Attachment J.20. - Peace Corps IT Incident Response Plan.pdf

Information Technology Security Program

Incident Response Plan (IR) CIO-SEC-PLN-05, v3.1

This document is approved for distribution. Policies, procedures and standards, herein, are effective at the date of signature until explicitly superseded or rescinded.

Digital Signature Chief Information Security Officer

This page is intentionally blank.

1. Introduction

1.1. Purpose and Objective

1.2. Authorities

1.3. Scope

1.4. Assumptions and Constraints

1.5. List of Terms and Acronyms

2. Model and Strategy

2.1. Relationships and Dependencies

3. Roles and Responsibilities

3.1. Users and Service Providers

3.2. OCIO Service Desk

3.3. IT Specialist (ITS)

3.4. Cybersecurity Incident Response Coordinator

3.5. Security Incident Response Team (SIRT)

3.6. Security Incident Event Management (SIEM) Security Analyst

3.7. Information System Security Officer (ISSO)

3.8. Senior Agency Official for Privacy

3.9. Chief Information Officer (CIO)

3.10. Chief Information Security Officer (CISO)

3.11. Swimlane Flowchart

4. Training

5. Testing

6. Communications

7. Incident Handling

7.1. Incident Management

7.2. Preparation

7.3. Detection and Analysis

7.4. Information Security Incident Reporting

7.5. IT Security Investigates and Tracks the Incident

7.6. Containment

7.7. Eradication

7.8. Recovery

8. Post-Incident Activity

8.1. Incident Response Reporting

8.2. Lessons Learned

8.3. Metrics and Program Analysis

9. Incident Response Assistance

10. Peace Corps Record Retention

10.1. General Records Schedule 3.2: Information Systems Security Records

Appendix A: Incident Response Call Lists

Appendix B: Determining Criticality and Sensitivity

Appendix C: Example Scenarios

Scenario # 1: SQL Injection

Scenario #2: Peer-to-Peer File Sharing

Scenario #3: Unknown Wireless Access Point

Scenario #4: Lost Mobile Device

Scenario #5: Distributed Denial of Service (DDoS)

Scenario #6: Data Exfiltration

Scenario #7: Malware infection

Scenario #9: Phishing

Scenario #10: Man-in-the-Middle

Scenario # 11: Unauthorized Access without Data Breach

Appendix D: Peace Corps Incident Response Report (PC-2049)

Appendix E: Incident Types (Not All Inclusive)

HIPAA Information Disclosure Complaint

Unauthorized Access Incidents

Denial of Service Incidents

Reflector Attacks

Amplifier Attacks

Distributed DoS Attacks

Synfloods

Malicious Code Incidents

Inappropriate Usage Incidents

CISA Incident Reporting System

Appendix F: Lessons Learned Documentation

Appendix G: Chain of Custody Guidance

Peace Corps Incident Response Plan

Document Revision History

Revision Author Description

16.04.27 Carlos Pasquel This is the initial version of this plan based on NIST Special Publication 800-61, DHS National Cyber Incident Response Plan, FISMA CIO Metrics, and the Peace Corps Cybersecurity policies. This plan defines the Peace Corps processes, procedures and required resources for managing and responding to all cybersecurity incidents.

17.05.01 Carlos Pasquel Version is in compliance with new US-CERT guidelines to take effect on April 1, 2017.

18.01.02 Carlos Pasquel Version is updated in accordance with the Notice of Findings delivered by the 2017 OIG audit. And, Lessons Learned from Global OCIO IRP Tabletop Exercise on November 2017.

Updated US-CERT reporting guidelines.

19.01.02 Carlos Pasquel Version is updated in accordance with the Notice of Findings delivered by the 2018 OIG audit. And, New listed timelines for Federal Civilian Executive Branch entities reporting updates to NCCIC.

20.03.25 Carlos Pasquel Version is updated in accordance with the Notice of Finding delivered by the 2019 OIG Audit.

21.02.16 Chang Chung Updated contact information

21.03.28 Michael Terry Reformatted document and updated website links.

Clarified communication with continuity activities.

Updated Track-It! Ticket requirements

1. Introduction The Peace Corps is an independent Federal agency under the Executive Office of the President. The Peace Corps’ mission is to promote world peace and friendship. It provides qualified Volunteers to interested countries in need of trained manpower to foster a better understanding of Americans by the people served, and foster a better understanding of those people served by Americans. The Peace Corps provides assistance at the grassroots level and through cross-cultural exchange. Headquartered in Washington, D.C., it currently has eight (5) Regional Recruiting Offices (RROs) within the United States and over 60 overseas posts serving over sixty (60) countries.

As an executive agency with a global Information Technology (IT) infrastructure, the Peace Corps is required to meet Federal guidelines for securing information and information technologies. The Chief Information Officer (CIO), and the Chief Information Security Officer (CISO) are responsible for agency-wide IT security oversight and compliance.

Incident Response (IR) is an important component of risk management for organizations that store, process and transmit sensitive information over a network. Security-related threats are numerous, diverse, and disruptive to daily operations. New types of security-related incidents occur frequently. In addition, lost data, lost business functionality, and lost time due to investigations, cost organizations valuable resources. Risk-based preventative activities can lower the number of, but not prevent, incidents, even for institutions willing to expend unlimited resources.

