IT Security Incident Response for Nonprofits

7. A security incident is the act of violating an explicit or implied security policy according to NIST Special Publication 800-61. Of course, this definition relies on the existence of a security policy that, while generally understood, varies among organizations. Security incidents include but are not limited to: • attempts (either failed or successful) to gain unauthorized access to a system or its data • unwanted disruption or denial of service • the unauthorized use of a system for the processing or storage of data • changes to system hardware, firmware, or software characteristics without the owner's knowledge, instruction, or consent

8. Security Incident Unauthorized Access Service Disruption Unauthorized Usage Hidden Changes

9. A security incident involves the unauthorized or unexpected access or use of an organization’s IT systems.

10. Breach Examples • Compromised user account • Malware on a computer • Ransomware on a file system • Forwarding email or files outside of the organization • Unauthorized access to a database • Manipulating / defacing a website

11. Security Environment • Data breach can almost be assumed • Higher expectation of privacy & security from stakeholders • Increasing compliance requirements • GDPR • HIPAA • PCI

12.

13.

14. Security Background

15. Security Focus Cycle INCIDENT SecurityFocus Make the pain go away! Can we avoid it again? Return to status quo

16. Security Focus Cycle INCIDENT SecurityFocus Make the pain go away! Can we avoid it again? Return to status quo

17. Written & Updated Policies Predictive Intelligence Security Training & Awareness Passwords Antivirus Backups Patching Encryption Good Security PracticesSecurity Readiness

18. Building Security Readiness Policy Training Tools Encryption, AI

19. Often overlooked… Written & Updated Policies

20. Why the need for an Incident Response Policy? Provides for a systematic response, so that the appropriate actions are taken. Moves away from knee-jerk reactions to deliberate response.

21. Incident Response Policy • Define stakeholders • Classify your risk • Identify response steps • Understand reporting requirements • Incorporate lessons learned

22. Incident Response • Stakeholders (at Community IT) • Client Communication • Technical Lead • Stakeholders (Your Organization) • Primary Contact • Legal Counsel • Business System Owner • Board • Compliance Officer

23. Incident Response • Risk • Risk to operations / productivity • Risk to privacy • Compliance

24. • Response • Notify the client • Stop the infection • Remediate the infection • Understand infection vector • Exhaustively investigate related systems and accounts Incident Response

25. Incident Response • Reporting • Driven by organization compliance and policies • Potentially handled by legal counsel

26. Incident Response • Incorporate Lessons Learned • Update systems inventory • Implement MFA policy • Edit incident response policy

27. Action Steps Talk Talk to your IT partners Understand Understand compliance requirements Review Review incident response templates

28. Resources • Thycotic Template: https://thycotic.com/solutions/free-it- tools/free-privileged-account-incident- response-policy-template/ • SANS: https://www.sans.org/security- resources/policies • NIST: https://nvlpubs.nist.gov/nistpubs/SpecialPubli cations/NIST.SP.800-61r2.pdf • Digital Security Training - https://techsoup.course.tc/catalog/track/digit al-security

29. Upcoming Webinar Selecting Nonprofit Software: Technology Comes Last Wednesday November 14 4:00 – 5:00 PM EST

IT Security Incident Response for Nonprofits

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à IT Security Incident Response for Nonprofits

Similaire à IT Security Incident Response for Nonprofits (20)

Plus de Community IT Innovators

Plus de Community IT Innovators (20)

Dernier

Dernier (20)

IT Security Incident Response for Nonprofits