Posts

m.a.collins
, , ,

Respond – The Fourth Function of CSF

Krakenimages by Shutterstock

The next logical step in the NIST CyberSecurity Framework is Respond.  In other words, how are you planning to respond when a threat to your organization is detected or realized?  The Respond function essentially sets forth the processes and procedures enacted for incident response, who will own the issue and oversee its execution, who will be engaged to perform the forensics to determine how the threat gained a foothold in the environment, and what steps should be taken correlative to the risk inherent to the threat.

There are four aspects to the Respond function of CSF:

1. Response Planning

The goal in response planning is to enhance your business or organizational resiliency.  Here are some scenarios to consider that we hope would never occur but are likely enough to consider for planning.  We’ll start with a very likely incident.  What happens if your company loses power?   How long can the company network sustain a power outage before it becomes a critical incident?  What would happen if your major Cloud provider (Office365, QuickBooks Online, Kronos, etc.) went offline for a month or longer?  How would your organization respond?  Do you have a Business Continuity plan to cover instances like that?

How would your company be affected by a fire, flood, or tornado?  Would your clients and branches be able to maintain communications and business basics?  Do you have a Disaster Recovery plan that can cover that?

Of course, some these issues are tertiary to cybersecurity – they impact cybersecurity but may or may not be directly related.  What happens if an employee is tricked into opening an attachment that introduces ransomware to the entire network?  Or, what happens if one of your security controls indicates a persistent attack from a particular source? What happens if a disgruntled employee attacks the network from within the company?  Who is notified, who is responsible for mitigation and remediation, who needs to be alerted and when?  What is your Security Incident Response plan?  These are all things you need to consider.

Smaller organizations have the benefit of being able to pivot quickly and adjust to unforeseen situations.  Larger organization require more thorough planning to survive and adapt to such events.  However, we all know that planning ahead of time makes these situations less stressful and easier to overcome.  If that weren’t true, EMA and the Military wouldn’t invest so much time in training and preparing their personnel for disaster response.  Be sure your response planning includes Business Continuity, Disaster Recovery, and Security Incident Response plans.

2. Communications

This article has already hinted at communications, but it is the key to overcoming any crisis.  Technology can help us here, since we all have a smartphone in our pockets; but how will you leverage those technologies in response to an emergency?  What do your personnel need to know and expect when normal avenues of communication are not an option?  How will you respond in such a way to maintain business as usual while not destroying evidence necessary for the authorities to forensically investigate the incident?  Who is going to notify the authorities and what authorities should be notified?  How will your clients get in contact with you?  How often will you test these plans to ensure you aren’t overlooking a critical roadblock?  When do you need to contact your cyber-insurance provider?

There are a lot of questions to consider, which is why leadership must make it a priority to plan out these scenarios.  Attempting to make these decisions on the fly will generate incredible chaos and likely will miss better options that would save the company time and money.  There are a lot of moving parts to cybersecurity incidents, and the more you plan before you need them, the better your organization will weather the storm of an attack.  Defining who communicates with whom and by when will mitigate a lot of unnecessary stress and chaos.

3. Analysis

It’s difficult to talk about one aspect of Response without alluding to others.  We’ve mentioned forensics already, but forensics needs to be planned for in the communications stage of an incident response plan.  Additionally, forensics needs to be performed and executed. 

If you have a cyber-insurance policy, today’s policies often cover forensics up to a certain amount.  Depending on your insurance provider, they may want you to notify them (communications again) before doing anything; because they want to ensure the proper authorities are involved before you make changes that will negatively impact their ability to forensically identify how the attack occurred, who was responsible for it, and what can be done to mitigate that threat in the future.

If you have an IT department, you need to have some means for them to perform their analysis from a read-only snapshot archive.  This enables analysis to be performed without tampering or contaminating digital evidence.  This is where your Protect function comes into play.  Those enhanced logging and archiving measures developed and implemented will help both internal and external sources get to the bottom of the issue.

4. Mitigation

Finally, once you’ve identified various threats, it is important to have a plan for isolating those threats from doing any further damage to your organization.  For instance, TCS has the ability to immediately isolate a computer from the network as soon as ransomware is detected on it.  This effectively enables us to limit the threat exposure to our clients, but ransomware is only one of many threats to our clients.

Different kinds of threats pose different mitigation complications depending on the type of threat.  Planning ahead to determine how different threats can be isolated and contained as quickly as possible will help you recover faster with less negative impact to your organization.

Conclusion:

As you can see, the further we get into the functions of CSF, the easier they get.  All that front-loading work at the beginning to identify the various types of threats, perform risk analyses, implement protection measures, develop policies and procedures for how personnel will perform critical tasks, makes it much easier to respond to emergent issues.

