Cyberattack and resilience with Nuabee

The specific nature of cyber attacks #

Compared to other crisis scenarios, cyber crises have specific characteristics that are important to understand:

• A dual temporality, with immediate impacts and a long remediation process that can extend over several weeks or even months;
• Uncertainty regarding the scope of the compromise;
• A lack of uniqueness of location, which implies a potential propagation to other organizations/companies due to the interconnection of IS;
• A threat that can adapt to containment and remediation measures;
• A complexity to understand the attacker’s objectives and attribute the origin of the attack.

(extracts from ANSSI documents)

The different stages  #

1. secure the perimeter
2. assess the severity of the cyber disaster
3. activate DRP measures
4. decide on complementary measures

Compared to other crisis scenarios that may require the activation of a DRP, cyber crises have specific characteristics:

• Immediate impacts (shutdown of certain activities, inability to deliver services, etc.).
• Uncertainties concerning the scope of the compromise.
• The complexity of deciding what can or cannot be restarted in DRP mode, and in what order, as this is linked to :
  • The vector of the attack: is it a worm, externally controlled ransomware, etc.
  • Potential propagation to other organizations due to the interconnection of IS.

In the first few hours, it can be difficult to distinguish an IT incident from a cyber incident.Technical teams must try to detect weak signals to shut down systems if necessary.

Step 0: Secure the perimeter #

Step 1: Assess the severity of the cyber loss #

• Which businesses (services) are affected
  • Which businesses (services) are able to work or not?
  • Which IS applications are affected?
  • Which IS applications can continue to be used?
• Are employee and/or customer data affected?

Step 2: Activate DRP measures #

This stage involves restoring critical applications and data so that core activities can be resumed:

1. The scope of the DRP to be activated, in particularThe
   1. choice of sites (if the DRP concerns several sites)
   2. The list of VSThe
   3. restoration date (last backup or specific date)
2. Additional actions to be carried out before opening access to usersExecution of
   1. security testsLaunch of
   2. additional security appliances in the recovery space

Step 3: Decide on additional measures #

It’s important to bear in mind that remediation in the wake of a cyber crisis can be a potentially lengthy process, lasting several days, weeks or even months.

You need to draw up a list of additional urgent actions to be carried out, and identify those responsible for implementing them.

This stage involves adapting the scope of the disaster recovery plan, hardening the systems and monitoring the attacker, so that core activities can be resumed.

In the event of a cyber-attack, it is possible (or even probable) that modifications will have to be made to infrastructures (security architecture, OS versions, server hardening, telecom architecture modifications, etc.) before a return to the nominal situation can be envisaged.

Stage 4: organizing the return #

This involves organizing the return to the nominal situation, after the activation of the DRP and its use in real-life by a Customer.

The aim is to present the general process and, depending on the context of the cyber crisis, the implementation mechanisms will be adjusted.

All these phases are explained in a specific document: Return to nominal situation after use of the DRP.