Many computer security professionals tend to think of computer security incidents as problems that originate from outside the perimeter, such as denial of service attacks, worm infections, and website defacements. As a result, many incident response teams fail to recognize and prepare for security compromises perpetrated by insiders. This is a serious mistake that results in substantial losses and costs. [v]  As reflected by recent surveys, many incidents, particularly those resulting in significant financial harm, are the work of rogue employees and other trusted individuals. [vi]

The insider threat takes many forms, whether it is unauthorized access to customer privacy information, theft of intellectual property and trade secrets, financial fraud, improper deletion of computer files (as in the case of Arthur Andersen) or various employee policy violations such as email harassment and Internet pornography. Notably, industry regulations and best practices do not differentiate between computer incidents with internal or external origins. As such, the incident response process needs to be just as effective in addressing the internal theft of intellectual property as with denial of service attacks.

A recent case involving an insider fraud investigation illustrates the essential importance of network-enabled computer forensics tools. In May 2003, an examiner at a major financial institution recently employed EnCase Enterprise in New York to successfully preview two drives in Asia connected to the wide-area-network for purposes of investigating a very sensitive case of insider trading. The drives were previewed less than an hour after management determined that the investigation was necessary and that time was of the essence.  The preview process revealed that one of the drives contained highly relevant information, and that drive was promptly acquired for further forensic analysis in New York without the knowledge of anyone in Asia and without disrupting operations.  The investigation also revealed that the other drive did not contain relevant evidence. Notably, with the SARS outbreak at its apex at the time of the incident, EnCase Enterprise essentially enabled an investigation that otherwise would likely not have taken place.

Even without a SARS epidemic, an investigation involving international travel, flyaway kits, and stand-alone computer forensics utilities would have delayed the process by several days, if not weeks, thus resulting in destroyed or otherwise changed evidence due to the critical delays. Further, an on-site response process would have likely compromised the investigation in this case or, at a minimum, impacted business and morale due to the very non-clandestine physical presence of investigators. 

While, as noted above, “patch and proceed” is at best a problematic approach to responding to breaches of perimeter security, it is completely antithetical to properly investigating incidents involving rogue insiders. Organizations must address the inside threat with proper internal computer incident response processes to limit liability and establish proper internal controls. Network-enabled computer forensics tools are ideal for investigating and containing compromises caused by insiders.

Industry Regulations Mandate Incident Response Processes

Many in the information security field are either unaware or reluctant to acknowledge that employing proper and established incident response processes and tools are critical components of the information security equation. Notably, however, key regulatory agencies do not share this lack of awareness. Specific industry regulations in the United States mandate that incident response processes consistent with best practices be implemented as part of an overall information security plan.

The Federal Trade Commission’s Safeguards rule, for instance, requires that covered entities maintain information security programs that include responding to attacks, intrusions or other systems failures. [vii]  The FTC rules went into effect May 2003.  The Office of the Comptroller of the Currency (OCC), which regulates banking institutions, issued similar regulations that specifically require banks to implement response programs specifying actions to be taken for internal and external security breaches, “including appropriate reports to regulatory law enforcement agencies.” [viii]  The Department of Health and Human Services issued nearly identical regulations stemming from HIPAA that cover health care providers. [ix] 

These regulations are not mere guidelines but mandates subject to aggressive enforcement, particularly by the FTC and OCC. The FTC recently initiated enforcement actions against Microsoft, Eli Lilly, the ACLU, Guess, Inc., and others concerning the failure to protect computer-stored customer information with proper information security safeguards, including incident response protocols.

