Cyber Security Report

This report provides insights into a disaster recovery plan, incident response summary, and security incident checklist for ITBase, a publicly traded IT firm. It covers the importance of cyber security, the case overview, and steps to mitigate risks and respond to incidents.

Cyber Security Report

Table of Contents
Introduction......................................................................................................................................1
Overview of Case...................................................................................................................1
1 Formulate disaster recovery plan for incident that is experienced by firm.........................1
2 Develop response summary for incident.............................................................................4
3 Prepare security incident checklist that can be utilised by firm when they have compromised
................................................................................................................................................6
Conclusion.......................................................................................................................................7
References........................................................................................................................................8

Introduction
Cyber security is defined as body of processes, practices and technologies which are
designed for protection of programs, data, networks and programs from any kind of damage,
attack or unauthenticated access (David, Keupp and Mermoud, 2020). It is also denoted by
information technology security. It is the practice that defends servers, electronic systems, data,
mobile devices, computers, networks and computers. With reference to organisations, it is
critical that they have adequate, policies, strategies and procedures that will assist them to secure
their systems in precise manner and carry out their functionalities effectively. Cyber security aids
firms to make sure that they can protect devices from third party attacks. This report is based on
ITBase which is publicly traded firm that is regarded as a market leader within highly
competitive as well as multi-billion dollar infrastructure IT market. This report will provide an
insight into disaster recovery plan and furnish response summary for the incident that have been
occurred. Apart from this, security incident checklist must be prepared that firm can use when
their assets have been intercepted by intruders.
Overview of Case
ITBase is an IT firm who has decided to add layer of security defence in order to identify
that their systems have been compromised. But when it was carried out then it was identifies that
their server is being utilised like a launching pad to attack other firms. For this organisation have
hired SeekSecNet which is a network security organisation that will formulate external
penetration test. ITBase is making use of firewall for protection of their networks but it was
identified that there logs were hardly reviewed and any kind of intrusion detection capabilities
were not executed. The fact was that the firm did not know that their server is compromised
unless unrelated firm contacted them for the network attack which was organised from their
network. But if they have not been notified by the firm then they will be compromised for many
more months. There is a probability that many firms might have been impacted but may not
know this. To have complete analysis of incident organisation have contacted SeekSecNet
through which they can prevent their system from getting compromised in future.
1 Formulate disaster recovery plan for incident that is experienced by firm
The structured and documented approach that is liable for illustration of ways in which
firm can resume their operations from any kind of unplanned incident is referred to as disaster
1

recovery plan. This is critical part of BCP (Business Continuity Plan) that is being applied to
distinct aspects of firm that are dependent of functioning that is being conducted by firm with
reference to IT infrastructure (Hussain, Mohamed and Razali, 2020). Organisations normally
make them prepared for different all the accountabilities that goes from natural disasters to cyber
attacks by formulation of precise detailed plans. The disaster recovery plan for ITBase is given
by SeekSecNet, it is illustrated below:
i. Establish owner: The anticipation for protection of business from any kind of cyber
attacks is often on IT department. But there is a probability that this department might be
overloaded with other issues at that peculiar instance. Thus, it is essential that it must be
identified that there is someone in ITBase who will take liabilities for formulation of
disaster recovery and cyber security plan. For this firm has hired SeekSecNet but as it is
outside organisation they need to have all details and for this there has to be appropriate
support from managers and leaders (Kwak and et. al, 2020). As it will enable them to
have precise information about attack.
ii. Identification of representatives from business: Creation of plan that will influence
business and needs input from each function of firm. SeekSecNet can execute this by
taking into consideration following aspects:
 Data and tools have critical role within carrying out activities along with this it is
necessary that what access is being given for them to whom.
 All the documents must be updated as new employees will be hired or even may
move in ITBase. This needs to have precise as well as mandatory interaction
among team leads (Lee and et. al, 2020).
 Employees must be included within the exercises of brainstorming like to
acknowledge the scenario of what if and plan must also be tested before it is
required. It is necessary that off-hour contact data must be added for each team
when incident takes place even after their working hours.
iii. Document risks: With reference to small businesses risks comprises of multitude events
such as business partners or vendors shutting down, natural disasters, unfortunate user
error or ransomware attack (Li, No and Boritz, 2020). The team must be formulated that
must provide SeekSecNet with probabilities by brainstorming. This comprises of certain
aspects mentioned below:
2

