single alert. This implementation increases the reliability of the alert and decreases the possibility of “alert fatigue,” fatigue,” which is often experienced by security analysts charged with following up on too many unsubstantiated alerts. DDoS attacks are often associated with extortionists, hacktivists or politically motivated attackers wanting to make their agenda known. k nown. The high percentage percentage of respondents

optimizing detection

(49%) who experienced this type of attack is consistent with the 2014 Verizon Verizon Data

and response time.

Breach Investigation Report, which included DoS attacks as one of its nine detailed breach patterns, making up 3% of all incidents experienced by their contributors.1 The survey respondents were not immune by any means. Of respondents, 17% saw from 2–5 incidents, and 4% experienced more than 20. IT personnel and management may believe that only very large organizations experience DDoS attacks;2 however  however,, the median size of the organizations in the survey sur vey was less than 5,000 people. These results seem to indicate that many organizations considered relatively small were also impacted by DDoS attacks. IR teams large and small should prepare for this type of attack, which is particularly easy for adversaries to carry out on a budget as small as $50. 3 

SANS ANALYST PROGRAM

1

www.verizonenterprise www.verizon enterprise.com/DBIR/2014 .com/DBIR/2014

2

http://threatpost.com/g http://threat post.com/google-project-s oogle-project-shield-to-pro hield-to-protect-sensitive-si tect-sensitive-sites-from-ddo tes-from-ddos-attacks s-attacks

3

“Figuring DDoS Attack Risks Into IT Security Budgets,” www.forbes.com/sites/c www.forbes.c om/sites/ciocentral/20 iocentral/2012/05/08/gu 12/05/08/guring-ddos-atta ring-ddos-attack-risks-in ck-risks-into-it-securityto-it-security-budgets budgets

8

Incident Response: How to Fight Back

 

Incidents Happen  (CONTINUED) Impact of Data Breach Incidents A data breach is defined as theft of sensitive data such as intellectual property or records containing an employee or customer’ customer’ss name and associated sensitive data, for example, health information or financial account information. In the 2014 Cost of Data Breach Study from Ponemon Institute, the average cost to a company suffering a data breach affecting personally identifiable information (PII) was $3.5 million, with an average cost per sensitive record of $145. 4 Organizations spend approximately 50% of the cost of being a victim of a data breach on crisis services, ser vices, including forensics forensics services, as seen in a 5 study conducted by NetDiligence in 2013.  

Additional consequences of

What was the most common data attackers stole? The two top categories, each named in 36% of responses, were employee information and individual customer information. In addition, both proprietary customer information and intellectual property loss were found in 32% of respondents’ data breaches (see Figure 9). If you experienced a data breach in the past two years, what type of data was exltrated from the t he environment? Please select all that apply.

customer data loss that are less easy to quantify involve damage to reputation, degraded public opinion of the company’ss brand and loss of company’ market share.

   e   n    e    i    y   o    o   t    a     l    p   m    m   r    o     E    f    n     i

   r    n    e   o     i    m    t    u   a    s    m    n   r    o   o    c    f     l     i    n    a   r    u   e     d     i    m    v     i    t     d   o     I    n   u    s    c

   r    n    e   o     i    m    t    o    t    a    s    m    u   r    o    c    f    y    n    r    i    a    t    e     i    r    p    o    r     P

 ,     )    y  .    e   c    t    r    d   t    e   o   e  ,    p   c    s    o    r    e    n    c    a    p   r     l    u    l    a   o   p    u    s    g    t    (    n    c     i    r    e     l    u     l    t    e    c    t    a    n     f     I    u    n    a    m

   r    e     h    t     O

   a    t    a     d     l    a    g    e     L

Figure 9. Type of Data Stolen in Breaches

Reporting breaches to regulators, customer notification requirements, card replacement fees and consumer credit monitoring subscription costs make the loss of customer data a very lengthy and expensive situation for companies. The Target Target breach in late 2013 is estimated to have cost financial institutions more than $200 million in credit card replacement fees.6 An effective IR program detects compromises earlier in the attack life cycle, lowering the cost incurred when an organization suffers a compromise, possibly even preventing a breach from succeeding succeeding..

