Responding to Security Incident

Dr. Lamiaa Basyoni

Responding to Application Security
Incidents
Containment
Listing :

• Blackhole Feature: Enable the Blackhole feature on the web application to drop requests from the same source after a
limit.
• Blacklist IPs: Blacklist or block single IPs if the attack seems to originate from them.

DoS:

• Increase Server Capacity: Upgrade server capacity to handle more connections and deter low-and-slow attacks.
• Use Anti-DDoS Services: Employ services like CloudFlare for DDoS protection and maintaining web application availability.
• Manage Authenticated User Load: Define limits for authenticated users' load on the web app and terminate old requests
for new ones.

Filtering:

• Filter Traffic with Special Routers: Use routers to filter legitimate traffic from incoming ones, based on protocols and
patterns.
• Traffic Flow Restriction: Restrict traffic flow from compromised systems and networks.
• Use Web Application Firewall (WAF): Deploy WAF to monitor and block potential threats.
• Enable Egress Filtering: Restrict traffic flow from compromised systems using egress filtering.
Containment
Negotiate with Attackers: Negotiate with attackers in certain incidents to buy time
Negotiate for management approvals and minimize data loss.

Regular Malware Scans: Perform malware and virus scans, delete browser cookies
Perform regularly.

Vulnerability Scanning: Scan for injection and session-based vulnerabilities and

Scanning patch them.

Indicator of Compromise Detection: Check for indicators of compromise across

Check servers and applications and remove them.
Containment Methods

Whitelisting/Blacklisting

Web Content Filtering

Proxy Servers
 Whitelisting/Blacklisting
An application whitelist is a list of authorized applications that are
legitimate and safe to be present and active on a computer in an
organization.

Any application present in the list of application blacklist is not

permitted due to its association with malicious activity.

Application whitelisting is considered more reliable and effective in

mitigating security incidents.
Whitelisting/
Blacklisting:
Tools
 Web Content Filtering
Web content filtering helps incident responders to filter web
applications used by attackers to host malware or to launch phishing
and spam campaigns.

The main aim of web content filtering is to restrict the use of web
applications that are unsafe if they are run or executed on the system.

Incident handlers should perform web content filtering to avert

employees from accessing web pages that may contain computer
viruses or malware.
Web
Content
Filtering:
Tools
 Proxy Servers
Proxy Servers act as doorways between the user and the web application that are browsed by
the user.

They are used to prevent IP blocking and maintain anonymity.

There are several advantages of using proxy servers as they provide a high level of privacy and
protect the users and the organizational network from any harm from malicious activities.

Incident handlers should use proxy servers in order to filter the web traffic either explicitly and
transparently.
Proxy
Servers:
Tools
Eradication
Eradication

Directory Traversal Attacks: Cookie/ Session Poisoning

Attacks:
Define access rights to the protected areas of Do not store plain text or weakly encrypted
the website. password in a cookie.
Apply checks/hot fixes that prevent the Implement cookie’s timeout.
exploitation of the vulnerability such as Cookie’s authentication credentials should be
Unicode to affect the directory traversal. associated with an IP address.
Web servers should be updated with security Make logout functions available.
patches in a timely manner.
Eradication

XSS Attacks: SQL Injection Attacks:

Ensure that the application performs proper Limit the Length of User Input:
validation of all the parameters of a user Isolate Database Server and Web Server: The
request such as headers, cookies, query web server runs in a DMZ as it should provide
strings, form fields, and hidden fields against a access to the public and if the attackers
rigorous specification. compromise it, they can also use its privileges
Use testing tools extensively during the design to access the database.
phase to eliminate such XSS holes in the Implement user input validation and
application before it goes into use. sanitization to restrict malicious SQL queries
The meta-characters are suspicious and might to the web server and database.
cause XSS attack on the web servers, incident Use typesafe Variables or Functions: The
handlers must encode input and output for responders should make sure that the server
Recovery

Scan all the web Elevate logging and

application resources such monitoring levels of the web Check the web application Remove the malware from
as servers and databases application to gather backups for traces of attack the affected applications
for malware and traces of realistic information about and clean them. and its resources.
attack and remove them. latest events.

Configure firewall, IDS, and Identify the compromised Use the cleaned, verified,
Change the administrative other security solutions to user accounts from the web and patched backup
passwords of all the detect the identified attack server and remove those version of the web
devices and resources. using signatures and accounts after informing application to restore the
behavior analysis. the users. services.

Check if the application has

recovered completely along Restart any services Restore the web servers
with the user accounts, terminated as a part of the and databases from clean
privileges, and containment process. and trusted backups.
configurations.
Responding to An Insider Incidents
 Containment

The IT and computer security

team should block the Seize the allocated devices and The IR team should inform the
After detecting the incident, suspect's organizational email take proper permissions to concerned department
incident responders must account and network seize their personal mobile affected by insider and ask
isolate the affected systems. credentials, seize their devices that they might have them to check for potential
desktops, laptops, mobile used during the incident. losses.
devices and other devices.

