All CISA Advisories, EN

CISA Shares Lessons Learned from an Incident Response Engagement

Advisory at a Glance

Executive Summary CISA began incident response efforts at a U.S. federal civilian executive branch (FCEB) agency following the detection of potential malicious activity identified through security alerts generated by the agency’s endpoint detection and response (EDR) tool. CISA identified three lessons learned from the engagement that illuminate how to effectively mitigate risk, prepare for, and respond to incidents: vulnerabilities were not promptly remediated, the agency did not test or exercise their incident response plan (IRP), and EDR alerts were not continuously reviewed.
Key Actions
  • Prevent compromise by prioritizing the patching of critical vulnerabilities in public-facing systems and known exploited vulnerabilities.
  • Prepare for incidents by maintaining, practicing, and updating incident response plans.
  • Prepare for incidents by implementing comprehensive and verbose logging and aggregate logs in a centralized out-of-band location.
Indicators of Compromise 

For a downloadable copy of indicators of compromise, see: 
Intended Audience

Organizations: FCEB agencies and critical infrastructure organizations.

Roles: Defensive Cybersecurity Analysts, Vulnerability Analysts, Security Systems Managers, Systems Security Analysts, and This article has been indexed from All CISA Advisories