SANS ANALYST PROGRAM

4

“The cost of a data breach in 2014: $3.5 million, Ponemon study says,” www.itworldcanada.com/article/the-cost-of-a-da www.itworldcanad a.com/article/the-cost-of-a-data-breach-inta-breach-in-2014-3-5-mi 2014-3-5-million-ponemon-s llion-ponemon-study-says/9 tudy-says/93140 3140

5

“Cyber Liability & Data Breach Insurance Claims,” www.netdiligence www.netdiligence.com/les/C .com/les/CyberClaimsStu yberClaimsStudy-2013.pdf  dy-2013.pdf 

6

“Cost of Replacing Credit Cards After Target Breach Estimated at $200 Million,”  http://on.wsj.com/1jOmuzQ

9

Incident Response: How to Fight Back

 

Incidents Happen  (CONTINUED) Incident Handling Although 59% of respondents have a dedicated IR team, many respondents (27%) make use of third-party IR service providers to augment or handle incidents on an asneeded basis. In addition, 23% use an IT management provider to aid in IR. Based on the aggregate number of responses, some organizations with internal teams outsource particular incident types to third-party services and handle others on their own, as illustrated in Figure 10.

 

What resources does your organization utilize in responding to incidents?  Select all that apply.

  Surge team drawn from our internal sta    Dedicated internal team focused on IR, reporting and remediation   Third-party IR services we call as needed   Third-party IT management provider   Other

Figure 10. Types of IR Resources Utilized by Organizations

According Accor ding to respondents, investigations that involved company-owned laptops, smartphones, tablets and other company-owned mobile devices were the most common (62%) incident type handled internally. In contrast, the more frequently outsourced incident types involve business applications in the cloud (18%) such as SAP,, email or web applications, such as Dropbox, followed closely by in-the-cloud SAP marketplaces using shared applications (17%). Internal IR teams are likely to have the skills to handle incidents involving only commodity assets, such as laptops and mobile devices. However, However, few IR professionals have the skills to investigate an incident involving SAP or AS/400 (both very common in business today). Incidents involving these assets usually require the help of an outside specialist. Additionally, there is a natural gap between the availability of tools to investigate commodity assets and such specialized technologies, furthering the need to augment internal staff with outside experts.

SANS ANALYST PROGRAM

10

Incident Response: How to Fight Back

 

Incidents Happen  (CONTINUED) Incident Response Eectivenes Eectivenesss  The survey data shows that organizations organizations are experiencing a wide wide range of incident types with varying var ying degrees of frequency, and they are using a variety of resources. But how effective are their efforts? Only 9% of respondents were happy with their IR capabilities, including their outsourced processes. Almost 26% thought their capabilities and processes to be ineffective, as illustrated in Figure 11.

The rate of increasing complexity in

 

How eective do you feel your incident response capabilities capabiliti es and processes are (including your outsourcing arrangement, if applicable)?

today’s malware and attacker techniques is not slowing, and

  Very eective

if an organization’s

  Eective   Somewhat eective

IR capabilities are

  Not eective

behind the curve

  Unknown

now, that trend is likely to continue. Figure 11. Effectiveness of IR Capabilities and Processes

So, although 42% of respondents feel they are adequately prepared to handle incidents, the remaining 58% need to improve their capabilities. As the race between sophisticated attackers and watchful defenders ensues, the percentage of IR professionals who feel their capabilities are in need of improvement is not likely to change. The rate of increasing complexity in today’s malware and attacker techniques is not slowing, and if an organization’s IR capabilities are behind b ehind the curve now, that trend is likely l ikely to continue.

SANS ANALYST PROGRAM

11

Incident Response: How to Fight Back

 

Incident Response Takeaways  The best way to break down down the survey results is to focus focus on the six steps of IR and how respondents felt their current structure and capabilities provided successful completion of each step. Six Steps of Incident Response 1. Preparation 2. Identication and scoping 3. Containment 4. Eradication 5. Recovery 6. Lessons learned

Importance of Prepara Preparation tion A huge part of the preparation stage of an organization organization’’s IR capabilities is defining roles and responsibilities, creating buy-in and garnering support from upper management and data-owning business units. Without moving through a collaborative process of creating a formal IR plan and procedures procedures,, as 43% of respondents have not yet done, those working in the IR role are often left to figure out procedures and sidestep political landmines during times of crisis. But the Ponemon Institute found in its 2014 Cost of the Data Breach report that organizations that suffered a data breach and maintained an IR plan lowered the cost per sensitive record lost by up to $12.77.7  A secondary benefit b enefit to formalizing an organization organization’’s IR plans through collaborative efforts prevents barriers to communication that occur when IR goals are not fully aligned with service level agreements (SLAs) and business continuity. Respondents noted that silos existing between IR and other business units (36%) and HR/legal impediments to investigation/monitoring (14%) act as obstacles, further confirming the detriments to a investigation/monitoring lack of formalized process for working IR investigations (see Figure 12). What do you believe are the key impediments to eective IR at your organization? Lack of time to review/practice procedures Lack of budget for tools and technology Lack of a formal IR team or IR service Little visibility into system/endpoint configurations/vulnerabilities Lack of IR plans and procedures Difficulties correlating events happening on different systems Silos between IR and other groups Difficulty in finding and removing sophisticated attacks Accessing records involved with sychronization sychronizatio n tools Difficulties finding tools to investigate new technologies Legal/HR impediments Lack of trusted service providers available Jurisdictional issues with cloud services Other jurisdictional issues Other

