What To Do When You Get Hacked: A Practitioner’s Guide to Incident Response in the 21st Century

enter site Cover Half Title Title Page Copyright Page Table of Contents Chapter 1: What Is the Cybersecurity Epidemic? Why Is Cybersecurity Such a Big Deal? What Does Organized Computer Hacking Look Like? What Does This Mean for the Average Business? Stock Prices Suspended Business Operations Loss of Customers Compliance Fees Cyber Insurance Costs Lawsuits Recap Chapter 2: What Am I Defending My Company from? Social Engineering Malware Advanced Persistent Threats Insider Threats Who Are the Threat Actors? Types of Hackers What Exactly Do the Hackers Want? Recap Chapter 3: How to Get Started with Your Cybersecurity Program What Is a Cybersecurity Program? How to Get Started Creating Your Cybersecurity Program? Types of Security Controls Control Categories Preventative Controls Detective Controls Deterrent Controls Recovery Controls Recap Chapter 4: Why Do You Need Cyber Insurance? What Is Cyber Insurance? What Does Cyber Insurance Cover? What Are the Types of Cyber Insurance? What to Look for When Buying Cyber Insurance How Do Cyber Insurers Assess Companies? How to Make a Business Case for Cyber Insurance Recap Chapter 5: Compliance Regulations You Need to Be Aware of Why Is Meeting Compliance Important? GDPR Enforcement Recap Chapter 6: How to Be Prepared for Insider Threats The Principle of Least Privilege Segregation of Duties Mandatory Vacations Develop a Good Employee Termination Procedure Have Proper Surveillance Have Proper Backups and Recovery Processes Keep Track of Employee Access Monitor Your Network for Suspicious Activity Have Well-Developed Policies for Proper User Behavior Employee Training Security Awareness Training Recap Chapter 7: How to Build an Effective Incident Response Team NIST Incident Response Lifecycle Incident Response Lifecycle SP 800-61 Building Out the Incident Response Team Roles and Responsibilities Documentation and Playbooks How to Interview for Your Incident Response Team 30 Sample Interview Questions Junior Level Mid-Level Senior Level Required Software Tools Recap Chapter 8: How to Pitch for a Quality Cybersecurity Budget Quantifying ROI Four Areas of ROI in Cybersecurity Tips for Communicating ROI to Upper Management Have Accurate Accounting for Your Team Using Industry Statistics Recap Chapter 9: Why You Need Continuous Security Validation Why Continuous Security Validation Is Important Emulation versus Simulation How to Implement Security Validation Using Bug Bounty Programs Advantages Types of Bug Bounty Programs Why You Should Still Do Manual Tests Recap Chapter 10: The Importance of Routine Simulations Types of Situations You Need to Prepare For Types of Security Testing/Simulations That You Can Do Tabletop Exercise Structured Walk Through Simulation Testing Parallel Test Cutover Test Levels of Security Testing Data Verification Database Mounting Single Machine Boot Verification Runbook Testing Recovery Assurance Disaster Recovery Testing Best Practices Test Regularly Use the Feedback from the Simulations Have Clear Goals Outsource if Necessary Recap Chapter 11: The Six Steps to Preparing for a Cybersecurity Incident Incident Handler Communication Hardware and Software Analysis Hardening Your Systems for Preventing Incidents System Hardening Network Hardening Tips Chapter 12: How to Analyze a Potential Cybersecurity Incident Identifying IOCs Examples of Indicators of Compromise, Courtesy of Dark Reading Understand the Scope and Severity Understand Who You Need to Communicate With Identify Notification Requirements Recap Chapter 13: Steps to Containing a Cybersecurity Incident Isolate Any Infected Accounts and Machines Recap Chapter 14: How to Eradicate and Recover from a Cybersecurity Incident Eradication Phase How to Clean Malware Off of a Machine Prerequisites Step 1: Disconnect from the Internet Step 2: Make an Image of the Machine in Its Original State Step 3: Enter Safe Mode Step 4: Refrain from Logging into any Accounts Step 5: Clear Your Cache and Delete Temporary Files Step 6: Malware Removal Techniques Recovery Phase Recap Chapter 15: What to Do If You Don’t Have the Internal Expertise You Need Potential Benefits of Outsourcing Cybersecurity Potential Cons of Outsourcing Cybersecurity How to Outsource Cybersecurity Effectively Cybersecurity Operations You Should Consider Outsourcing Recap Chapter 16: How to Handle Third-Party Vendors That Have Suffered a Data Breach How You Can Mitigate Your Third-Party Risks Recap Chapter 17: How to Remove Data Leaks Once They Are on the Internet How to Remove Data Leaks on GitHub Truffle Hog GitSecrets GitHub Secret Scanning GitLeaks SpectralOps GitGuardian How to Get a GitHub Data Leak Removed How to Prevent Data Leaks on GitHub Educate Your Developers Use Fake Data Use a Monitoring Service or Tool What Happens If Someone Posts Your Company’s Data Online? Contact the Owner of the Forum/Website Submit a Request with Google Report the Website to Law Enforcement or the Web Hosting Provider How to Prevent Someone from Posting Your Data Online Protect Your Data Anonymize Client Information What Happens if Someone Steals My Domain? What to Do About a Squatted Domain How to Prevent Domain Squatting Register the Domain Before You Need It Register Similar Names Purchase Domain Ownership Protection Register a Trademark Be the Owner on Record Recap Chapter 18: How to Address the Public During a Data Breach Understand Your Reporting Obligations How to Deal with the Media Recap Chapter 19: How to Handle Disgruntled Customers During a Data Breach Recap Chapter 20: When Should I Get Law Enforcement Involved? Law Enforcement versus Private Consultants When Do You Have a Legal Obligation to Report a Data Breach to the Police? Recap Chapter 21: Public Authorities You Should Notify Throughout a Data Breach US Department of Health and Human Services Breaches Affecting Fewer Than 500 Individuals Breaches Affecting 500 or More Individuals Reporting a Data Breach to ICO When Do You Need to Notify Individuals about a Data Breach? When Do You Need to Report a Breach? How to Submit a Breach Report to the OPC and Affected Individuals Recap Conclusion Top 10 Key Cybersecurity Concepts to Remember Personally Identifiable Information (PII) Cyber Insurance The Principle of Least Privilege The Incident Response Lifecycle Quantifying the ROI of Cybersecurity Security Simulations to Prepare for a Hack Remember Third-Party Risks Compliance and Notification Requirements What Do You Need in an Incident Response Team? Defense in Depth Final Thoughts Available Resources Sources Index