They should also give strict

Continuously monitor the
guidelines to other employees Thoroughly check the suspect
employees, contractors, third-
to discourage tailgating, use of for portable devices carrying Register a proper complaint in
party vendors or outsiders
unauthorized drives, transfer of the stolen data and gather all the respective jurisdiction and
identified as spies until the take proper legal action.
data using unencrypted means, his accounts data used during
organization terminates them
and discussing confidential the incident.
from the office.
matters in common areas.
 Containment

The HR team should block all

Issue guidelines to other accesses of suspicious
Restrict the suspect from Order all the users to change
employees about the insider employees and put them
entering organization their account and system
to protect manual under continuous monitoring
premises. passwords.
information transfer. until further decision from
the management.

Examine and contain attack

Dismiss the privileges and vectors such as malware,
Prosecute the employee Prioritize the threats that lead
credentials assigned to the portable storage devices,
responsible for that data to espionage and patch
user responsible for that secret cameras, phone
breach as per law. them.
incident, as required. tapping devices, recorders,
etc., used to spy.
 Access Control
• The best method for controlling insider threats is limiting and controlling access.
• To eradicate insider attacks, the organization must allocate the least amount of
access and privileges to the employees that they require to perform their job.
• In case the employees require any additional privileges, they must obtain
permission from the authorities and scrutinize the necessity of additional
privileges before provision.

Data Encryption
• The organization should encrypt its data at all levels: at rest, in motion, and in
use.

Eradication • To ensure safe encryption standards, an organization should implement the

usage of cryptographically generated random and multiple keys of at least 256-bit
and sufficient length across its devices and application.

Isolate the Storage

• Organizations should never store sensitive information on a networked computer.
• The storage systems and devices should not be accessible to regular network
traffic and only few trusted individuals should have access to it.
• Store the devices, systems, servers, and databases in secure environment with
physical access restrictions.
• Use password and biometric authentication-based locks to protect these
devices.
 Change Passwords Regularly
• The organization should have a strong password policy to secure
critical data.
• The policy must mandate all the employees to change their
passwords at regular intervals and keep them private. It must also
ensure that the employees lock their system before leaving the
workspace even for smaller intervals.
• The policy must prohibit the employees from exchanging their
system or account passwords or saving passwords on their
systems.
Eradication Data Centric Audit and Protection (DCAP)
• Organizations should adapt DCAP solutions in order to monitor
and analyze user privileges, thereby, detecting unauthorized
changes made to these permissions.
• A DCAP solution can be used to automate the process of
managing user accounts and monitoring of usage patterns.
• Organizations can setup DCAP solution that includes automated
tools to discover and classify their critical or sensitive data.
 If the stolen data impacts the
Gather the evidences required to user accounts, change the
submit in the court of law by passwords of all the accounts
performing forensic process. and make it mandatory to use
These evidences will help the two factor authentication. In
organization to claim insurance case of stolen application data
to recover the damages. use copyrights to prevent other
companies from using it.

If the attacker has damaged any

data or placed malware, the Implement recovery processes
incident responder must remove and backup to continue business

Recovering all the traces of malware and

recover the data from backups.
operations after the incident.

Secure the backup media and its

Develop and implement the data content from alteration, theft, or
backup plan to recover data in destruction. It must ensure that
case of any security incident or the administrators perform
accidental data deletion. regular backups and test them
for integrity and availability.
 Implement separation of duties and configuration management procedures to
perform backups on computer systems, networks, and databases.

Implement a person-to-person rule to secure the backup process and physical

media.

Maintain a chain-of-custody document for accessing and handling backup media.

Recovering
Developing a data backup plan requires the investment of time and money but it is
far better than burden of recreating data. The main primary task is to understand
what data is to back up and protect. As a part of data backup plan, determine the
following:
•What data to back up?
•Which compression method to use?
•How often backup needs to run?
•What type of backups to run?
•What kind of media to use for backup?
•Where to store backup data to keep it secure?
Responding to Malware Incidents
Containment
Incident responder must In case the malware has
simultaneously gather and compromised multiple systems,
After confirming the presence of
analyze network logs of the you must cut the network
malware, separate the
system to find the events of services of these systems and
compromised host from the
malware propagation through prioritize them according to the
operational network.
shared files and connected importance of the affected host
systems. for business continuity.