Figure 12. Impediments to Effective IR 7

SANS ANALYST PROGRAM

“The cost of a data breach in 2014: $3.5 million, Ponemon study says,” www.itworldcanada.com/article/the-cost-of-a-da www.itworldcanad a.com/article/the-cost-of-a-data-breach-inta-breach-in-2014-3-5-mi 2014-3-5-million-ponemon-s llion-ponemon-study-says/9 tudy-says/93140 3140

12

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) Another key part of the preparation phase is IR team staffing. The majority of respondents (55%) cited the lack of a formal IR team with dedicated members as an obstacle to effective IR. Many organizations lack the necessary funding to staff a fully dedicated team whose sole focus is on detecting and responding to an incident. In some environments, the role may fall to a sole individual, who is assisted by “surge “surge staff” during the investigation of a serious incident. Obvious pitfalls to this team structure include a lower likelihood of recognizing a serious incident due to a lack of analysis resources and adding untrained workers pressed into service at times of high criticality and high visibility, such as after a breach becomes publicly known. Not only do

%

55

inexperienced staff not have proper triage and investigative skills, but they also require a great deal of oversight and guidance, taking the lead IR staffer away from managing the work and acting as a liaison to upper management and other business units.  There is no ideal team structure structure that will work for every every organization because complexity complexity

Percentage of respondents citing lack of a formal IR team with dedicated members as an obstacle to eective IR

of network infrastructures and number of endpoints varies widely. Yet, Yet, for effective response management to exist, someone must be held accountable for its oversight, care and feeding. Without explicitly assigned accountability, implementing an effective IR process and procedures procedures can be pushed aside as an ancillary duty. A third aspect of IR capability preparation includes proactively deploying security tools tailored for IR on the endpoints prior to a breach. A majority (52%) of respondents cited lack of visibility into system/endpoint vulnerabilities as an obstacle to efficient IR.  This highlights a common problem: problem: Many organizations organizations put security tools in place as a reaction to a breach instead of in preparation for one. Such tools allow for real-time and continuous monitoring of company endpoints, and if done in the preparation phase—prior to an incident—endpoint sensors can provide a full audit trail to aid in understanding an attack and properly scoping the environment with real-time and historic data.

SANS ANALYST PROGRAM

13

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) Methods of Detection After preparing for the inevitable endpoint compromise, detection of a compromise is the next most important step. In fact, none of the other steps in the process can occur without detection. But given the workload of the average security analyst, automation is an important component of detection. SANS asked survey participants which techniques they use to detect suspected compromises and whether these techniques are automated. Figure 13 illustrates their responses. How does your organization identify impacted impac ted systems, and how automated are these processes of identication?

Given the workload of the average security analyst,

  Manual   Automated

automation is an important

  Both

component of

  N/A

detection.

   s    t    n    e    g    a    g    n     i    n    n    a    c    s     d    e    s    a     b       k    r    o    w    t    e     N

   s     l    o    o    t    r    e     ff     i    n     S     /    e    r    u    t    p    a    c    t    e     k    c    a    p     k    r    o    w    t    e     N

   y    r    a     d    n    u    o     b     k    r    o    w    t    e    n    e     h    t    t    a    n    o     i    t    p    y    r    c    e     d     L     S     S

   s     i    s    y     l    a    n    a    g    o     l     l    a    u    n    a     M

   s    t    r    e     l    a    t    n    e    g    a     S     D     I     H

   s    t    r    e     l    a       M     T     U     /     l     l    a    w    e    r     i     F     /     S     D     I     /     S     P     I

   s     l    o    o    t    n    o     i    t    c    e    t    e     d      y     l    a    m    o    n    a     /    w    o     fl     k    r    o    w    t    e     N

   s     l    o    r    t    n    o    c    t    n     i    o    p     d    n     E

   s    n    o     i    t    a    c     fi     i    t    o    n    y    t    r    a    p       d    r     i     h     T

   s    t    n     i    a     l    p    m    o     C     /    n    o     i    t    a    c     fi     i    t    o    n    r    e    s     U

   s     i    s    y     l    a    n    a     d    n    a    n    o     i    t    a     l    e    r    r    o    c       M     E     I     S

   s    e    c     i    v    r    r    e     S     /    s     l    o    o    t    s    c     i    t    y     l    a    n    a     d    n    a    e    c    n    e    g     i     l     l    e    t    n     I