That being said, there are a lot of moving parts to the incident response plan. If you find that you are overwhelmed by the magnitude of incident response planning and need some consulting or even compliance assistance, please reach out to TCS today!  We’d be honored to help you work through these issues and have the best plan possible for your organization to weather just about any storm short of a zombie apocalypse.

Note: This article was based on the resources available at https://www.nist.gov/cyberframework/respond

/by
Charlie Waters
,

Strategy: Turning Your Business Inside Out

Inside What?

Does the current pandemic have your company turned inside out?  Hopefully not, but maybe some other crisis will.  Why not just go ahead and turn your company inside out on purpose?!  Better on your terms than something external.  Let me explain.  Today I am working from home, productive, but under quarantine (exposed, but so far symptom free, and I thank God for that).  This is not the first time I have had to work like this.  In a prior company, I was the VP of Service for a prominent Middle Georgia Managed Services Provider (MSP).  Like Total Computer Solutions, we provided a full compliment of outsourced IT staff to aid local small businesses.  From Virtual CIO (read: IT Director) to Service Coordinator to Help Desk Technicians and Engineers, the resources in my department were critical to support the strategic mission of a business down to the day-to-day computer problems.  As with that business, there were (and are today) a variety of conditions which made working from home a luxury on some occasions and an absolute necessity in others – ice storms, local flooding, power outages, and today – pandemics.  Who had COVID-19 on their Bingo card for 2020?  Today, I am the COO for TCS which means I am responsible for the operations of Service, Sales, and Finance – Facilities and Human Resources are also shared responsibilities in our core departments.

But this article is not about me or my background…more about YOUR business strategy.  This is an opportunity for me to share how prior planning and enhanced technical capabilities can enable your business and work force to thrive under similar work from home scenarios.  I am going to share with you my secret to business continuity – turning your business inside out.  If the concept of Disaster Recovery/Business Continuity is new to you, a little Google-Fu will produce a wealth of information on the topic.  Simply put, DRBC is the planning and development of capabilities to recover full business operations from a disaster while maintaining some level of functionality during the recovery effort.  I can work from home today, with minimal impact to my ability to communicate and coordinate our business operations, due to some advanced planning and the right mix of technologies.  But I am getting ahead of myself.

Company Culture for $200

It really starts with culture.  Company culture is the foundation upon which the rest of the business grows and thrives.  Without the right culture and management structure, keeping team cohesion and productivity during adverse business conditions can be difficult, if not downright impossible.  Fortunately, I have had great mentors in my career and picked up some tools along the way to help build and support a healthy culture around our people, process, and products.  For an MSP, our product is really our people.  True, we do sell stuff, but it is largely commodity goods and not the real differentiator between a good MSP and a bad one – the key is our team and we cannot thrive without a solid culture in place.  Our CEO Michael Collins is the primary champion of our culture here at TCS, so he and I have a Batman and Robin approach to reinforcing our values and team environment from the big picture down to everyday decisions.  This must be baked into the DNA of who you are as an organization.

Business structure must enable and support this culture.  We also use the Entrepreneurial Operating System (EOS) to drive the management of our business.  Rob Betzel, a friend who also happens to be my former boss, is a great local coach for both Company Culture and EOS.  I am forever grateful to him and others who have invested their time and energy into equipping me with the management principles and tools I have today.  Who knew you could make business leaders out of computer geeks?!  With a good management system/tools in place…we have a very high powered engine.  But what good is this high powered, superbly crafted engine without the proper fuel?

Culture is that fuel.  Everyday we fill the business engine with a tank of clean-burning high octane or some concoction of low octane fuel with lead, sulphur, water, and other contaminates.  Your company values, lived out, are the ingredients.  They cannot be merely a sign on the wall or words on your web site.  Integrity, teamwork, professionalism, accountability, and other key traits are the essential ingredients to maintaining workforce productivity, especially when working remote.  Sometimes, as managers, we have to make very tough decisions about who remains on the team when these values are not upheld.  Proper coaching and positive reinforcement can often help a struggling employee, but the best time to get this right is in the hiring process.  Having to micromanage an employee to get them to do their job well in the office simply is not going to work under these new conditions.  If you do not have this right yet, DO NOT PASS GO, DO NOT COLLECT $200 until you have this fixed.  As mentioned here, there is a wealth of local talent who can help you with this.

Communicate and Collaborate

Okay, company culture is good?  Check.  Now to turn your business inside out.  This really centers on communication and collaboration.  Here is what I mean by that (and this is the big secret) – design your business technology around having a mobile workforce who happens to work inside your building at times…cutting the corporate tether so to speak.  Easier said than done, for sure.  The planning and implementation must be a strategic top-down initiative.  On a side note, technology should always be connected to business strategy rather than existing for its own sake, letting the tail wag the dog.  In other words, bend technology around the needs of the users rather than the other way around.  And this strategy is more straightforward for companies primarily with knowledge workers as opposed to skilled labor who perform their work on the job site.  Even for skilled labor, their hub can be moved from the office to home (or an ad-hoc office) and dispatched to work onsite rather than reporting to the office first.  And for organizations who deliver their primary services onsite (i.e.: healthcare), support positions can often be moved off premise for the sake of distancing.  Telemedicine has emerged out of this trend.  There is no one size fits all solution, and these nuances must be considered.