In terms of defined industry best practices, ISO 17799 provides very detailed requirements for incident response, internal investigations, and preservation and analysis of computer evidence consistent with best practices and computer forensics protocols.  An enterprise’s overall security framework must, under ISO 17799, include an effective incident response approach “to ensure a quick, effective and orderly response to security incidents.” [x]  An ISO 17799-compliant enterprise should employ the best methods and tools available to respond to breaches or suspected breaches of its information security, and must collect and preserve the resulting evidence in a forensically sound manner for investigation and reporting purposes. [xi]

The leading international financial standards-setting institution, the Basel Committee on Banking Supervision (the “Basel Committee”) has promulgated important new standards for electronic banking. [xii] In a report entitled “Risk Management for Electronic Banking,” the Basel Committee addresses several components of information security, including a strong focus on the necessity of incident response processes. In the report, the Basel Committee establishes that “[e]ffective incident response mechanisms are . . . critical to minimize operational, legal and reputational risks arising from internal and external attacks.” [xiii] As a result, banks should “develop appropriate incident response plans . . . that ensure business continuity, control reputation risk and limit liability associated with disruptions in their e-banking services.” [xiv]

In order to implement this Risk Management Principle, the Basel Committee highlighted eight specific actions that should be undertaken by banks, including the following four functions or capabilities that banks should develop:

• Incident response plans to address recovery of e-banking systems and services under various scenarios, business and geographic locations . . .
  
  

• Mechanisms to identify [a] crisis as soon as it occurs, assess its materiality, and control the reputation risk associated with any disruption in service.
  
  

• Incident response teams with the authority to act in an emergency and sufficiently trained in analyzing incident detection/response systems and interpreting the significance of related output.
  
  

• A process for collecting and preserving forensic evidence to facilitate appropriate post-mortem reviews of any e-banking incidents as well as to assist in the prosecution of attackers. 

Thus, a key factor for banks is to be able to quickly and thoroughly respond to security incidents.  In order to manage risks adequately, banks must have contingency plans in place to address incidents as they occur, and those plans “should set out a process for restoring or replacing e-banking processing capabilities, reconstructing supporting transaction information, and include measures to be taken to resume availability of critical e-banking systems and applications in the event of a business disruption.” [xv]

Under these compelling regulations and defined best practices, organizations must employ the best methods and tools available to respond to breaches or suspected breaches of its information security, and must collect and preserve the resulting evidence in a forensically sound manner. For incident response, “best practices” is embodied by network-enabled incident response and computer forensics systems for computer security incidents that occur throughout an organization’s network.

Conversely, the “patch and proceed” methodology is not compliant with these regulations and standards for two reasons. First, with the growing standardization of network-enabled computer forensics tools, “patch and proceed” is simply no longer consistent with best practice. Secondly, without the proper response, collection and preservation of evidence, the internal and regulatory incident reporting requirements under these regulations and standards cannot be met.

The Defense and Prosecution of Claims Require Preservation of Evidence

In addition to information security regulatory requirements, enterprises face an increasing risk of various cyber liability claims stemming from such security breaches as theft of customer privacy data, denial of service attacks that are launched from a company’s compromised systems, misappropriation of intellectual property, insider financial fraud, and the destruction of computer data. These legal claims take many forms, including government enforcement actions, class action suits from customers, shareholder suits (for lack of internal controls to investigate and stem insider fraud), and other claims.

Under a new California law, effective July 1, 2003, companies that conduct business in California (a broad standard) must disclose computer security breaches to any California resident if their unencrypted computer stored privacy data is compromised by a hacker or rogue insider in the course of that breach. A similar federal law is under consideration. Organizations that fail to properly respond to a myriad of potential liability-causing incidents will find themselves unable to defend their interests in court, subjecting the enterprise to significant legal exposure.

More than just being able to defend its interests, companies are increasingly seeking to prosecute perpetrators, particularly in cases of industrial espionage, financial fraud, and theft of intellectual property and trade secrets. However, a company may not be able to prosecute or obtain a civil injunction against an employee who leaves the company with source code or the customer list if the digital evidence trail is not properly collected and preserved. Courts mandate that computer evidence be collected and handled in a manner consistent with best practices. [xvi]  Additionally, claims under cyber-insurance policies, which are growing increasingly popular, often require proper incident handling and preservation of evidence (usually under the provisions of ISO 17799).

Visit the Authors Web Site