IR is a coordinated, cohesive approach to computer security and the agency’s level of preparedness that determines the effectiveness of the IR strategy.

Purpose and Objective In accordance with the Federal Information Security Management Act of 2002 (FISMA), Federal agencies must document activities taken to enforce written policies and prevent, mitigate, detect, and respond to incidents.

FISMA also requires an Incident Response capability for preventing propagation of the incident and restoring computing services.

IR also coordinates actins with the Cybersecurity and Infrastructure Security Agency (CISA), CISA is the Nation’s risk advisor, and works with partners to defend against today’s threats and collaborates to build a more secure and resilient infrastructure for the future.

Thorough careful planning, IR reduces response time, downtime, and overall impact when an incident occurs.

This Incident Response Plan (IRP) incorporates lessons learned from previous incidents to improve and update policy and procedures, and mitigate exploited weaknesses.

This IRP provides a source for the SECURITY INCIDENT RESPONSE TEAM (SIRT) to identify, contain, and recover from IT security incidents, such as ransomware, virus attacks, spyware, unauthorized use, loss or theft of Government Furnished Equipment (GFE) that contains Government Data and/or User PII information, password compromise, data theft, and web site defacement.

Authorities

• Presidential Policy Direction (PPD) 41, United States Cyber Incident Coordination, July 2016.

• United States Computer Emergency Readiness Team (US-CERT) Federal Incident Notification

Guidelines, April 1, 2017.

• Cybersecurity and Infrastructure Security Agency (CISA), legislation elevated the mission of the former National Protection and Programs Directorate (NPPD) within the Department of Homeland Security (DHS), Act of 2018.

• The Federal Information Security Management Act version date of 2014 mends the Federal Information Security Management Act of 2002 (FISMA).

• Federal Information Security Modernization Act of 2014, (FISMA2014 or FISMA Reform) Public Law 113-283, new law in a new subchapter II (44 U.S.C. § 3551). Chapter 35 of title 44, United States Code (U.S.C.).

• Interim Policy Statement IPS 1-17, Information Security Program, Information Security for the Peace Corps information systems, May 9, 2018

• Manual Section MS 511, Personal Property Management Handbook, Procedures to account for Peace Corps property, Updated May 2018.

• Manual Section MS 899, Breach Notification Response Plan. Policies and procedures of the Agency’s Breach Notification Response Plan (Breach Plan), August 1, 2016.

• National Institute of Standards and Technology (NIST) Federal Information Processing Standards Publication (FIPS), Publication (PUB) 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004.

• National Institute of Standards and Technology (NIST), Framework for Improving Critical Infrastructure Cybersecurity Draft Version 1.1, April 16 2018.

• National Institute of Standards and Technology (NIST) Federal Information Processing Standards Publication (FIPS), Publication (PUB) 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-12 Revision 1, An Introduction to Computer Security: The NIST Handbook, June 2017.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems, December 2018.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, December 2014.

January 2015.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53A Revision 4, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, December 2014.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 2, Computer Security Incident Handling Guide, August 2012.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-83 Revision 1, Guide to Malware Incident Prevention and Handling, July 2013.

• National Institute of Standards and Technology (NIST) Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, September 2006.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-100, Information Security Handbook: A Guide for Managers, March 2007.

• NIST Special Publication 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011.

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-184, Guide for Cybersecurity Event Recovery, December 2016.

• Office of Management and Budget (OMB) Circular No. A-130 Revised, Appendix III, Security of Federal Automated Information Resources, November 2000.

• OMB Memorandum M-16-03, Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements, October 2015.

• OMB Memorandum M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government, October, 2015.

• OMB Memorandum M-06-16, Protection of Sensitive Agency Information, June 23, 2006.

• OMB Memorandum M-06-19, Reporting Incidents Involving Personally Identifiable Information and

Incorporating the Cost for Security in Agency Information Technology Investments, July 12, 2006.

• OMB Memorandum M-17-09, Management of Federal High Value Assets, December 2016.

• OMB Memorandum M-17-25, Reporting Guidance for Executive Order on Strengthening the

Cybersecurity of Federal Networks and Critical Infrastructure, May 2017.

Scope This document contains the incident response and reporting process that applies to the Peace Corps systems, information, and environments. This document provides incident response and escalation procedures for the Peace Corps Incident Response program. Particularly, lower-level system components (i.e., individual Peace Corps systems) may be addressed by system specific incident response procedures. During the absence of the system specific incident response procedures, this document will take the place of the system specific incident response procedures and will apply to all Peace Corps personnel.

Assumptions and Constraints.

• Memorandums of Understanding (MOU) or Statements of Work (SOW) have been established between Peace Corps systems and the appropriate supporting help desks.

• This document does not discuss preventive measures, neither the efficacy of specific security and privacy controls.

• This document will continue to be updated annually to remain accurate and useful.

• This document covers the unclassified network only.

