Information security is a critical concern for most enterprises today. While in many cases, the security breach may be limited to a virus attack or a website defacement, there are other and more serious implications of a breach—these can damage a company’s reputation in the form of crippling downtime-related losses or theft of proprietary information. An attack or breach could be from internal or external sources, and while there are many articles that have dealt with the source of such attacks, this report is aimed at advising enterprises on the incident response measures that should follow a breach.

Threats from every side
A recent IS security survey by CII-PwC shows that 80% of businesses suffered some kind of breach in 2001-02, up from 60% in the previous year. While virus attacks accounted for a bulk of most breaches, denial of service attacks were also on the rise. Besides these, financial fraud, identity theft, spoofing, corporate espionage, website defacement and insider abuse accounted for the other attacks—and all were on the rise. Also, internal security breaches accounted for 60% of all incidents.

OS-related vulnerabilities are among the single-largest causes of IT security breaches in India—largely in line with the global trend. However, the proportion of primitive-level security breaches like human error and poorly-defined access controls seem to be significantly higher in India than internationally. Swapan Johri, head (security) at HCL Comnet says, "About 80% of all corporate intellectual property is in the digital form. This stands exposed to a whole range of attacks, varying from insiders with malicious intent, to terrorists, spies, joyrides, even predatory competition."

In most cases, breaches are determined through data damage, server logs or being alerted by an employee.

Capt Felix Mohan, CEO of Delhi-based IT security firm Securesynergy, says, "Breaches are detected by proactive and reactive methods. Proactive methods are technical controls like intrusion detection systems, firewalls, file integrity monitors and analysis of server logs. Reactive methods include discovery of breach due to data loss or material damage, or when alerted by colleagues, customers, or managed service providers."

Denial doesn’t help
Enterprises usually express denial or disbelief on determining a breach for the first time. Only when the severity of the situation becomes clear does a gamut of emotions ensue—anger at the perpetrator, betrayal by the security vendors who didn’t prevent it from happening, and finally, sheer panic. By the times a typical enterprise actually starts addressing the problem, precious time has been lost, possibly worsening the situation.

The reason for the panic stems from the absence of an incident response plan that serves as a guide when the system is breached. Most do not know who to call for help, when and how to communicate the problem to employees, customers and the media, or how to get back online. To minimize the damage, an enterprise should have a well-defined strategy in the form of a detailed and clearly-written incident response plan. Preparing ahead kills the possibility of a switch to ‘panic’ mode, apart from making the recovery process faster and smoother.

Quick-fix may not plug gaps
Most enterprises, when confronted with a website defacement, tend to take down the site, fix it quickly, put it back up and hope that nobody noticed. But a rushed fix can make matters worse. Many hackers also build a backdoor into their handiwork, allowing them to easily get back in and do more damage later. Implementing a quick fix solution, therefore, can quash a company’s ability to track down and prosecute the perpetrator. In their haste to restore sites, companies trample and sometimes entirely ‘erase’ the crime scene. The first step is assessing the extent of the damage. Says Capt Mohan, "Few enterprises document forensics guidelines that set out how to maintain evidence during an investigation from a legal perspective, and provide technical procedures and standards that need to be adopted for diagnosing breaches."

Backups are essential
One technique for buying time to investigate without jeopardizing the business is to maintain backups with frequently-updated copies of all website pages. A company hit by a security breach can then run its site from the backup servers, while combing through evidence on the primary system. The cost of this would vary, depending on the size and dynamics of the site. Having backup for a larger site may be worth it when you consider the value it offers. A company can immediately bring a clean copy of the site backup, examine the damaged site to determine in detail what happened and avoid a rushed fix.

In-house IR team
Enterprises need an in-house incident response team consisting of cross-functional employees to handle cases of breaches. Calling in the incident response team should be at the top of the list of action items on a company’s incident response plan. This group should have executives and representatives from IS, business units, plus PR, legal, marketing and HR departments, with training on how to respond in the event of a breach.

Do not hesitate to report
The CSI/FBI 2002 Computer Crime and Security Survey in the US reveals that only 34% of surveyed respondents reported a security breach to law enforcement bodies. Also, 77% of the respondents patched holes and moved on with business. Rohit Nand, senior security consultant at Bangalore Labs, opines—"The percentage of organizations in India that would detect a security breach and report the same to law enforcement would be far lower than that in the West. Thus is due to factors like lower security awareness levels and budgets, apart from the lack of a centralized IT security incident reporting body, like FBI and CERT."

A company’s IR plan should detail whether the authorities should be called, and in what circumstances, and by whom. For one, when an employee receives a threat via e-mail or trade secrets have been compromised, the authorities should be informed fast. But in case of an employee being suspected of accessing information that’s off-limits, it could be a matter best dealt with in-house. On the whole, reporting cybercrimes and network attacks is the right thing to do. Only sharing information with law enforcement and industry groups will make it easier to prosecute criminals, identify new security threats and prevent future attacks.

Amit Sarkar in New Delhi