   s     l    o    o    t    e    r    u    t    p    a    c      n    e    e    r    c    s     d    n    a    r    e    s    w    o    r     B

   s     l    o    o    t     d    e    p    o     l    e    v    e     d    y     l     l    a    n    r    e    t    n     I

   s     l    o    o    t    s    c     i    s    n    e    r    o     f     l    a    t     i    g     i     d    y    t    r    a    p       d    r     i     h     T

   r    e     h    t     O

Figure 13. Detection Methods

SANS ANALYST PROGRAM

14

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED)  The three most popular techniques techniques (each used by more than 90% of the participants) are scanning for indicators with agents (96%), analyzing network capture (93%) and responding to firewall, IPS/IDS or UTM alerts (91%). Participants reported high levels of automation for agent-based scanning and firewall/ IPS/IDS/UTM alerts, but the second highest level of automation reported was detection using host-based intrusion detection (HIDS) agents. Participants also reported high levels of automation with HIDS agents (46%, second highest in the survey overall), but a full 16% do not use HIDS at all. This lowers HIDS popularity for detection to sixth overall.  The top 5 are listed in Table 1. Table 1. Most Popular Detection Tools Technology

Percent Using

Network-based scanning for indicators with agents

96%

Analyzing network capture

93%

Responding to firewall, IPS/IDS or UTM alerts

91%

User notification or complaints

85%

Manual log analysis

85%

Perhaps just as interesting is what participants are not  using  using for detection. The three least used technologies in the survey are SSL decryption at the network boundary (39% do not use), endpoint controls such as network access control (NAC) or mobile device management (MDM) (33% do not use) and homegrown tools tailored to the environment (31% do not use).  The low adoption of NAC, MDM and and SSL decryption may indicate indicate that tool maturity maturity (or perceived maturity) and the ease in which these functions can be implement implemented ed as detection mechanisms have a ways to go. Though not currently used by a good portion of respondents, the usefulness of these technologies as preventive controls is undeniable undeniable.. For example, as endpoint devices travel between home and various worksites, connecting to public hotspots and unprotected home networks and increasing the chances of malware infection, implementations implementations such as NAC ensure a device is scanned and deemed healthy prior to allowing it access to internal network resources.

 The fact that commercially commercially available tools are meeting participants’ participants’ needs may explain the limited use of homegrown tools in place of SIEMs. Alternatively, participants may lack the expertise in-house to design, build and maintain such tools.

SANS ANALYST PROGRAM

15

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) One additional finding worthy of mention is that 18% of participants do not use a SIEM at all, while 85% still perform some type of manual log analysis for the identification of incidents. It is unclear whether this is due to lack of training, system availability or some other factor. SIEM providers should perform further fur ther research to determine the reasons why manual log analysis has a higher overall adoption rate than the use of a SIEM and why some percentage of SIEM users still rely on manual log analysis for the identification of incidents.  Teams  T eams without the the ability to classify and and qualify alerts—functions alerts—functions a SIEM typically provides—may provides—m ay be unable to properly prioritize and may perceive every alert as critical, quickly overwhelming a small team’s resources. For respondents who implement a SIEM and are still conducting manual log review review,, factors such as a SIEM’s limited visibility into certain areas of an organization’s network or decreased granularity due to high-level filtering of data aggregates may be likely reasons for this continued analysis requirement.

Containment One measure of IR team maturity is how rapidly the team can move an incident from initial detection to containment , which means isolating affected systems to stop additional infections and prevent additional data theft. One of the most important IR goals is to keep loss and the impact to the organization down to acceptable levels. levels. It is this time frame that is critical in many instances in mitigating the severity of loss. The most common time frame from discovery to containment and implementing virtual or physical isolation of affected systems, chosen by 19% of respondents, was 4–8 hours.  The second largest largest group of respondents respondents (16%) called out the 1–4 hour time frame. Only slightly fewer (14%), however, required required 2–7 days for containment. Obviously, the smaller the window of time the better (see Figure 14). From the time the incident was discovered, how much time elapsed until containment was accomplished?