• The scope of this document extends to the systems under the direct control of the Peace Corps;

although it discusses interactions with other entities, this document is not applicable to non-Peace Corps controlled data centers, or other facilities.

List of Terms and Acronyms.

The following list defines acronyms and terms used throughout this document.

Acronym Definition AO Administrative Officers ATO Authorization to Operate BRP Business Recovery Plan CD Country Director CDM Continuous Diagnostics and Mitigation CIO Chief Information Officer

Acronym Definition CIRC Cybersecurity Incident Response Coordinator CISA Cybersecurity and Infrastructure Security Agency CISO Chief Information Security Officer COOP Continuity of Operations Plan CR Change Request DHS Department of Homeland Security DMZ Demilitarized Zone DOS Denial of Service DRP Disaster Recovery Plan EA Enterprise Architecture EAP Emergency Action Plan E-mail Electronic mail FIPS Federal Information Processing Standard FISMA Federal Information Security Management Act GFE Government Furnished Equipment GFIRST Government Forum of Incident Response and Security Teams GIRC Global Incident Response Coordinator GSS General Support System HIDS Host Intrusion Detection System ICS Industrial Control Systems IP Internet Protocol IR Incident Response IRC Incident Response Coordinator IRP Incident Response Plan ISP Internet Service Provider ISS International Support & Services ISSO information system security officer IT Information Technology ITS International Technical Support MA Major Applications MAC Media Access Control MBR Master Boot Record MOU Memorandum of Understanding MS Manual Section NIDS Network Intrusion Detection System NIST National Institute of Standards and Technology OGC Office of General Counsel OIG Office of Inspector General OMB Office of Management and Budget PCHQ Peace Corps Headquarters PCII Protected Critical Infrastructure Information PHI Personal Health Information

Acronym Definition PII Personally Identifiable Information POA&M Plan of Action and Milestones POC Points of Contact RA Risk Assessment RIRC Regional Incident Response Coordinator RITS Regional IT Specialists RRO Regional Recruiting Office SA System Administrator SAT Security Assessment Test SIEM Security Incident Event Management (Security Analyst) SIRT Security Incident Response Team SLA Service Level Agreement SME Subject-Matter-Expert SOC Security Operations Center SP Special Publication SSP System Security Plan URL Uniform Resource Locator US-CERT United States Computer Emergency Readiness Team VPN Virtual Private Network

2. Model and Strategy The Peace Corps’ governance structure is based on Federal, DHS, NIST and OMB policy guidance. It provides a policy based process to ensure that the organization has user agreements, rules of behavior, periodic information assurance training and role based training to provide a cybersecurity aware workforce. These items are intended to help reduce the number of security incidents and hold responsible violators who create security incidents.

Incident Response will coordinate efforts with the Peace Corps Security Operations Center (SOC) program also ensures Peace Corps is in compliance with the Federal, DHS, NIST and OMB policy guidance, especially security controls based on latest version NIST SP 800-53, requiring these reportable and auditable activities regarding personnel, annual security training, agreements and role based training. These security controls also drive the level of management, operation, and technical protection to harden against security incidents.

The OMB and NIST policies and procedures drive the incident response plan. Peace Corps recognizes that the response resources are limited and incidents must be triaged based on the severity of elements like:

Functional Impact, Information Impact, and Recoverability, and risk rationale to assign the existing resources efficiently and resolve the incidents promptly.

The IR model uses a centralized approach with an Incident Response Coordinator (IRC) for the gathering of the initial incident information, and the Cybersecurity Incident Response Coordinator (CIRC) designated as the IR Program single point-of-contact for all incidents. International Technical Support (ITS) staff and the OCIO Domestic Service Desk staff play a pivotal role, serving as local IRC’s, by assisting users in the gathering of the initial incident information. The term IT Specialist (ITS) is used interchangeable to refer to both domestic and Overseas IT staff.

The Regional IT specialists (RITS) provide 24 coverage to POSTs. This team of IT Specialists are the liaison between the IT Specialists (ITS) and the CIRC located in headquarters. RITS provide support to the local IT Specialists, assist with the containment and mitigation procedures, and ensure the prompt notification to HQ to meet the CISA time guidelines. For domestic support, the “Manager of domestic support services” has designated a liaison for the domestic Helpdesk that meets the same standards as RITS performs at POSTs.

The CIRC acts as the agency’s clearinghouse for incident response handling, response and communications activities. The CIRC responsible for incident handling, reporting incidents to CISA/US-CERT, coordinating actions with the Incident Response Team(s) (SIRT), and reporting to the agency. The CIRC establishes an ad hoc SIRT of Subject-Matter- Experts (SME’s), IRCs and business office POCs. SIRT members report to the CIRC for the duration of the incident. Team members vary depending on the nature, scope, and complexity of the incident. Specifically, the CIRC is responsible for reporting and provides status updates to the CIO and the CISO.

Relationships and Dependencies.

• Business Continuity – Incidents may result in the degradation, corruption or destruction of information systems. This plan communicates incidents to ISSO’s to trigger continuity plans like information system contingency plans and disaster recovery activities.

• Human Resources - Counseling or disciplinary actions may be necessary for employees involved in the incident.

