Incident Response for Telstra Outages and Security Breaches Assessment Answer

Introduction

Several outages of unplanned Telstra exchanges may occur every second counts when a security breach occurs. The damage caused by malware infections and ransomware is often enormous, as well as compromised credentials can be utilized for privilege escalation, allowing attackers to gain access to even more valuable resources.

The term "incident response" (IR) refers to a set of procedures for dealing with security incidents like hacks and breaches (Woods and Bohme, 2021). Effectively identifying, mitigating, and reducing the cost of the cyberattack and determining and fixing the cause to prevent future attacks require an established incident response strategy (IRP). As the IT administrator, the security of the wireless broadband router becomes a priority for the company's security. Security teams must immediately prioritize the most important tasks during an attack on cybersecurity despite the many unknowns they face. When a security incident occurs, having a plan in place for how to respond to it ahead of time can mitigate a lot of the negative effects on the business and its reputation.

Security analysts should immediately notify the appropriate parties upon confirmation of a cybersecurity incident. Common compliance standards have certain stipulations:

• Notifying the public, as well as in some cases directly notifying data subjects, of the data breach is required by privacy laws like the General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA).
• A plan for responding to incidents must follow certain procedures in order to be PCI DSS compliant. In particular, the need of 12 states that user plans must have designated employees available around the clock, provide adequate training for incident response staff, also set up notification mechanisms.

Involvement from legal, the media, and executive management may be warranted, depending on the nature of the breach. Many situations call for swift action from areas like customer service, finance, as well as IT, who needs to be informed in the event of a breach, and how, should be specified in the user incident response plan. In order to save precious seconds in the aftermath of the attack, the plan should include complete contact details and the means of communicating with each relevant party.

All of these are important for breaching the data, even more than a 1300 customer communication is being occurred or the staff is working on the related data for customer relationship management. There might be the possibility of breaching the CISCO firewall or Telstra Router at some point as many connections occur between those areas (Kaiser et al., 2022). This company seeks network security for managing their breaching which may lead to the drastic loss. Creating a solid IR plan ahead of time should be the top priority while implementing incident response cybersecurity (Tang et al., 2020). Before a major attack or data breach occurs, the company should have tested the incident response methodology. The following steps should be taken in response to a critical security event, building into the NIST incident response phases:

Figure 1: Recommended phases for wireless networking and cybersecurity incidents

Step 1: Assembling the team

Having the right individuals who have the right skills and the requisite tribal knowledge is crucial. Find someone to take charge of the response team and make sure they know what they're doing. This person needs to be able to quickly reach upper management and get approval for drastic measures like shutting down critical systems.

The SOC team and managed security consultants might be all needed to deal with an incident in a smaller company or one facing a less severe threat. However, when dealing with major incidents, the company should involve other departments like HR and Corporate Communications. If a Security Incident Response Team (i.e. CSIRT) has been established, all of its members, both technical and non-technical, should now be called into action (Garces et al., 2019). The company should inform the legal department immediately if a breach can lead to litigation or if public notification and correction are necessary.

Step 2: Detecting & Ascertaining each source

Such an incident response team's top priority should be determining what caused the breach and then stopping its spread. Many different types of indicators can alert security teams to the presence or existence of an incident, such as:

• Security information and event management systems (SIEMs) along with additional security solutions generate alerts according to the analysis of log data in response to reports of suspicious activity from users, administrators of systems, network administrators, security personnel, and others within the organization
• Using hashing algorithms, file authenticity checking software can tell if critical files have been tampered with and alert the user.
• Malware prevention software

Records (including audit-related information) that should be routinely analyzed for irregular or suspicious behaviour using:

• Users
• Distant archiving
• Temporal recall
• Hardware in a network
• Methods of Operation
• Hosted solutions
• Applications

Step 3: Containing and recovering

A security breach is like a wildfire in the forest. After an incident has been identified along with its origin, it must be contained. Disabling network access for infected computers and applying security patches to fix malware issues and network vulnerabilities are two examples of what this entails. Users whose accounts were compromised may require new passwords, and any insiders who may have been responsible for the incident may need to have their accounts disabled (Whitman and Mattord, 2021). All compromised systems should be backed up by the team to ensure they can be restored to their original state for forensic analysis. Restoring the service, if necessary, entails two main procedures:

• Validate and test the network and systems to ensure they are fully functional.
• Recertify as safe and functional any compromised part.
• Long-term containment requires closing down or removing user accounts as well as backdoors that allowed the intrusion, as well as restoring all systems to manufacturing for normal business operation.

