After an incident there is a moment when everyone just wants things to go back to normal. Servers are restored, passwords are reset, the incident response team goes home and management breathes out. This is exactly the moment when you are the most vulnerable.<\/p>\n
Look at it from the hacker\u00b4s perspective. You found a company that paid. They had weak admin practices, they didn\u00b4t notice you for weeks and when you asked for money they actually paid. In any other business that is called a loyal customer. Any sales person will tell you that it is a lot cheaper to keep an existing customer than to find a new one. Hackers are no different, they just have better margins.<\/p>\n
So why wouldn\u00b4t they come back? They know your environment, they probably know a few of your passwords and there is a good chance that they left a back door or two.<\/p>\n
Restoring to the state before the incident means restoring to the state that got you hacked. This is why the tier model and PAW must be on the list after an incident, not as a nice to have. Separate your Tier 0 accounts from everything else, make sure your domain admins only logon to domain controllers and dedicated admin workstations and never ever let an admin account read mail or browse the internet.<\/p>\n
It is not the cheapest project you will do this year. But it is a lot cheaper than being a returning customer.<\/p>\n","protected":false},"excerpt":{"rendered":"
After an incident there is a moment when everyone just wants things to go back to normal. Servers are restored, passwords are reset, the incident response team goes home and management breathes out. This is exactly the moment when you are the most vulnerable. Look at it from the hacker\u00b4s perspective. You found a company […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[3,13],"tags":[22,33,32,31],"class_list":["post-1037","post","type-post","status-publish","format-standard","hentry","category-computer-forensics","category-technology","tag-credential-theft","tag-incident-response","tag-paw","tag-tier-model"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1037"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1037\/revisions"}],"predecessor-version":[{"id":1041,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1037\/revisions\/1041"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}