• Senior Accountable Official for Privacy - Provides guidance to Peace Corps personnel regarding matters involving PII, and ePHI for both cyber and paper breaches.

• IT Security - IT security personnel are usually the first to identify and respond to events and must include a CIRC to ensure planning, coordination and lessons learned are up to date.

• Production Operations and Infrastructure - The IT support group is often consulted and used to support the SIRT, as they are technically adept and knowledgeable of systems, networks, and daily operations.

• General Counsel - The impact of the incident may result in consultation with legal counsel regarding prosecution of the perpetrators and steps to minimize liabilities resulting from the incident.

• Executive Management - Leaders provide guidance, budget approval, and resources necessary to implement, and perform Incident Response.

• Safety and Security - Access to buildings and computer spaces involve physical security managers; in addition, some incidents begin or are executed via physical access to computer systems. Coordination is vital for a prompt, effective response and investigation.

• Communications - Public affairs or media relations may be consulted and informed during the response, eradication and restoration of services.

• Cyber Security Expert Support - The CISO maintains the authority to involve any third party forensics expert, while the CIRC provides oversight of evidence collection as needed.

Information systems-focused plan that may activate an Information System Contingency Plan (ISCP) or Disaster Recovery Plan (DRP) depending on the extent of the attack.

• Information System Contingency Plan (ISCP) – Provides procedures and capabilities for recovering an information system. The plan scope addresses single information system recovery at the current, or if appropriate alternate location.

• Disaster Recovery Plan (DRP) – Strategy that employs duplicate data set in order to allow quick resumption of business operations after a disaster. Plan is activated after major system disruptions with long-term effects.

3. Roles and Responsibilities.

Users and Service Providers

• Immediately report suspected incidents Service Desk, ITS, and/or IT Security

• Provide details of incident (Sensitive PII, medical, and financial should not be included.)

• Provide documentation associated with the incident (e.g. Police report)

• For data breach incidents, gather evidence as requested in the Evidence Package for delivery to

CIRC only.

OCIO Service Desk

• Opens a Track-It! ticket and assign to the “Cyber Security” queue and notify CIRC. Requests RITS for containment and mitigation assistance.

• Assists End User with the completion of “Section I” of the Incident Security Response Report form

PC-2049.

• Sends email escalation/notification per the established procedure.

• Provides technical assistance during an incident as required.

• Establishes and implements tools and processes that supports the Peace Corps Service desk policies and procedures to ensure containment, mitigation and timely reporting of security incidents.

• Overseas IT Specialists contact RITS(s) and requests assistance, escalates and/or notifies incidents for better detection and analysis of the event.

• IT Specialist (Domestic and/or Overseas) becomes the Incident Response Coordinator (IRC).

IT Specialist (ITS)

• Collects, and reports artifacts related to the incident.

• Communicates and reports to CIRC as required.

• Coordinate efforts with the SIRT when required, tracks the status of the incident and provides updates through incident reports until reporting is satisfactory.

• Documents and preserves (with sufficient details the audit trail) the actions taken to investigate an event or incident.

• Documents post-level incident activities and lessons learned.

• Post ITS serves as the local Incident Response Coordinator

• Inform and escalates incidents to RITS, CIRC and management at POST

Cybersecurity Incident Response Coordinator (CIRC)

• Serve as the Global Cybersecurity Incident Response Coordinator.

• Manage the overall Incident Response Program.

• Evaluate past events and incidents for trends and patterns.

• Monitor Cyber Security ticket queue and respond to potential incidents.

• Assess reported incidents and determine the appropriate course of action.

• Notify to CISA/US-CERT reportable incidents including the Impact Category Descriptions and associated severity levels (based on elements: Functional Impact, Information Impact, and Recoverability) and risk rationale.

• Coordinate with IT Security Training Manager regarding cyber security education matters.

• For major Incidents:

• Assemble the ad-hoc SIRT, identifying technical expertise needed based on initial reports and systems impacted.

• Communicate with the Service Desk (Domestic and/or Overseas) to monitor (detection and analysis of) the incident and associated impacts.

• Notify to CISA/US-CERT including the Impact Category Descriptions and associated severity levels (based on elements: Functional Impact, Information Impact, and Recoverability) and risk rationale.

• Communicate with business POCs, ISSOs, and system owners based on the nature, location or severity of the incident.

• Track the status of the incident (containment, eradication, recovery) through incident reports until resolution.

• Keep the CIO and the CISO informed of the incident status. Frequency is determined by the severity and criticality of incident.

• Update status as required to CISA/US-CERT.

• Facilitate actions and notifications with Management, OGC and OIG as needed.

Security Incident Response Team (SIRT)

• Is organized for the Containment, Investigation, Eradication, and Recovery of an incident. SIRT is assembled when additional response resources are required in response to an incident.

• SIRT is called up by the CIRC in coordination with the CISO and CIO.

• Perform incident evaluation, handling, and recovery operations.

• Act as the primary resource providing subject matter support through the incident handling stages.

• Establish and implement tools and processes supporting the Peace Corps and/or CISA/US-CERT policies and procedures to ensure timely triaging and reporting of security incidents.