   n    w    o    n     k    n     U

    d    e    v    e     i     h    c    a    t    o     N

   r    u    o     h     1    n    a     h    t    s    s    e     L

   s    r    u    o     h     4   –     1

   s    r    u    o     h     8   –     4

   s    r    u    o     h     4     2   –     9

   s    y    a     d     2   –     1

   s    y    a     d     7   –     2

   s     k    e    e    w     2   –     1

   s     k    e    e    w     4   –     2

   s     h    t    n    o    m     3   –     1

   s     h    t    n    o    m     6   –     3

   s     h    t    n    o    m     2     1   –     6

   n   s    a    h    t     h    t   n    o    e    r   m    o     2     M     1

Figure 14. Elapsed Time from Discovery D iscovery to Containment 

SANS ANALYST PROGRAM

16

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) What obstacles are impeding a team’s ability to contain the system immediately? After receiving an alert based on network- or host-based indicators, an IR team must perform triage on the system(s) to properly confirm a security incident. In most sprawling global enterprises today, responders responders make remote connections in order to ascertain the system state of the alerted system. Remote forensics/IR tools effectively decrease triage data collection time, allowing teams to speed system containment by valuable minutes or even hours. If an IR team does not have remote forensic/IR agents on the endpoint systems, other system survey scripts might be run remotely or an IT or security technician on site might be tasked with performing the triage locally. More recently, some enterprise IR tools have added

Remote forensics/ 

features that can automate alert confirmation, isolation, analysis and incident resolution

IR tools effectively

to achieve rapid-response capabilities, thereby freeing up valuable security analyst

decrease triage data collection time,

and IR human resources. These alternatives aid in reducing the time from detection to containment. In many network intrusion cases involving sophisticated sophisticated attackers, initial system triage

allowing teams to speed system

of potentially compromised systems sets off a race between the investigating investigating team and

containment by

normal activity, the chance of tipping off an attacker that detection has occurred is of

valuable minutes or even hours.

the attacker. Because responders run collection/triage tools on systems that deviate from particular consequence. Expected attacker actions, once they suspect detection, include minimizing their footprint on the network by wiping malicious files and toolsets from compromised systems systems or changing their behaviors to avoid further detection. Clearly, the less time an IR team gives the attacker to react after detection, in most cases, the better.

A large percentage of respondents had longer time frames in moving to containment—15% containment—15 % reported periods of longer than 7 days, and 11% reported taking tak ing a month or longer. Some of these organizations may have elected not to immediately contain affected systems but, instead, monitor attacker activity in order to gather threat intelligence and aid in attacker attribution. By completing attribution of an attacker, the IR team is better able to understand the threat and gains valuable indicators of compromise (IOCs) that they can use to detect future attacks that would otherwise have flown under the radar.

SANS ANALYST PROGRAM

17

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) Remediation and Recovery Successful remediation involves involves eradicating the malicious actor from the network and returning to business as usual: getting systems back online and restoring availability of affected services to internal and external customers. In many critical incidents, there are potential financial implications for every minute an organization’s network or system services ser vices are degraded, whether the system is a web server that had to be taken offline or an employee’s employee’s workstation that required a complete rebuild. Based on this, an important IR performance metric is the time it takes an organization to move from detection of a critical incident to full remediation. The most common survey response (22%) is a 2–7 day window from detection to remediation, as shown in in Figure 15.

54% Percentage of respondents identifying improved remediation processes as an area for improvement

From the time the incident was discovered, how much time elapsed until remediation was achieved?

   n    w    o    n     k    n     U

    d    e    v    e     i     h    c    a    t    o     N

   r    u    o     h     1    n    a     h    t    s    s    e     L

   s    r    u    o     h     4   –     1

   s    r    u    o     h     8   –     4

   s    r    u    o     h     4     2   –     9

   s    y    a     d     2   –     1

   s    y    a     d     7   –     2

   s     k    e    e    w     2   –     1

   s     k    e    e    w     4   –     2

   s     h    t    n    o    m     3   –     1

   s     h    t    n    o    m     6   –     3

   s     h    t    n    o    m     2     1   –     6

   n   s    a    h    t     h    t   n    o    e    r   m    o     2     M     1

Figure 15. Time from Discovery to Remediation

Additionally, 29% of respondents reported taking over a week to remediate the incident, and 4% took longer than 12 months or never remediated the issue. What hurdles are slowing these organizations’ IR processes, processes, requiring them to experience notable delays? And are these time frames acceptable? As later survey questions reveal, 54% of respondents named improved remediation processes as an identified area of improvement over the next two years, supporting the idea that current time frames from detection to remediation are unacceptable.