 What in case supplier or vendor goes out of business?
 What in case disgruntled employee delete or removes bunch of information from
system before they walk out of the ITBase?
 What can be done if organisation is closed due to hurricane or any other natural
disaster?
 What if system and servers of organisation are compromised?
It is necessary that relevant steps are being taken within reference to questions specified
above and there are many more that have to be answered so that adequate actions can be utilised
for mitigation of risks and priority in which they have to be handled (Lima and Keegan, 2020).
With reference to ITBase, SeekSecNet need to understand the vulnerabilities which lead to cause
the attack on servers so that accordingly plan can be developed for its mitigation.
iv. Specification of technologies, tools and data that are critical: Each organisation
possesses certain systems and data that enable them to carry out their functions. For an
instance accounting requires payroll data, sales need list of customers; developers require
code repository and many more to furnish their capabilities. But ITBase need to ensure
that depending on roles employees have to carry out within sales or any other aspects
access must be given so that information is not utilised in wrong manner (Mahajan,
2020). Along with this, SeekSecNet need to identify that if server compromised then for
how long firm can work in downtime.
v. Formulate inventory related with physical assets: It has to be made sure that updated
list related with all equipments must be made available with reference to day to day
operations that are being carried out by them. This should include each aspect which
ranges from computers to servers along with information and where they are physically
present. In addition to this, aspects related with where is data stored and ways in which it
is accessed by employees to deliver their services. It will assist SeekSecNet to take into
consideration each aspect that lead to creation of attack on servers of ITBase.
vi. Identify where as well as ways in which information can be backed up: Most of the
firms are dependent on their laptops and desktops for storing information. But it is
necessary that backup is being created so that if any physical harm either intentional or
unintentional the backup of that is present (Pretorius and van Niekerk, 2020). According
to SeekSecNet, this must involve protecting each computer, have the services from cloud
3

for backup, automatically create this aspect and prioritise easier recovery so that
information can be restored as well as recovered without need of virtual private networks
(VPN).
vii. Creation of communication plan: When disaster occurs in off- hours then it is essential
to notify their employees but it is important that how it can be notified (Samtani and et.
al, 2020). To understand its importance an example can be taken into consideration like a
network of ITBase have been compromised and an employee tend to login their
credential details to have access to software. Then intruder will also have active details
that will make it easy to have unauthenticated access. Thus, at this instance downtime
might seem better option but at their own cost. There are other aspects which must be
included like how vendors and customers will be notified, how they can operate their
operations from remote location, how information of update can be given. This has to be
considered by SeekSecNet.
viii. Practice: This illustrates that team sits together and take into consideration all the
probabilities associated with attacks which might occur and may have adverse impact on
their operations (Thomas and et. al, 2020). This will lead them to think practically as they
work and various problems might be faced by them while delivering their functionalities.
2 Develop response summary for incident
The organised approach that is being taken up for addressing as well as management of
cyber attacks or security breach, it is referred to as incident response. This also involves ways in
which firm attempts to deal with consequences associated with incident or any kind of breach
which have taken place. The goal behind this is effectual management of incidents through
which overall damage can be restricted. In addition to this, it also involves recovery cost, time
and collateral destruction is minimised (Wang and Jones, 2020). Incident response is normally
handled by IT team of organisation but usually but with reference to ITBase, SeekSecNet will do
this part for them but by coordinating with IT team of firm. The steps that are being taken up by
the later are mentioned beneath:
i. Preparation: This is crucial for formulating inevitable security breach which aids within
identification of ways in which policies will be formulated, communication and access
control given. Here, all the necessary aspects will be covered (Wiley, McCormac and
Calic, 2020).
4

ii. Identification: It is process by which incidents are being detected and are prompted to
give quick response through which damage and cost can be declined. Initially, the
password of servers must be changed and also events must be gathered by SeekSecNet
from monitoring tools, log files, intrusion detection and firewalls for determination of
attacks and its probable scope (David, Keupp and Mermoud, 2020).
iii. Containment: When incident is being identified or detected that comprises of top
priorities then the foremost thing is to prevent from damage occurring. Like in this,
server is used to hack systems of other organisations. It is necessary that all SANS
suggested steps are being considered by SeekSecNet for preventing destruction of
evidences which might be required for prosecution. These steps comprises of
formulation of system backup, short and long term containment.
iv. Eradication: This is a phase for effectual incident response which involves elimination
threat as well as restoration of impacted system to their previous state. For this
SeekSecNet can have services from cloud to have backup of all the data that is stored in
server and network, so that there working may not be affected (Hussain, Mohamed and
Razali, 2020). The next step involves formatting of a server so that the entire virus or
any kind of malicious software is removed so that probability of attack can be eliminated
in future. Furthermore, the next step that can be taken up by SeekSecNet is to ensure that
there all the devices and servers are up to date so that probability of vulnerabilities can
be eradicated completely. The next is to have different alphanumeric passwords which
are stored in encrypted form so that if third person get access to information they also
they can prevent the attacks. The other essential aspect is to have firewall and malicious
software detection application. Furthermore, access must be restricted to application with
reference to activities that are being carried out by employees as it will avoid internal
threats up to some extent (Kwak and et. al, 2020).
v. Recovery: The system must be tested, monitored and validated while putting them back
within production so that it can be identified that servers of ITBase are compromised or
re-infected (Lee and et. al, 2020). This is the essential step and this also comprises of
decision making in context of time, date, restoration of operations, their testing and
verification of compromised systems, monitoring as well as validation of the behaviour
of system.
5