• Serve as the 1st tier incident response capability at the Peace Corps level.

Security Incident Event Management (SIEM) Security Analyst During an incident that creates “major” functional and information Impacts, and recoverability; the Peace Corps SIRT serves as the first tier in handling incidents occurring within Peace Corps system boundaries. The Peace Corps SIRT assists the reporting party (for example, system administrator, network administrator, or user) during the incident handling process. In instances of systems and environments hosted by other agencies or organizations, it is possible that the helpdesk and the Peace Corps SIRT will need to interact with the other agency help desks or Security Operations Centers (SOCs) (e.g., Department of State Help Desk).

• Examine and report Incident Cases indicated by SIEM system.

• Provide SME support in triaging the reported security incidents.

• When called upon serve as the security support of SIRT.

Information System Security Officer (ISSO)

• Provide leadership and guidance on developing the system specific incident response procedures.

• Together with the CIRC/SIRT, determine whether an incident is a reportable incident to CISA/US-CERT.

• Inform Authorizing Official of the incident and assist in development of course-of-action.

Senior Agency Official for Privacy

• Responsible for compliance with Federal Privacy laws at the Peace Corps organizational level.

• Coordinate with the CIRC, General Counsel and the Inspector General Office OIG providing guidance to

Peace Corps personnel regarding matters involving PII and data breach.

• POC for the Data Breach Response Team.

Chief Information Officer (CIO)

• Authorize the SIRT as the 1st tier incident response and the investigative and reporting body.

• Responsible for the Peace Corps Incident Response Program.

• Inform the Peace Corps Director and Risk Executive of the incident.

Chief Information Security Officer (CISO)

• Authorize the SIRT as the 1st tier incident response and the investigative and reporting body.

• Responsible for the Peace Corps Incident Response Program.

• Enforce the Federal incident handling processes and procedures in compliance with applicable FISMA, OMB, and DHS guidelines.

• Ensure that CISA/US-CERT reportable incidents are submitted within reporting time requirement.

• Inform the Peace Corps Director and Risk Executive of the incident.

Swimlane Flowchart

4. Training.

All Peace Corps staff and contractors must receive Security Awareness Training (SAT) upon hire, and pass a refresher course and examination annually thereafter. The security awareness training includes adequate training to recognize a potential incident and instructions for reporting incidents. Real-world examples will be included as part of each session and examination.

The CIO, IT Security, and/or CIRC may identify the need to implement refresher training outside of the routine schedule, if needed to reinforce practices following a security breach.

Additional training sessions will be customized for personnel with incident handling responsibilities. As each role dictates, the training will be structured to provide the knowledge and skills necessary to recognize and manage Incident detection, analysis, forensics, reporting, remediation, and restoration strategies.

CIRC will incorporate lessons learned and any new tools, techniques, staffing resources, and federal mandates into the training sessions to ensure consistent use across the agency.

The CISO is responsible for ensuring proper resource allocation to include budgeting, scheduling and staffing necessary to conduct the requisite training.

5. Testing At least annually, the CIRC plans and conducts Incident Response tabletop activities to verify that the response and training procedures produce the expected outcome. The exercises are scheduled once a year and random participants will, throughout the exercise, validate the processes and procedures of the IR Plan. The test scenarios will be based on incidents most likely to occur and lessons learned from previous exercises.

Incident Response testing:

• Will be focus primarily, but not exclusively, on the capture, containment, and communication processes;

• Frequency may be adjusted based on major changes in systems or the threat environment; and

• May include team-specific and cross-team training exercises, spanning orientation, tabletop, and functional methods.

The CIRC will identify lessons that can be learned from the test results. Where weaknesses were identified, the CIRC will plan and institute modifications to improve the effectiveness of the incident response program.

6. Communications An effective incident response program relies on clear, informative and rapid communication. This begins with initial reporting and continues through resolution and program analysis. In addition to reporting staff and members of the immediate security team, the CIRC is likely to also engage with individuals responsible for other related agency plans, such as Breach Response, Disaster Recovery, Continuity of Operations Plan (COOP), Emergency Action Plan (EAP), and Information System Contingency Plans. The clarity and timeliness of those communications provides Peace Corps offices with the best possible opportunity to avoid outages and begin recovery as quickly as possible. Notification and activities related to resolving incidents are also dependent upon the effective communication of essential tasks. Additional contact responsibilities for each role are included in the Section 3, Roles and Responsibilities, as well as in processes identified in this document.

In situations when the Incident requires escalation outside of the agency, other than to the United States Computer Emergency Readiness Team (US-CERT), the US-CERT Government Forum of Incident Response and Security Teams (GFIRST) CISO will initiate an external communication plan as needed. No one in the agency, including the SIRT members, should communicate with members of the press or law enforcement agencies without prior coordination through the CISO with the Peace Corps General Counsel and/or Communications Division.

7. Incident Handling.

NIST SP 800-61 separates IR activities into five phases: Preparation, Detection and Analysis, Containment, Eradication, and Recovery. IR activities may occur independently or in combination with other phases. These activities work well for most technical incidents, but may require adapting to address a HIPAA privacy incident, PII incident, or an information disclosure complaint.

