Hit by a Cyberattack
Lessons “Learned”
Miguel De Bruycker
1
Introduction
• Belgian Defence 2006 Cyber Defence project
– Protect, Detect & Respond
• Expertise
– Malware detection
– Malware analysis
– Incident handling
2
3
For some networks you
Need “more security”
“More” security?
• “Good” security, but sexy
• Long time undetected
– AV is good, but…
• “Strong” Counterparts
4
5
The CEO handles the incident
“We” take care of this
• Management makes decisions
• Evaluate the risks fast
• Bring in “real” experts
• Your ICT get the fame
6
7
Talk about it …
When the time is right
Communication plan
• Control your communication• Involve Legal
– File a complaint?– Maintain a list– Make liable– Prepare a clear message
• Share IOC ?
8
Diagnosis?
• Identification• Diagnosis• Intervention
– Narcosis– Surgery– Wake up
• Recover• Follow up
Silent (no media, no action)
Protect forensics & evidence
Plan clean up, communication, post Ops
Counterpart will try
(Steal last crown jewels)
Erase all traces
Install backdoor
10
It’s better to detect yourself
All intrusions leave traces
• Monitor (do it, check it)
– Install IDS
– Log & check
– Detect at the first stage
– But protection = step 1
• Periodic Board Report
• Have IH procedures
11
12
There are seldom lessons “learned”
We mostly have lessons “Identified”
THANK YOU
Miguel De Bruycker
13