Step 4: Assessing the damage, also severity

It can be hard to assess the full scope of damage caused by an incident until the dust settles. Have servers, which host essential business functions like online stores and hotel booking systems, come under attack from the outside. Also, for instance, an application layer intrusion executes malicious SQL queries on the web application's database via a SQL Injection attack or uses a web server as a backdoor to access sensitive data or take over the system. When a critical system is compromised, the incident must be escalated and a response team must be activated immediately. In most cases, the user should try to figure out what went wrong. If an outsider or an insider was successful in causing damage, the company should treat the situation as direr. At the appropriate time, weigh the benefits and drawbacks of conducting a full-scale cyber attribution investigation.

Step 5: Beginning the process of notification

A data breach occurs when sensitive information is inappropriately accessed, copied, transmitted, viewed, stolen, or used. Public notification of such an incident is required by privacy laws like the General Data Protection Regulation and the California Consumer Privacy Act. Notify those whose private information or financial records were compromised so they can take preventative measures against harm.

Step 6: Take several actions for preventing such incidents in future

When the dust settles after a security breach, it's time to look at what was learned so that it doesn't happen again. Some examples of such measures are installing software updates on servers, providing education on recognising and avoiding phishing attacks, and increasing the effectiveness of internal threat monitoring systems. When conducting post-incident activities, any security holes or vulnerabilities are expected to be patched.

Data Back-up by IR

Consider providing the company staff and employees with updated security training in light of what they learned from this incident. If an employee opened a malicious Excel file that was attached to an email, for instance, the whole company should be trained to spot and avoid such phishing attempts.

With the help of an incident response plan, IT personnel can better identify and respond to cybersecurity incidents like data breaches and cyber-attacks. Developing and maintaining an effective incident response plan calls for consistent training and revisions.

Restoring and reintroducing compromised hardware and software into a production setting. As soon as possible, get user systems as well as business operations back up and running without worrying about another breach.

Issues to consider

• When will systems be able to go back into active service?
• Is everything up to date, secure, and tried?
• Is there a reliable backup from which to restore the system?
• What exactly will you be looking for and how long will you be monitoring the affected systems?
• How can we make sure that similar attacks never happen again? (Intrusion detection/protection, file integrity tracking, etc.)

The goal of disaster recovery and backup services is to ensure that in the event of data loss because of file destruction, data corruption, cyberattack, or natural disaster, business operations can be continued or resumed with minimal interruption.

Conclusion

Thus, the company needs to set up an organization that may establish response-preventative measures in advance with the help of an incident response methodology. The methods used in IR can be classified as diverse. When security incidents occur, such as hacks or breaches, an incident response (IR) protocol must be implemented. Security teams need to have a plan established for how to react after an attack and set priorities for their work. Before a major attack, as well as a data breach, occurs, it is crucial to develop a thorough IR plan and practise the incident response methodology. Locating and identifying the origin of a problem is crucial for stopping it from spreading. Disabling network access, installing security patches, as well as backing up compromised equipment are all necessary steps in containing and recovering from the breach.

The primary concept is to evaluate the extent of the breach, inform those who have been affected, and implement safeguards to stop it from happening again. In the case of data loss, businesses can continue or restart operations thanks to disaster recovery along with backup services.

References

Garcés, I.O., Cazares, M.F. and Andrade, R.O., 2019, December. Detection of phishing attacks with machine learning techniques in cognitive security architecture. In 2019 International Conference on Computational Science and Computational Intelligence (CSCI) (pp. 366-370). IEEE.

Kaiser, F.K., Andris, L.J., Tennig, T.F., Iser, J.M., Wiens, M. and Schultmann, F., 2022, October. Cyber threat intelligence enabled automated attack incident response. In 2022 3rd International Conference on Next Generation Computing Applications (NextComp) (pp. 1-6). IEEE.

Tang, J., Zheng, L., Han, C., Yin, W., Zhang, Y., Zou, Y. and Huang, H., 2020. Statistical and machine-learning methods for clearance time prediction of road incidents: A methodology review. Analytic Methods in Accident Research , 27 , p.100123.

Whitman, M.E. and Mattord, H.J., 2021. Principles of incident response and disaster recovery . Cengage Learning.

Woods, D.W. and Böhme, R., 2021, June. How cyber insurance shapes incident response: A mixed methods study. In Workshop on the Economics of Information Security

You Might Also Like

Telstra Case Study Assignment Help

Facial Recognition in Computer Science Assignments

ACCT100 Financial Statement Analysis - Telstra Assignment Sample

Looking For Complete Assignment Sample Get It On WhatsApp