Essentially this means formulating a cloud-centric but locally supported business technology infrastructure.  Consider moving employees to laptops with docking stations versus workstations.  This immediately enables mobility.  Voice communications – hosted phone system with softphones that run on your PC or even using your cell phone to make and receive calls using your business line.  Move QuickBooks online…easy.  You have already moved your email to O365, right?  RIGHT?!  Utilize Microsoft’s 365 suite beyond email to sync your documents to the cloud – no need for a file server or NAS is many cases.  Cloud-to-cloud backup is needed to protect your data no longer on premise.  MS Teams can be used for business chat along with audio/video conferencing.

In fact, yesterday I ran our weekly management meeting using Teams and was able to facilitate the meeting with no loss of productivity while working from home this week.  Management scored me an across the board 9 out of 10 for running the meeting which is pretty good considering the tough audience I serve.  Yes, we are results focused enough to score facilitating meetings (thanks again to EOS).  Shared management scorecard, no problem – click save and the rest of the team automatically gets the updates via cloud sync in the background.  With Microsoft 365 we can even edit Word documents and Excel spreadsheets as a group, live in the document at the same time.

Often critical line of business applications are the toughest nuts to crack.  The best option may be to keep what you have, even if that means on premise servers for now, and see if your application vendor offers a cloud hosted solution (sometimes you will see this advertised as SaaS – Software as a Service).  Cloud is not cheaper, but the benefits often make sense given the flexibility it offers along with a more robust business capability.  If you have already made that move, kudos!  Otherwise, TCS can facilitate a process for you to evaluate and identify a new vendor who offers this critical capability.

A side benefit of moving to a subscription “as a Service” model for consuming IT services is a more predictable and flat operational cost (OpEx) as opposed to large periodic or sometimes unpredictable capital expenditures (CapEx).  This is a main reason why MSPs operate under fixed-fee monthly contracts.  You are paying for an outsourced and fully staffed IT department, not simply an hourly rate to fix your latest application error.  Your technology infrastructure is a very dynamic environment that must be watered and fed to keep it running efficiently.  And moving to the cloud doesn’t mean your support needs magically disappear, it simply moves the management to the other side of the Internet wire.  Be sure you have an experienced technology partner to help you navigate these waters.  Having a handyman for odd jobs is fine, but you wouldn’t build a new house without a qualified architect.

Don’t You…Forget About (Securing) Me!

Culture, communication, and collaboration are in order, great!  My pastor would be proud my 3-point alliteration.  Ah, but we have a 4th point…security (or Cybersecurity gets me to 4 Cs).  We cannot overlook security in all of this.  Believe it or not, this Inside Out approach can improve your business security.  Yes, we have firewalls, encrypted wireless, content filters inside the office, but the most effective security (read: defense in depth) strategy is to assume your corporate network is what security experts refer to it as the “soft gooey middle”.  Simply put, start by assuming your office network is not safe and build defenses around your endpoints and applications.  When those are secure, along with a VPN or other secure remote access technologies, the reach of your information systems can be safely extended and working from Starbucks can be just as safe as the towering defenses of the ubiquitous grey office cube with its mystical, magical, always impervious to outside threats, wired ethernet connection (tongue firmly in cheek).

And all the stuff you have now moved to the cloud, it must be secured as well.  Wrap a security layer around O365 email to protect against phishing attacks, for example  If you are a regulated business (and who isn’t these days?), there are particular requirements for how your security is implemented and this also affects which cloud vendor(s) you choose.  Who owns your data?  Where is it physically stored?  Can you get your data back if needed?  As you guessed, there is no cookie cutter approach and security is best designed and managed by trusted professionals who understand the vulnerabilities and regulatory requirements along with appropriate risk mitigation strategies.

Wrapping It Up

TLDR; In summary, with the right company culture and structure, along with the appropriate mix of secure business technologies, your organization can remain business as usual through events that would cripple lesser equipped companies.  This Inside Out strategy takes what would otherwise be an existential threat and turns into a competitive strength.  Total Computer Solutions can design and support this sort of environment for your business and make “Turning Your Business Inside Out” a positive.  We would love to engage with you whether you are an existing contract client or have questions about how TCS can assess your business technology, partner with you, and help road map a strategy that is right sized for your organization.  We are all neighbors serving neighbors after all and TCS has been in that business for over 33 years.

Want More?  TCS Recommended Reading Includes:

/by