SANS ANALYST PROGRAM

18

Incident Response: How to Fight Back

 

Incident Response Takeaways  (CONTINUED) Part of IR preparation is working with upper-level management to define an acceptable interruption window (AIW), the time an incident can continue before the interruption the

incident causes starts to become unacceptably adverse in terms of its consequences. With 15% of respondents citing a detection to remediation period of one month or more, an excellent follow-up question might be to determine whether these organizations have calculated an AIW and whether the impact of these critical incidents fell within their acceptable limits. Regardless, organizations of all sizes should s hould look to establish an AIW based on their business models. Impediments to remediation include lack of well-developed IR processes, shortage of inhouse or readily available forensics/IR investigators and limited access to threat-specific remediation advice. Organizations without these resources have difficulty determining proper scoping for an intrusion and typically are unable to do the following: • Analyze their initial system to identify signature signature malware and attacker behaviors

and generate indicators of compromise • Properly scan and identify other compromised compromised endpoints on the network involved involved

in the intrusion • Eectively broaden broaden the scope to include endpoints without active malware based

on trace system artifacts and use of previously compromised accounts • Reduce the potential damage by disabling specic specic applications or services that are

the means for compromise and/or data exfiltration

SANS ANALYST PROGRAM

19

Incident Response: How to Fight Back

 

Lessons Learned Perhaps one of the lessons survey participants learned through their experiences is the need for more automation and integration with SIEM technology. When asked about the areas of their organizations’ IR IR process they planned to improve upon over the next 24 months, a full 68% of participants indicated they plan more integration with the SIEM. Improved visibility into threats and vulnerabilities was the second most frequent improvement, cited by 59% of respondents (see Figure 16). What improvements is your organization planning for incident response programs over the next 24 months? Select all that apply.

    t     )     i     s     n     M    s     e     E    y     v     I     l     e     S    a      (     n     y     t     t     a      i     r     n      d     u    e    n     c     m     e    e    a     s      /     g    g     n     n    a     i     o    n    t     r      i     t     a    o     a    m     p     e     m     n    r     o     o     t     i     r     o     u    t      f     a    a    n     e     m     o     r     r     i     o     f     o    t     a      M     n    r      i     g     e     t     n      i

     d    y    t     n    e    n     e     a     h     t     s     t     s     m     a    a    n     o     e     r     r     s     e     i      i      h     t     v     t     i      l     n     e      i     o     t     b    e     n    a     h      i     r     t     y     t     e     n    o      i     t      l     l      i     u     l     y      b     v      i     s     d    p      i     p     v    e     t     a      d     i     e    a     c     v    o     o     r     s     p    s     a     m      I

    n    s     o    e     s      i     t     s     a    e      i      d    c     o     e    r     p     m     e     r     p     u      d       e    w     v     l     o     o     r     l     o     p     f     m      d      I     n     a

     d    e     c     e     t     r     c     u     a    o     p    s     t     m     n      i      i     e    o     p    p     n     o     i     c     p     s      d     o     t     n     a     y     t      i      l     s      i      b    m     a    e     t      d    s     e    y     v    s     o     r     p     m      I

    e     m      i     t     e     s     n     o     p     s     e     r     r     e     t     t     e      B

    r     e      h     t      O

Figure 16. Planned Improvements

Both improved integration of the SIEM and improved visibility focus on faster and more efficient detection of anomalous behaviors. The 2014 Verizon Verizon Data Breach Investigations Report (DBIR),8 supports these self-identified weaknesses in security teams today. During 2013, just under 20% of all breaches experienced by DBIR participants were detected internally, with the remainder identified by third-party notification. Likewise, our respondents are focused on improving detection first, decreasing the number of days an attacker spends in an environment undetected. undetected. Improving response time is a goal for 42% of respondents over the next two years.  Typically,, as IR teams mature and detection  Typically detection improves, focus focus tends to shift to increasing increasing the efficiency of the IR process, including data collection and correlation. Process refinement is likely a goal for more mature teams, though the integration that most respondents have planned with the SIEM will most likely have a positive effect on response time as well as detection. 8

SANS ANALYST PROGRAM

www.verizonenterprise www.verizon enterprise.com/DBIR/2014 .com/DBIR/2014

20

Incident Response: How to Fight Back

 

Recommendations Armed with these survey results, it is clear that most organizations can achieve more efficient processes by implementing the following recommendations. recommendations.

Better Dene the Term Incident  In the National Institute of Standards and Technology Technology publication NIST SP 800-61,9 

 Armed with an

the formal definition of an incident  is  is “a violation or threat of violation of computer security policies, acceptable use policies, or standard security practices.” Yet, in practice,

agreed-upon

organizations have different interpretations interpretations of what types of events this definition

definition, it is

should include. With an overly broad definition of what falls into the category of incident ,

much easier to add trackable metrics or key performance indicators (KPIs) for detection and

an IR team can quickly become overwhelmed with the triage, investigation and event handling that should not directly involve them. Moreover Moreover,, armed with an agreed-upon definition, it is much easier to add trackable metrics or key performance indicators (KPIs) for detection and remediation—something more likely to secure additional budget. A well-written IR policy, crafted in the preparation step of the six-step IR process, should include a formal definition of what incident types the IR team will be responsible for.

remediation—

Valuable resources resources can be tied up if the IR team is the victim of “scope creep” creep” and tasked

something more

with investigating every employee acceptable use policy violation or tracking down lost

likely to secure additional budget.

or stolen equipment. Prior to the charter of the IR team and development of its mission, all stakeholders must agree upon the definition of incident . Only with such agreement can staff accurately define the roles and responsibilities of the IR team. Those writing the policies and proceduress should provide other details, such as conditions under which a member of procedure the IR team can remove a system from the network or shut a system down. To To be sure all parties are on the same page, be sure C-level executives sign off on the policy before it is implemented.