Incidents are recorded and tracked in the Peace Corps Track-It! ticketing system. Each incident is assigned a Service Ticket, with its respective Incident Ticket Number. The Track-It! Ticket will contain all general details, status, Police report (when the incident compels), and the PC-2049 form as attachments (if required).

When reporting and incident, user(s) and IT specialists should not include PII and/or ePHI data in the Track-It!

System, nor in the PC-2049 form. This guidance is provided with the purpose to contain further data spillage and/or leakage. If such information, artifacts and evidence need to be provided, send them by email to CIRC only, and the information will be handled accordingly.

The use of the form PC-2049 to report the loss of Government furnished equipment (GFE) is used to report the loss of GFE devices that include computers (servers, laptops, desktops, surface), Tablets, Smartphones, Satellite phones, external Drives that contain Agency data (with PII and/or ePHI), and (currently) RSA Tokens.

And, one PC-2049 should be used to report of the loss of a single GFE device. The IRC (local IT Specialist domestic and overseas) reports the incident using the Information Security Incident Response Report (PC2049), which is attached to the Service Ticket record in Track-It!. IRC assists the user, who reports the event, to complete Section I of the PC-2049 form.

RITS assist the respective ITS at POST with containment and mitigation actions. Based on the evidence, RITS (domestic and overseas) can assist to complete sections: II Incident Containment, III Investigation/Conclusion, and IV Resolution of the PC-2049 form, this assistance to complete the PC-2049 is not mandatory.

The CIRC updates PC-2049, reviews the previous sections to ensure completeness, and proceeds with section IV Resolution, and section V Reporting. If closure is satisfactory, the form is signed. If required, CIRC will assemble the ad-hoc SIRT, identifying technical expertise needed based on initial reports and systems impacted. CIRC will notify to CISA/US-CERT and will provide Impact Category Descriptions and associated severity levels (based on elements: Functional Impact, Information Impact, and Recoverability) and risk rationale within one hour of the Incident being identified by the CIRC or SCIRT team. Where risk to the confidentiality, integrity or availability of an information system or its data are at risk, the Information System Security Officer (ISSO) will be notified of the incident for awareness and, if necessary, contingency plan activation. In addition to the aforementioned communications, the CIRC facilitates actions and notifications with Management (CISO, AO), OGC and OIG as necessary.

PII paper breaches are not reportable to CISA/US-CERT unless it includes digital data. And, per MS-899, all paper breaches must be handled internally.

When transferring physical evidence to other offices or agencies as part of the investigation, the CIRC must record and track transfers using Form PC-2125, the Incident Investigation Chain of Custody Form; and attach PC-2125 to the service ticket.

As part of incident closure, CIRC briefly documents the resolution in the report and closes the service ticket.

Incident Management.

This Incident Response Plan includes the agency’s standard operating procedures for computer security Incident Response, vulnerability analysis to mitigate weaknesses, and the restoration of Peace Corps IT

Incident Response – Data Breach Process

Us er

IT

S pe ci al is/

In ci de nt

Re sp on se C oo rd in at or

RI

TS

(o ve rs ea

s) o r Su pe rv iso r ( do m es tic

In ci de nt R es po ns e

Co or di na to r

CI

RC

(H ea dq ua rt er s)

Incident Suspected Call Helpdesk

Email Cyber Incident

Response

Call

SOC

Gather Evidence Package Form PC-2049 Section I Original Emails Recipients POC Reply/confirmation Send to CIRC

No No

Opens Helpdesk Ticket Request user to provide CIRC original messages

Yes Yes Yes

Evidence Package DO NOT include sensitive information in ticket!

Escalate

Assists IT Specialist Procedures:

• Containment

• Mitigation

Ensures the provision of:

• Forms

• Report to CISA

• Original Messages

Escalation

• Validates Evidence Package

• Makes additional contact, if required

Notify:

• CISA within ONE hour

• System Owner, ISSO

• Breach Response Team

Assembles ad-hoc

CSIRT

(when required) Close Incident Ticket systems. The plan establishes the following guiding principles for latest or new trends of reported incidents.

The agency’s IR strategy addresses the following:

• Identifies procedures for performing incident handling and reporting,

• Lists the requirements for reporting incidents,

• Identifies staff and SIRT training requirements,

• Identifies appropriate structure and staffing models for the Incident Response Team,

• Defines the roles and responsibilities of SIRT members,

• Establishes communication and cooperation guidelines between the SIRT and other internal groups (i.e., GC and IG), and

• Establishes communications and cooperation between the SIRT and external groups (e.g., CISA/USCERT, GFIRST, and law enforcement agencies).

1. For each incident, the Cybersecurity Incident Response Coordinator (CIRC) will serve as the single point-ofcontact unless otherwise assigned. The CIRC is responsible for ensuring that the required incident reporting, including reports to CISA/US-CERT, are prepared and submitted. CIRC also facilitates actions and notifications with Management, OGC and OIG as necessary.

The IRC is responsible for the triage of the incident prioritization by following stablished guidelines, and by providing an effective and timely escalation response to cyber events or incidents.