Use separate virtual local area Start analysis of the

Allow the connections through
networks (VLAN) for infected compromised host to find
an access control network or
hosts to find the processes the malware signature, pattern or
VPN for the non-compromised
malware employs to join the behavior that you can use to
devices.
network when connected. contain the incident.
Containment

Disable the targeted

Run host-based Run registry monitoring
services, applications Block all unnecessary
antivirus, firewall, and tools to find malicious
and systems until the ports at the host and
intrusion detection registry entries added by
exploited vulnerabilities firewall.
software. the backdoor.
are patched.

Remove or uninstall the

Remove the malicious Delete malicious files
program or application
registry entries added by related to the backdoor
installed by the
the backdoor Trojan. Trojan.
backdoor Trojan or virus.
Eradication

Content Filtering Tools

• An organization must make use of various tools that can mitigate malware threats.
• Antivirus software, intrusion prevention systems (IPS), content filtering tools, and firewall can help the IRT team in blacklisting the malware.
• Content filtering tools are highly useful when blocking malware with static characteristics, such as strings and loaders.
• For example, a responder can block malicious spam mail by configuring the email servers and clients, and anti-spam software to filter the
suspicious mails based on their attributes such as content, name and type of attachment, origin of the mail, its signature, etc.

Network Security Devices

• Network connectivity of the compromised host plays a major role in the spread of malware and in establishing communication between the
attacker’s tool with its control and command server. Thus, it is very effective to impose temporary restrictions on network connectivity to
curb such malware’s attempts to compromise other hosts.
• Incident responders must disconnect the compromised devices by blocking their IP address or physically removing its network cables. This
approach includes isolation of uncompromised subnets from the main network or eliminating network access to remote VPN users. For
example, the responder can keep servers and workstations on separate subnets to ensure minimal disruption of functionality.
• IPS devices can prevent malware based on their signatures and heuristics. An inline network based IPS can identify and block the malware
from entering the organization’s hosts. An incident responder should reconfigure IPS sensors based on the severity of the infection. The IPS
devices can contain spread of malware occurring from both the incoming and outgoing attacks. Also, a responder can customize them
based on the malware attributes and signatures.
 Blacklist

• An incident responder can also use blacklisting technique to block malware from
executing.
• This method is applicable even if the responder did not receive malware signatures
from the vendor.
• For this, the incident responder can simply enter the names of the files that should
not be executed into operating systems, host based IPS products, and other security
tools in the network.
• Antivirus tools can quarantine and contain existing malware but may not be much
effective in case of new malware. An incident responder should hence update the
antivirus software with the latest signatures.

Antivirus Tools

Eradication • A responder may eradicate malware by cleaning with antivirus, quarantining with
antivirus software, using malware removal tools, through manual intervention,
vulnerability management technologies, and using network access control software.
An organization may also use automated eradication methods, such as triggering
antivirus scans remotely.
• To remove the binaries and the related registry entries, the responders should run a
full antivirus scan. For this they should use an antivirus software that contains
updated signatures. An incident responder may also run an online antivirus scan or
make use of best practices that antivirus vendors suggest.
• Responders should remember that while eradicating sophisticated malware,
rebuilding the system from is the safest approach. An incident responder can rebuild
the system from a trusted source, such as system installation disk or a clean system
image.
Eradication

Updating the Malware Database

• Update the malware databases in the organization with the signatures of newly found malware and, also report the
same to the malware vendors and antivirus developers. Save the signatures in the form of Hashes for future reference of
organization as well as the public recognition.

Fixing Devices

• Once the IRT team detects the vulnerability on their network that the malware has exploited, it must address them on
the other systems in the network as well. Some examples are security misconfigurations, which an incident responder
can rectify by implementing proper access controls, or vulnerabilities in shared drives, that a responder can update or
stop their usage to contain the attack.

Manual Scan

• Run a full scan of the compromised system with an updated antivirus program to remove the malicious codes, binaries,
related registry entries, scheduled tasks and other files and folders related to the malware. Recheck the recovered
devices for traces of malware before introducing it to the functional network.
 Recovery

The IRT must review and Inform and educate users,

update the computer security clients, stakeholders, and The IRT should ensure that
and malware prevention employees about the recent the organization follows an
policies as per the report and malware attack and actions effective data backup and
outcome of the recent that can prevent such recovery process.
malware incident. incidents in future.

The organization should

The organization should
identify critical hosts and
educate its employees about
install host-based IDSs on
safely dealing with email
them, to monitor their traffic
attachments.
flow and to detect anomalies.
 Recovery

The responders should check The organization should

The Organization should whether all hosts have review and update its IR
restrict usage of removable updated firewalls and processes and facilities such
devices on organizational antiviruses that can block the that it can deal with malware
systems, unless necessary. installation of spyware incidents as quickly as
software. possible with minimal losses.

Organizations should use

All the employees and users secure email clients with
of the organization should features, such as digital
have email filters that can signatures, PGP encryption,
spot and filter out spam. scanning feature for
attachments, and so on.
Thank you