Cyber-resilience: bend without breaking Gérôme BILLOIS gerome.billois@wavestone.com (+33) 6 10 99 00 60 © WAVESTONE 2 Cyber-resilience: 2 concrete public engagements with worldwide IS reconstruction Not Petya attack Ransomware 2017 2019 CERT-W run ~4 forensics per month… Steering of the worldwide cybersecurity remediation plan (2 years) Up to 30 consultants involved Crisis period: 3 weeks Up to 17 consultants involved Crisis period: 3 weeks CYBER RESILIENCE © WAVESTONE 3 What is somehow different in a cyber crisis? A business crisis, not an IT one Against you, a group of real people The need for forensics expertise A long term crisis (usually 2 to 3 weeks) The inverted pyramid: few experts, lot of work to do A strongly regulated topic (GDPR/business specific) © WAVESTONE 4 CYBER-RESILIENCE In case of a major cyber-attack, maintaining vital activities in downgraded mode while regaining trust quickly in your information system How can attackers impact your resilience? Destroy information system Cyber Warfare, (h)ac(k)tivism… Corrupt internal system Steal money, fraud, scams… Steal data Trade secrets, personal data… © WAVESTONE 5 Massive destruction of Internal system corruption Massive destruction of workstations & servers following a compromised AD Modify securities ownership in the delivery & settlement process Fraudulent payments on the payment settlement chain (CBM or commercial money) Major data leakage Major data leakage of cash & securities positions Specify precisely your main scenarios Precise in details, adapted to context and considering the latest attacks to define efficient plan © WAVESTONE 6 QUANTIFY RISKS What is the probability of being attacked and how much it will cost AND QUANTIFY THE RISKS: What is the value at risk? © WAVESTONE 6 © WAVESTONE 7 Assess your protection level… regarding to the selected scenarios Then improve your cybersecurity protection 1 2 Build your cyber-resilience a. Contain the attack b. Work without IT c. Reconstruction IT fast How should I do? © WAVESTONE 8 Harden high privileged infrastructures (backup, batch, supervision…) Some well-known And some less usual solutions. but seldom implemented solutions Restrict use of high privileged accounts, starting with AD infrastructure Review the batch management (reduce batch rights, review code security, check integrity) Adopt the “One-way flow” principle for critical applications (establish connection from most secured to less secured diode) Challenge vendor and sub-contractor security maturity continuously (adapt update strategy and remote access) Secure data flows to prevent injections (ETL, EAI, file shares, messaging systems) Dedicate administration environments Allow quick updates 1. Improve your cybersecurity protection Implement Honeypots © WAVESTONE 9 Assess your protection level… … and then build your cyber-resiliency following 2 steps © WAVESTONE 9 2a - Contain the attack © WAVESTONE 9 Arm yourself Respond efficiently /Have forensic expertise on hand /Have sufficient, safe and searchable logs /Have safe crisis management tools /Rethink crisis communication /Define floodgates (Red Button) in your network /Strengthen detection with business processes knowledge (multi-level controls) /Introduce technological diversity when appropriate /Consider taking out cyber-insurance /Allow quick decisions from operational teams for threat containment (floodgate activation, systems shutdown...) – with management delegation of power /Be able to rally management, technical experts, continuity, HR and communications staff /Be prepared for 24/7 operations (logistics/HR) over a long time and ensure rotations /Test your cyber-crisis management using an ambitious and realistic situation FC © WAVESTONE 10 FOCUS | During a cyber attack, before rebuilding workstations/servers, it is required to understand the attack to develop a “vaccine” Business activity NOMINAL INTERRUPTION DOWNGRADED MODE phase phase phase CYBERATTACK Nominal site Backup site Preparation of the backup solutions Analysis, decisions and activation of the backup solution Common steps for a backup user site failover Distinctive characteristics for a cyber attack Understanding of the attack Development of a “vaccine” Deployment of the backup solution for the chosen populations The time required to understand the attack and to develop the vaccine will delay the activation and deployment of the backup solution © WAVESTONE 10 Deployment of the backup solution for the chosen populations © WAVESTONE 11 Working with paper, cash, phone, alternative email… © WAVESTONE 11 /Can I work with manual workarounds? /If not, how do I a do controlled business shutdown? /Which data do I need? (Clients contacts, contractors or suppliers lists, business data extractions…) /Which alternate tools do I need? (phones, WhatsApp-likes, Gmail-likes, “light” desktop environments…) FC 2b. Learn to work without IT for a few days. © WAVESTONE 12 Standardisation Define global reconstruction solutions, the specificities are time- consuming! Automatisation Accelerate recovery and limit the need for human intervention Simplicity Ensure that it is not only experts who can carry out the operations ABILITY TO PARALLELISE The keys to fast IS reconstruction CYBER RESILIENCE © WAVESTONE 13 © WAVESTONE 13 The keys to fast IS reconstruction Can we innovate? /Ready-made business packages for workstations /User self remastering procedure with USB key: Do It Yourself /Deployed cloud based workstation /Mobile backup server to restore user’s data (drop-shipping) WORKSTATIONS APPLICATIONS & INFRASTUCTURES /Orderly applications reconstruction (business prioritization) /Ensure backups and associated infrastructure are healthy /Standalone mode for vital applications (internal or cloud-based) /Key Infrastructures reconstruction plans defined and tested /Automated infrastructure & application deployment /[High budget] Implement non-similar facility ELA © WAVESTONE 14 Three layers to consider in order to define the Recovery Strategy CYBER RESILIENCE Applications Data Usually the malware is located in the OS part or sometime in Application part Recovery Strategy Restore, Clean-up & Patch or Reinstall OS Restore, Clean-up & Patch or Reinstall Restore, Clean-up or Recreate data or Accept the loss © WAVESTONE 15 We need to work together must be onboarded Businesses in cyber crisis management Suppliers in your cyber-resilience strategy must be considered Continuity teams must work in cybersecurity and © WAVESTONE 16 Rundown: The road towards cyber-resilience. Specify scenarios. Evaluate the scenarios: /Complexity in my company’s context /Current impact Keep watch on ever changing threats to adapt your plans. completing your cyber-security program… building your cyber-resilience program. To complete the cyber- security program with additional measures. From …to Launch your cyber- resilience program: /Ability to contain the attack /Ability to fast reconstruct the IS /Ability to work without an IS Gérôme BILLOIS gerome.billois@wavestone.com @gbillois @Risk_Insight Credits Icons Thenounproject: Ben Davis, Anbileru Adaleru, Anil, Nikita Kozin, Rodrigo Ramirez, David Courey