2. CIRC, SIRT and other individuals will implement the incident prioritization guidelines to provide effective and timely response to cyber events or incidents.

3. The CIRC must ensure that CISA/US-CERT Reporting Timeframes defined on the US-CERT site are met.

4. The CIRC must ensure the Incident Response Plan provides clear criteria for categorizing observable occurrences as events or incidents.

• An event is any observable occurrence in an IT system that may have IT security implications. Events include suspicious or out-of-the-ordinary attempts by a user to connect to a file share, a server receiving an unauthorized request for a Web page, a user sending unauthorized electronic mail (Email), and the firewall blocking a connection attempt.

• An incident is any event that threatens the availability, integrity, and confidentiality of information resources. Incidents are events that could lead to negative consequences, such as IT system crashes, Denial of Service (DOS) attacks, unauthorized use of IT system privileges, defacement of a Web page, and execution of malicious code that compromises or destroys data.

The CIRC must coordinate with the Office of Safety and Security (OSS) to ensure the Incident Response Plan addresses physical IT security events or incidents such as those discovered as part of monitoring physical access to areas with IT systems.

Preparation Preparation is the key to effective Incident Response and prevention. Emphasis on preparation ensures the agency is ready to respond to incidents; nevertheless, the agency has already taken the necessary steps to prevent incidents by securing systems, applications, and networks. Organizations are better prepared to respond to an incident when they:

• Use proactive techniques to prevent incidents;

• Establish a formal Incident Response Team;

• Develop an emergency Communications Plan; and

• Conduct routine education and training for team members.

7.2.1. Proactive Tools and Resources.

Proactive techniques are employed to prevent the occurrence of an incident within an organization. These techniques can reduce, but not eliminate, the possibility that an incident will occur. The following proactive techniques can ultimately reduce an Incident’s impact on the Peace Corps. These proactive techniques are built into the Peace Corps IT operations, provided in the annual security training, and other IT Security awareness activities.

Techniques Description

Anti-virus and Encryption Ensuring all servers, desktops, laptops, and GFE mobile devices have Antivirus capabilities and virus definition are up-to-date.

Encryption ensures that data remains secure.

User Awareness & Training Ensuring all system users are informed of potential impact as a result of a virus, worm, ransomware, and other outbreaks attacks. Training allows users become familiar on how to report suspected incidents to the appropriate office.

Email Client Configuration Ensuring email clients are configured to not automatically open attachments.

Intrusion Detection System (IDS) and Vulnerability Scanning

An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station.

Vulnerability/Patch Management

Implementing an effective method to address known system vulnerabilities.

Detection and Analysis.

An incident can be detrimental to Peace Corps’ daily operations; it could also impact its reputation. In the early stages of an event, the exploited vulnerability may not be known. This could allow a subsequent “copycat” type of attack, and/or an extension of the first event to occur.

Revealing details about the ongoing situation could result in further exploitation of Peace Corps systems or services. Adverse publicity can make the incident more difficult to manage. Finally, what one individual or organization perceives as a “major” problem, might in fact, only be a minor incident (or merely an event).

Therefore, the Detection and Analysis phase of IR is critical to clearly identifying, classifying, and successfully resolving an Incident.

7.3.1. Detection.

Identifying incidents is a challenging task. They often occur due to an accidental configuration, or through deliberate actions of internal or external individuals. Identification requires Peace Corps to understand detection and analysis techniques in order to direct the appropriate response activities. Identification is best accomplished using a combination of methods. These methods for discovering and confirming incidents are classified into three categories: Routine Monitoring, Investigation, and Reported. See table below.

Identification Method Definition Routine Monitoring Routine Monitoring are actions performed regularly; such as, audit log reviews and network resource monitoring. Routine Monitoring methods embody many of the proactive elements of Incident Response.

Investigation This method is used to identify incidents that occur infrequently, or at random.

Examples include investigations of unusual trends or peculiar events, such as excessive attempts to ping the network, or recurrent intrusion detection alerts.

Reported Reported problems may also lead to the detection of incidents. User complaints of slow connectivity, or a denial of service activity that creates an impact to transmit, may uncover an incident. Another example of reported problems and indicative of an incident is workstation issues related to a virus.

Attack Vectors/Sources It is not possible to define and prepare for every type of incident. However, this section lists the common attack vectors that are considered when planning the strategy for detecting and handling incidents. The following high-level set of attach vectors and descriptions from NIST SP 800-61 R2. IR will utilize the following attack vectors taxonomy when reporting cybersecurity incident notifications to CISA/US-CERT.

(Note: This category is no Longer Required since April 1st, 2017. This section is included as a reference).

• Unknown: Cause of attack is unidentified.

Example: This option is acceptable if cause (vector) is unknown upon initial report. The attack vector may be updated in a follow-up report.

• Attrition: An attack that employs brute force methods to compromise, degrade, or destroy systems, networks, or services

Example: Denial of Service intended to impair or deny access to an application; a brute force attack against an authentication mechanism, such as passwords or digital signatures.

• Web: An attack executed from a website or web-based application.

