Domain ใดที่รับผิดชอบ Incident Response? (CISSP / NIST Framework)
ในกรอบงานมาตรฐาน สองกรอบหลักระบุ Domain ที่เกี่ยวข้องกับการตอบสนองเหตุการณ์ (Incident Response - IR):
1. CISSP CBK (Common Body of Knowledge) - 8 Domains
Domain 7: Security Operations (Security Operations) ครอบคลุม Incident Response โดยตรง
- 7.1: Understand and support investigations
- 7.2: Understand requirements for investigation types (Administrative, Criminal, Civil, Regulatory)
- 7.3: Conduct logging and monitoring activities
- 7.4: Securely provisioning resources (related)
- 7.5: Understand and apply foundational security operations concepts (Need-to-know, Least Privilege, Separation of Duties)
- 7.6: Understand and apply resource protection techniques (Media, Hardware, Facilities)
- 7.7: Conduct incident management (Detection, Response, Mitigation, Reporting, Recovery)
- 7.8: Operate and maintain detective and preventative measures
- 7.9: Implement and manage patch and vulnerability management
- 7.10: Understand and participate in change management processes
2. NIST Cybersecurity Framework (CSF 2.0) - 6 Functions
Function: RESPOND (RS) - การตอบสนองต่อเหตุการณ์ความปลอดภัย
- RS.MA (Incident Management): การจัดการเหตุการณ์
- RS.AN (Incident Analysis): การวิเคราะห์เหตุการณ์
- RS.MI (Incident Mitigation): การลดทอนผลกระทบ
- RS.CO (Incident Reporting & Communication): การรายงานและสื่อสาร
- RS.RC (Incident Recovery): การกู้คืน
Function: RECOVER (RC) - การกู้คืนหลังเหตุการณ์
- RC.RP (Recovery Planning), RC.CO (Recovery Communications)
3. NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide
มาตรฐานเฉพาะสำหรับ Incident Response Lifecycle (4 Phases):
- Preparation: Policy, Plan, Team, Tools, Training, Playbooks
- Detection & Analysis: Monitoring, Alerting, Triage, Validation, Prioritization
- Containment, Eradication & Recovery: Short/Long-term Containment, Evidence Preservation, Malware Removal, System Restore
- Post-Incident Activity: Lessons Learned, Root Cause Analysis, Report, Improve
Network Security Domain สำหรับ Incident Response (Network-focused)
หากถามเฉพาะ "Network Security Domain" ในบริบท Network Security Architecture:
| Domain/Function | Network Security IR Activities |
|---|---|
| Network Monitoring & Detection | NetFlow/sFlow, NDR (Zeek/Suricata/Corelight), IDS/IPS Alerts, DNS Logs, Proxy Logs, SSL Decrypt |
| Network Forensics | PCAP Analysis, Flow Analysis, Timeline Reconstruction, Attribution, C2 Detection |
| Network Containment | VLAN Quarantine, Port Shutdown, ACL Block, Sinkholing, BGP Blackholing, NAC Quarantine |
| Network Evidence Preservation | Full Packet Capture (PCAP), Log Export (Syslog/NetFlow), Chain of Custody |
| Network Recovery | Config Restore, Route Convergence, Service Validation, Traffic Normalization |
Effective Responses to a Security Breach (5 Steps)
- Assemble Incident Response Team (IRT): Security, Network, Infra, App, Legal, Comms, Management
- Contain: Network Isolation (VLAN/ACL/NAC), Block C2 IPs, Disable Compromised Accounts, Preserve Evidence
- Assess Scope & Severity: What Data? What Systems? Who Affected? Regulatory Impact? (PII, PHI, PCI, IP)
- Notify: Internal (Exec, Legal, PR), External (Regulators, Customers, Law Enforcement, Insurance) - ตาม Law (PDPA 72 hrs, GDPR 72 hrs, SEC 4 days)
- Eradicate, Recover & Improve: Root Cause, Remove Threat, Restore from Clean Backup, Validate, Update Controls, Lessons Learned
Network-specific IR Playbooks (ตัวอย่าง)
- DDoS: Activate Scrubbing (Cloud/On-prem), BGP Flowspec, Rate Limiting, Anycast
- Ransomware: Network Segmentation (Stop Spread), Snapshot/Backup Validation, Decryptor Search, Negotiation Policy
- Data Exfiltration: DLP Alerts, NetFlow Anomaly, Egress Filtering, DNS Tunneling Detection
- Supply Chain / Vendor Breach: Vendor Access Review, API Token Rotation, Third-party Risk Re-assessment
- Insider Threat: UEBA, DLP, Privileged Access Monitoring, Forensic Imaging
Network Security Tools สำหรับ IR
| Category | Tools |
|---|---|
| Packet Capture | Wireshark, tcpdump, Moloch/Arkime, ntopng, Corelight, ExtraHop |
| Flow Analysis | SiLK, nfdump, ElastiFlow, Kentik, Plixer, NetFlow Analyzer |
| NDR | Corelight, Zeek, Suricata, Darktrace, Vectra, ExtraHop |
| Forensics | Volatility (Memory), Autopsy (Disk), NetworkMiner, Xplico |
| SOAR/Automation | Cortex XSOAR, Splunk SOAR, Tines, Shuffle, n8n |
💡 สรุป
CISSP Domain 7: Security Operations และ NIST CSF Function: RESPOND เป็น Domain/Function หลักที่ครอบคลุม Incident Response สำหรับ Network Security โดยเฉพาะ จะเน้นที่ Network Monitoring, Network Forensics, Network Containment, Network Evidence Preservation, Network Recovery ซึ่งต้องการ Network Visibility (NetFlow, PCAP, NDR) และ Network Control (ACL, VLAN, NAC, BGP) ร่วมกับทีม IR ทั่วไป
