Information security incident response and investigation

One of the largest Eastern European banks asked us to help them to meet the requirements of the international payment system SWIFT. To do this, it was necessary to implement and test the regulations and procedures for information security incident response.

To achieve this goal, the following tasks were completed:

• General preparation work: we coordinated with the customer the investigation regulations based on the existing customer's information security policies, as well as the relevant requirements and norms. We prepared a team of experts for remote investigations and investigations at the customer's premises.
• Preparing for remote investigations: we established remote access and instructed the customer's specialists.
• Conducting a test incident investigation. The test incident scenario and the amount of information provided to us were entirely at the customer’s discretion.
• Conducting investigations of real information security incidents and interacting with the customer in accordance with the established procedures.

We offered the customer the following set of typical security events and incidents, and the procedures for their handling:

1. Abnormal activity in the system or transaction logs
2. Compromised access credentials (short-term)
3. Identity theft (long-term APT attack, one-time attack, reconnaissance, etc.)
4. Privilege escalation
5. Violation of access zones or resource sharing between critical and general IT systems
6. Leak of confidential or internal information, or the threat of its disclosure
7. Virus attack (on-site or remotely, depending on the impact and extent of damage)
8. Violations of traceability and event log integrity, and breaches of non-repudiation
9. Other integrity violations (tampering or unauthorized modification)
10. Denial of service attack
11. Other incidents

Over two months, we developed and agreed on the response regulations and procedures with the customer. After we allocated resources for response and investigation, the customer initiated a test incident and gave us memory and hard disk dumps without any information about the incident. The "compromised" server was disconnected from the network, and a backup server took its place.

During one working week, we analyzed the dumps and found a test infection with a computer virus. We performed reverse engineering and prepared a detailed report describing how the infection occurred and progressed of the infection, as well as assessing the severity of the threat posed by the virus and providing recommendations for its removal.

The customer was satisfied with our work, reported to SWIFT, and purchased an annual subscription to our managed security incident response service. Then we offered the customer our service of PCI DSS implementation, but this is already a different story.

Partner with us to create your next success story.