Example: Cross-site scripting attack used to steal credentials, or a redirect to a site that exploits a browser vulnerability and installs malware.

• Email/Phishing: An attack executed via an email message or attachment

Example: Exploit code disguised as an attached document, or a link to a malicious website in the body of an email message.

• External/Removable Media: An attack executed from removable media or a peripheral device

Example: Malicious code spreading onto a system from an infected flash drive.

• Impersonation/Spoofing: An attack involving replacement of legitimate content/services with a malicious substitute.

Example: Spoofing, man in the middle attacks, rogue wireless access points, and structured query language injection attacks all involve impersonation.

• Improper Usage: Any incident resulting from violation of an organization’s acceptable usage policies by an authorized user, excluding the above categories.

Example: User installs file-sharing software, leading to the loss of sensitive data; or a user performs illegal activities on a system.

• Loss or Theft of Equipment: The loss or theft of a computing device or media used by the organization.

Example: A misplaced laptop or mobile device.

• Other: An attack that does not fit into any of the other categories.

Signs of an Incident The most challenging part of the IR process is accurately detecting and assessing incidents. This includes conclusively determining whether an incident has occurred. If an event is deemed an incident, a combination of three factors - type, extent, and magnitude - are used to assess the event.

• Incident types are generally determined and classified by the level of detail available to local IT staff. Manual detection of an incident includes the reporting of a privacy complaint or a vague operational complaint from one or more users. Another level of detail includes automated network-based and host-based sensors, antivirus software, and log analyzers. The volume of incident signs is typically high when using an automated detection system. For example, it is not uncommon for an organization to receive thousands or even millions of intrusion detection sensor alerts per day.

• The extent of an incident generally relates to the number of users, workstations, servers, networks, sites, and/or business services impacted by an incident.

• The magnitude and extent of an incident also may be discovered by manual or automated means.

Proper and efficient analysis of incident-related data normally requires deep, specialized technical knowledge and extensive experience.

Precursor and Indication Signs

Signs of an incident fall into one of two categories: precursors and indications. A precursor is a sign that an incident may occur in the future. An indication is a sign that an incident may have occurred or may be occurring now.

The SIRT evaluates incidents and potential instances using the following types of information:

• Network intrusion detection sensor alerts,

• Antivirus software alerts,

• User complaints,

• Discovery of unusual files,

• A spike in service desk tickets,

• Unusual events recorded in audit logs,

• Unusual deviation from typical network traffic flows, and

• Unexplained loss of functionality distributed in unusual patterns or numbers.

Precursor and indication incident signs are derived from a variety of sources within the IT infrastructure.

Commonly, the sources consist of security software alerts, audit logs, outside sources (ex.: www.cert.org), and people internal and external to the IT department. While received independently, they are used in combination to identify and detect a true incident. The Peace Corps also employs a third party monitoring contractor to ensure independent assessment of any precursor information at headquarters.

Peace Corps systems evaluate the sources of precursors and indications mentioned in the following table, as part of the incident detection and analysis process.

Source Description Network Based IDS (Smart Defense)

IDS products identify suspicious events and record pertinent data, including the detection date and time, type of attack, source and destination IP addresses, and username(s) (if applicable and known). Peace Corps systems currently use a Security Incident and Event Management (SIEM) tool. All alerts from the SIEM are evaluated by the SOC to ensure validity. This prevents the CIRC/SIRT from responding to a false positive.

Antivirus Software Antivirus products are effective at detecting, eradicating, or isolating malicious code - provided their signatures are current. Commercial Off The Shelf (COTS) products typically send alerts to the affected host and a centralized antivirus console (when configured). The CIRC/SIRT evaluates the antivirus software console as needed. All antivirus alerts reported by users are evaluated by the SOC to determine the type and extent of the infection.

Operating System and Application Logs

Logs from operating systems, services, and applications (particularly audit-related data) are frequently of great value when an incident occurs. Logs provide a wealth of information, such as which accounts were accessed and what actions were performed. These logs are used by the CIRC/SIRT to gather incident documentation and determine appropriate response and recovery activities.

IT Specialists, as IRCs, may review the logs, report the analysis to the Service Desk, and escalate the incident as appropriate.

Network Device Logs Logs from network devices such as firewalls and routers are also valuable in identifying trends (e.g., a significantly increased number of attempts to access a particular port) and correlating events detected by other devices.

The SIRT reviews these logs in conjunction with other signs and evaluates if a true incident occurred and, if so, the scope of the incident.

IT Specialists at posts may review the network device logs and report the information to the ITS Desk and the CIRC, as appropriate.

CISA/US-CERT

Coordination Center

Keeping up with new vulnerabilities and exploits can prevent some incidents from occurring and assist in the detection and analysis of new attacks.

Organizations, such as the CISA/US-CERT Coordination Center periodically provide threat updates with information through briefings, web postings, and mailing lists. The CIRC/SIRT uses readily available security information from the US-CERT Coordination Center to prepare and detect potential incidents.

http://www.us-cert.gov.

Peace Corps Personnel Users, system administrators, network administrators, security staff, and others from within the organization (and some external partner/vendors) may report signs of…