9

SANS ANALYST PROGRAM

“Computer Security Incident Handling Guide,” http://csrc.nist.gov/publications/nistpubs/800-61rev2/SP800-61rev2.pdf 

21

Incident Response: How to Fight Back

 

Recommendations  (CONTINUED) Build Security into Other Business Unit’s Processes Part of reducing an IR team’s workload depends on other business units taking tak ing an active role in problem ownership. All data owners or people who manage/maintain an organization’’s information technology assets should receive training on implementing organization security best practices. Such training will ensure visibility of security efforts and buy-in from various units when a serious breach does occur. By ensuring software developers include security considerations in their development cycle, the IR team will have fewer problems with vulnerable in-house applications and, subsequently, fewer incidents requiring response. Those desktop support technicians tasked with interfacing with an organization organization’’s user population must have

 All data owners or people who manage/maintain an organization’s

a firm understanding of system triage and receive training so that they may properly differentiate differentiat e between a user issue and a malware infection. Finally, Finally, data owners must understand the security gains associated with best practices such as least privilege required access and system and application event auditing. If security is “baked in” to daily business practices, the IR team will experience fewer critical incidents.

information technology assets should receive training

Track Incident Response Costs to Justify IR Tools and Larger Team  The survey asked participants whether they measure the costs costs associated with handling an incident, and only 14% affirmed that they do. Another 63% of respondents do not measure the cost, and 23% don’t know (see Figure 17).

on implementing security best

Do you measure the associated costs of handling incident response?

 practices.

  Yes   No   Unknown

Figure 17. Measurement of IR Costs

SANS ANALYST PROGRAM

22

Incident Response: How to Fight Back

 

Recommendations  (CONTINUED) Why is this a concern? Without accurate measurement measurement of the th e costs involved in handling an incident, the budget for IR activities is almost certain to suffer. With With a quarter of those who responded in managerial roles, the low visibility v isibility into cost information is indeed surprising.

One recommended technique for justifying additional resources such as staff, hardware and software is to track the costs of current inefficient processes and procedures. Generating metrics that support the need for additional budget allocation to fund staffing and enterprise IR tools will provide information to help upper management better understand future budgets requests. Putting a monetary value on the following metrics would be useful in justifying more resources: resources: direct costs of engaging third-party forensic/IR services and travel costs for a responder to get to compromised systems when remote tools would have worked, indirect costs of decreased productivity of sourcing the department with surge staff during an incident, indirect costs of training surge staff and indirect costs of manually processing data/logs. By tracking the financial

Direct costs of engaging third-

penalties to organizations that do not have adequate resources, resources, security managers can

party forensics/IR services and

make a persuasive argument to properly staff and equip their in-house IR capability.

travel for a remote responder, responder,

Enterprise IR tool rollout and maintenance fees can be a considerable line item in a

as well as indirect costs of

security team’s team’s annual budget. Yet, Yet, if evaluated properly p roperly,, these tools can simplify the

decreased productivity of

tedious and time-consuming data acquisition process to enable smaller teams to

sourcing IR surge sta during

respond more efficiently and thoroughly. The right IR tool can allow a team to do more

an incident, training surge

with less and shave time off all stages of IR.

sta, and manually processing

 The survey also uncovered uncovered that 30% of respondents respondents don’t have have any of their security

data and logs are metrics

budgets allocated for IR. Another 39% of respondents don’t know whether they have any

that are useful in justifying

budget for IR (or how much it is). Figure 18 provides a look at the status of IR budgets.

additional resources. What percentage of your security budget is assigned to incident response?

  Unknown   None   1–2%   2–3%   4–5%   5–10%   Greater than 10%

Figure 18. Percent Percent of Security Budget Dedicated to IR SANS ANALYST PROGRAM

23

Incident Response: How to Fight Back

 

Recommendations  (CONTINUED)  The consequences consequences of not having a budget for IR or not having visibility into what that budget covers include the potential to lose current licenses or be unable to obtain

The demand for organizations

licenses for essential software, including network- and host-based monitoring tools,

to have a continuous

forensics tool suites and data collection and parsing tools. Likewise, a lack of budget

monitoring and response

or an inability to secure appropriate funding for the constantly growing storage

capability makes dedicated IR

media needs of an IR team can result in a lack of historical data that may be needed to investigate a past vector of initial infection. Organizations must acknowledge the

teams imperative.

growing importance of this type of data as well as trained professionals who can interpret the data to retell the story of what happened.