vi. Lessons learned: This is critical phase within incident response as it aids within
educating as well as improvisation of future incident response effort. This will enable
SeekSecNet to update the incident response plan of ITBase as there may be probability
that some aspects might have been skipped or missed.
Apart from this, it is necessary that network is being monitored so that attack can be
identified. The reason behind this is that ITBase was not able to identify that there servers are
hacked and are being utilised for attacking systems of other organisations. So by monitoring
network they can acknowledge all the activities conducted (Li, No and Boritz, 2020).
Furthermore, if more than three attempts are being made to login within the system then that
computer or device must be blocked, restarted with new credentials as well as particular
authority must be informed about the same.
3 Prepare security incident checklist that can be utilised by firm when they have compromised
This aspect will assist will enable SeekSecNet to ensure that all the adequate steps have
been taken up by them to deal with cyber attack that has been occurred within ITBase. It will
assist within capturing information that is required while staying manageable, compact as well as
distributable (Lima and Keegan, 2020). In this context, the checklist is presented below:
i. Carry out precise risk assessment: identify the likelihood with reference to severity of
risks and ensure that it is always precise.
ii. Identification of team members and stakeholders: The stakeholders must be depicted
clearly who have decision making authorities.
iii. Defining type of security incidents: It is essential for SeekSecNet to acknowledge what
has to be done with reference to security incident response. The plan must illustrate what
counts for an incident as well as in charge for activation of plan.
iv. Inventory resources as well as assets: ITBase have resources and systems are available
to them. All the information of assets has to be maintained.
v. Planning of hierarchy of data flow: SeekSecNet need to have all the essential details
related with their assets so that they can identify what processes must be executed further
(Mahajan, 2020). It is necessary for SeekSecNet to ensure the flow of information.
vi. Preparation of wide range of public statements: Security events can have serious and
long time impact on reputation of firm. So accordingly statements must be formulated to
respond to their stakeholders.
6

vii. Formulation of incident event log: During and after cyber security incident have
occurred, it is necessary to track as well as review all the information by making sue of
log (Pretorius and van Niekerk, 2020).
Conclusion
From the above report, it can be concluded that cyber security is practice that is
associated with protection of programs, systems and networks from any kind of digital attacks.
They aims at assessment, alterations or destruction of sensitive data, extortion money or
interruption of normal functionalities of business processes. It is critical for organisation to
implement adequate cyber security measures for prevention of such kind of attacks. This
involves application, information, disaster recovery and network security that will enable firm to
carry out their operations in precise and abrupt manner.
7

References
Books & Journals
David, D.P., Keupp, M.M. and Mermoud, A., 2020. Knowledge absorption for cyber-security:
The role of human beliefs. Computers in Human Behavior, p.106255.
Hussain, A., Mohamed, A. and Razali, S., 2020, March. A Review on Cybersecurity: Challenges
& Emerging Threats. In Proceedings of the 3rd International Conference on Networking,
Information Systems & Security (pp. 1-7).
Kwak, Y. and et. al, 2020. Why Do Users Not Report Spear Phishing Emails?. Telematics and
Informatics, p.101343.
Lee, J.K. and et. al, 2020. Reconciliation of privacy with preventive Cybersecurity: The bright
internet approach. Information Systems Frontiers, 22(1), pp.45-57.
Li, H., No, W.G. and Boritz, J.E., 2020. Are external auditors concerned about cyber incidents?
Evidence from audit fees. Auditing: A Journal of Practice & Theory, 39(1), pp.151-171.
Lima, A.Q. and Keegan, B., 2020. Challenges of using machine learning algorithms for
cybersecurity: a study of threat-classification models applied to social media
communication data. In Cyber Influence and Cognitive Threats (pp. 33-52). Academic
Press.
Mahajan, S., 2020. Automotive Cyber Security Market: Industry Analysis and Forecast Till
2026.
Pretorius, B. and van Niekerk, B., 2020. Cyber-security for ICS/SCADA: a south African
perspective. In Cyber Warfare and Terrorism: Concepts, Methodologies, Tools, and
Applications (pp. 613-630). IGI Global.
Samtani, S. and et. al, 2020. Cybersecurity as an Industry: A Cyber Threat Intelligence
Perspective. The Palgrave Handbook of International Cybercrime and Cyberdeviance,
pp.135-154.
Thomas, B. And et. al, FireEye Inc, 2020. Dynamic adaptive defense for cyber-security threats.
U.S. Patent 10,616,265.
Wang, L. and Jones, R., 2020. Big Data Analytics in Cyber Security: Network Traffic and
Attacks. Journal of Computer Information Systems, pp.1-8.
Wiley, A., McCormac, A. and Calic, D., 2020. More than the individual: Examining the
relationship between culture and Information Security Awareness. Computers &
Security, 88, p.101640.
8