Case Study: IR Plan and Prepare

Case Scenario:

You work in your organizations IR team in Europe

An exposed database resides in New Zealand

Your organizations headquarters is in the U.S.

An email has arrived from your friend Francis, from your football league, notifying you that she has discovered information internal to your organization posted on pastebin.com

From: Francis

To: me

Subject: Have you seen this?

Hi,

My buddy forwarded me this as he knows that I know someone (you) from Orange.org.

-----Original Message-----

Hi Francis, Have you seen this? What is going on?

Orange.org Hacked, Defaced & Data Leaked

A hacker l33t3_guy has contacted us with the first large breach of the year

The breach is on another giant this time Orange.org sites have become targets of l33t3_guy.

The attack has left websites defaced and a dump of the servers database has been leaked and uploaded to two mirrors on public file sharing sites. The files have since been removed from depositfiles.com but are still available on www.pastebin.com/xxx at the time of publication.

The leak is a 24mb compressed rar file that contains 4 folders with contents ranging from txt files to sql db dumps and further rar and zip files.

Sample of pastebin.com Contents

file1.txt

ID jmeno email heslo login prijmeni vyrobek rowguid

14 Daniel prentis@kaktus.mx p prentis Prentis B56778DF-8C6E-4E4E-B3AC-09ABF55CCC5F

15 gggg fffff a admin fffffff C3D23D86 . . .

17 f f f f f f 0615821E . . .

16 q q q q q q 85FC2FD6 . . .

20 Jan zich@kaktus.mx disevycpat janzich Zich . . .

Here is the full list of the relevant contacts in your IR departmental contact list.

Internal Contacts:

Legal: Leslie Lu, based in London, U.K.

Public Relation (PR): Patrick Pan, based in Palo Alto, U.S.

Database (DB) contact: Devi Dharma, based in New Zealand

External Contacts:

Media contact: Milli Massimo,The Local Times

Administrator at pastebin.com: Amir Au

Information on exposures:

Daniel Prentis, prentis@kaktus.mx and Jan Zich, zich@kaktus.mx

J. Pavlik, j.pavlik@kaktus.mx

Eduard Ostraa Na, e.macha@kaktus.mx

Global Guide to Breach Notifications: https://www.theworldlawgroup.com/globaldatabreachguide

Now lets begin with how we handle the incident.

Plan and prepare is the first step. This phase is addressed after post-mortem completion and periodically, over time. Answer the following questions.

Short answers are expected. please make your answer within one paragraph (=5>

Q1	What information in the files might be sensitive?
Q2	Who will be involved in the IR process?
Q3	For the IR within your organization, are there any relationships you still need to establish? List your three key organizational relationships.
Q4	For the IR within your organization, what are your three key external relationships?