Bruce Schneier: IT Teams Need Cyberattack Response Planning More Than Prevention (Linux.com)

> ideally neither gets starved and you have a robust prevention program as well as a decent response program.

> If I had to prioritize one over the other though, I would prioritize prevention rather than response. Just don't ignore response.

To quote from the article ... "Right now, response is the worst of the three and the area where organizations need the most improvement". So you and Schneier are singing from the same hymn-sheet.

Cheers,
Wol

You can't know if prevention is working if you don't know what's happening in your organization. This sort of conflates detection and response, but Schneier conflates them as well: "We need to be able to figure out what's happening to our organizations and what to do about it. And we need to do it in a way that makes us more resilient as an organization."

The overlap in detection and response is in determining the scope and effect of the breach. How many times does a corporation say, "we've detected an intrusion but we've been assured only X was taken and all is now well." Who actually believes such statements? It's garbage. They're almost always speaking from a position of ignorance about the real severity and scope of the intrusion.

A robust response capability requires excellent communication among groups, and accurate, timely, and comprehensive data about the state of infrastructure (routers, servers, etc). These things are _also_ critical for prevention, where such knowledge and agility are key components in keeping systems upgraded and patched. So it would almost necessarily follow that poor response capabilities reflect poor prevention capabilities.

I agree that prevention is paramount, if only because it's much more concrete and measurable. But detection and response provide priceless signals about the state of prevention, and thus guidance on where to focus and prioritize resources. If people falsely consider that a license to take short-cuts in prevention, that's their problem.

You have to set some sort of threshold for tolerable unethical behavior though because no one individual and definitely no organization that ever has been or will be can be described as ethical in all cases. Plenty of unethical organizations do ethical things which are worth supporting and plenty of seemingly ethical organizations do unethical things if you dig into them.

So you're saying if we have nothing to hide, we have nothing to fear?

>> So what sort of response are you going to make other than "it happened and we'll try to make it so that people don't misbehave in the future'?

You're obtuse. As mentioned in previous posts, thinking about a proper response to compromises helps you prevent such compromises in the first place. And that's not just technically (like defense in depth, up to date machines, blahblah).
Let me see:
- response guy: what kind of response will we give if your secret database X is compromised ?
- CEO: eh ? isn't that info supposed to be in our super-secure-LAN ?
- IT: hmm, no, we moved it to some-unsecure-network because important client Y didn't want to install a VPN (or you-name-it whatever stupid but pseudo valid reason).

Don't tell me that this doesn't happen, I see that all the time. Security people are the ones who prevent the work from being done, and when employees or clients push the management strong enough, the management ends up giving stupid orders without really understanding the consequences. Another reason is that temporary stuff (creating database blah for only a few days for client X) ends up being used forever.
If you can regularly assess response to compromising your existing infrastructure you'll be able to fix your infrastructure first.

And after an intrusion, what about
- proper sysadmin response to manage compromised servers (do I poweroff them ? Do I pull the network cable ? Do I try to dump the RAM and dd the disks while still on ? ...
- proper PR - it's much more credible to say at once that data X and Y and Z was stolen, rather than saying that nothing was stolen, then data X, then later Y, and then much later Z, which kind of proves your incompetence and shows that you really don't know what's in your network.

and I can continue with a bunch of other examples, but you got the point.

... if only in response to a subpoena or FoIA request. If you harm somebody enough to motivate them to sue, it all comes out.