1

Incident Response: Is Your Incident Response Plan in Place? Does it work? Everyone knows that sound. The extremely loud siren that goes off every time someone burns a bag of popcorn in the break room. Either that or a well timed fire drill right when you start an important conference call. These annoying events are, however, quite necessary to ensure that we are all prepared for a true emergency. Do you have an established incident response plan in place? Is it a well-documented, accessible plan that all IT staff have read and understand? After a breach occurs, mayhem will soon set in and only a well-prepared team will be able to mitigate the damage in short order. Neo was recently installed on a 350 bed healthcare facility with only the top executives having knowledge of the deployment. Neo’s job is to scour all connected network devices to test for the latest vulnerabilities. Neo probes for weaknesses and tests all devices to ensure they are up to date with the latest firmware, locked down against the latest vulnerabilities and to make sure passwords are not easily broken. Almost immediately upon deployment, the IT staff reported there was a rogue device somewhere in the facility attempting to access different points within the network. The team worked quickly and efficiently moving room by room until they finally located Neo working away in the office with the two senior executives. Neo was briefly disabled and the threat level was brought back down to normal. In this case, Neo provided the equivalent of a fire drill on the facility’s network and the facility was able to document the effectiveness of its incident response procedure. At that point, Neo was assigned proper credentials and put back into service. Neo’s findings from its full scan can be found in the whitepaper titled Neo Medical Checkup – Hospital . Once re-deployed Neo was able to penetrate the system’s network security device. This was a critical discovery and the facility was able to quickly address the situation and secure the vulnerability. How does one know if their emergency plans and procedures will actually work in times of crisis without going through a simulation? If you don’t have a plan in place, the time is now. If you have a plan, testing it is equally important. Neo is a daily-automated ethical penetration-testing device that goes beyond typical network security devices and what third party security firms offer, for a fraction of the cost. Neo performs security tests of a network daily, helping ensure the highest level of security possible. Justin Farmer, CEO April 13, 2015 GIAC ISO 27001, CEH, CHFI, CDRP, CWSP, Network+