Track Incident Response Metrics to Justify IR Tools and Increased Size Most mature IR teams are achieving greater success in detection and containment by making use of  proactive continuous monitoring and response rather than

Despite the current security climate, 14% of respondents work in organizations with no dedicated IR teams. This lack of a formal team was cited as a key obstacle in efficient incident handling. Many security managers find it difficult to justify staffing full-time dedicated IR professionals, because the frequency or volume of an a n organization’s incidents tend to be cyclical. It is this intermittent nature of feast or famine that makes it hard for IR managers to justify permanent staff. Yet, most mature IR teams are achieving greater success in detection and containment by making use of proactive continuous monitoring and response rather than reactive intermittent response processes. The current recommendation recommendation is to view response as not occasional but continuous— continuous—with with team members hunting for signs of

reactive intermittent

intrusion or anomalies when they are not working on identified events. events. Performance

response processes.

metrics that may aid in the justification of additional team members or IR tools include tracking three time frames: the time from initial infection to detection, from detection to containment,, and from detection to remediati containment remediation. on.

SANS ANALYST PROGRAM

24

Incident Response: How to Fight Back

 

About the Author Alissa Torres is a certified SANS instructor specializing in advanced computer forensics and incident

response. Her industry experience includes serving in the trenches as part of the Mandiant Computer Incident Response Team Team (MCIRT) as an incident handler and working on an internal security team as a digital forensic investigator. investigator. She has extensive experience in information security, spanning government, academic and corporate environments, and holds a bachelor’s degree from University of Virginia and a master’s from University of Maryland in information technology. technology. Alissa has served as an instructor at the Defense Cyber Investigations Training Training Academy (DCITA), delivering incident response and network basics to security professionals entering the forensics community. community. In addition to being a GIAC Certified Forensic Analyst (GCFA), (GCFA), she holds the GCFE, GPEN, CISSP CISSP,, EnCE, CFCE, MCT and CTT+ certifications.

Sponsors SANS would like to thank this survey’s sponsors:

SANS ANALYST PROGRAM

25

Incident Response: How to Fight Back

 

Last Updated: October 27th, 2014

Upcoming SANS Training Click Here for a full list of all Upcoming SANS Events by Location SANS Cyber Defense San Diego 2014

San Diego, CAUS

Nov 03, 2014 - Nov 08, 2014

Live Event

SANS DFIRCON East 2014

Fort Fort L Lau aude derd rdal ale, e, F FLU LUS S

Nov Nov 03 03,, 2014 2014 - Nov Nov 08, 08, 2014 2014

Live Event

SANS Sydney 2014

Sydney, AU

Nov 10, 2014 - Nov 22, 2014

Live Event

SANS Korea 2014

Seoul, KR

Nov 10, 2014 - Nov 15, 2014

Live Event

SANS Tokyo Autumn 2014

Tokyo, JP

Nov 10, 2014 - Nov 15, 2014

Live Event

Pen Test Hackfest

Washington ton, DCUS

Nov 13, 201 014 4 - Nov 20, 20 201 14

Live Event

SANS London 2014

London, GB

Nov 15, 2014 - Nov 24, 2014

Live Event

SANS Hyderabad 2014

Hyderabad, IN

Nov 24, 2014 - Nov 29, 2014

Live Event

Healthcare Cyber Security Summit

San San Fr Franci ancisc sco, o, CA CAU US

Dec Dec 0 03, 3, 2014 2014 - D Deec 1 10, 0, 2014 2014

Live Event

SANS Cyber Defense Initiative 2014

Washington, DC DCUS

Dec 10 10, 20 2014 - Dec 19 19, 20 2014

Live Event

SANS Oman 2015

Muscat, OM

Jan 03, 2015 - Jan 08, 2015

Live Event

SANS Security East 2015

New Orleans, LAUS

Jan 16, 201 015 5 - Jan 21, 20 201 15

Live Event

SANS Brussels 2015

Brussels, BE

Jan 26, 2015 - Jan 31, 2015

Live Event

SANS Gulf Region 2014

OnlineAE

Nov 01, 2014 - Nov 13, 2014

Live Event

SANS OnDemand

Books & MP3s OnlyUS

Anytime

Self Paced

Sponsor Documents

Or use your account on DocShare.tips

Hide

Forgot your password?

Or register your new account on DocShare.tips

Hide

Lost your password? Please enter your email address. You will receive a link to create a new password.

Back to log-in

Close