Hacks happen. Security Module can help agencies navigate crisis response

The department secretary is calling your direct line. The Inspector General's office is coming by for a visit. Your CIO and CFO are returning early from a business trip to deal with the problem. And media coverage of the security breach at your agency has led to a call center flooded with complaints as members of the public worry that they may be at risk.

It's a pretty grim security nightmare. And there's no silver bullet to make a problem like that go away. There is however, a path out of the darkness.

The Co3 Security Module from Co3 Systems lets users define the security problem, and then takes them step by step through all the technical, legal, financial and agency-specific steps to best deal with the aftermath of the crisis. It's not a port in the storm, but more like a compass in the tempest. It could serve as an effective way to implement response procedures agencies have in place.

We were able to test the Security Module as both a user and an administrator. The program sells for $50,000 for three seats.

First, while GCN has reviewed countless programs that help create security walls, or help plug holes once a breach has happened, or even make a honey pot to try and catch would-be thieves, we've never found a program that tells users what to do in worst-case scenarios. The Security Module shows users exactly who to contact, and in what order, based specifically on the security problem, the data involved and the agency in question.

Second, the module can be accessed (with a password) by anyone with a Web browser. The result is that everyone at an agency, or at least those designated to do so, can become part of the security landscape. No longer will security be "IT's problem."

Instead, if users “see something” suspicious, they can “say something” by logging into the system and reporting as much about the event as they know. Perhaps a computer is running slow or files appear to be missing. One slow computer might not mean much, but if multiple users report the same problem, it could be evidence of an attack. The individual users may not have to take any action other than reporting the problem, as staff  downstream can be assigned to tasks based on the severity and type of incident. Users can  become a part of the solution, adding thousands of eyes to watch the electronic waterfront.

The software itself is part database and part expert system. Users reporting a problem are asked straightforward questions. For example, a user reporting a stolen laptop is asked drill-down questions designed to ascertain the scope of the problem. Once that form is filled out, one click sends it to the responsible person or to a group of people at the agency. A dashboard tracks all the incidents as they move through the system so staff can see what events are still being worked on and which ones have been resolved.

In the administrative section, IT managers assign the various incidents to different groups. Slow computers or a possible denial of service attack may be solely assigned to the IT department, for example, while a stolen laptop report might also go to investigators or security. Assignments can be made depending on the type of data that's gone missing, or the type of attack an agency is experiencing.

The security module is packed with best practices and legal requirements. For example, in one nightmare scenario we reported, the agency was advised that it was required to "Notify US-CERT within one hour of discovery/detection of any incident involving personally identifiable information even if only limited information about the breach is available. Updates should be provided as further information is obtained." The system also provided the contact information for the Homeland Security Department.

Beyond the standard and legal requirements, individual agencies can add their own specific procedures to the base system.

The Security Module also points out tasks that might be overlooked. For example, if negative media reports might be generated based on the incident, it reminds users to check websites and blogs and to contact the local news agencies to try and get ahead of the story.

Based on our testing, we feel that the Co3 Security Module is not only useful, but could become an invaluable weapon when responding to security incidents. Federal agencies have guidance the National Institute of Standards and Technology on responding to attacks, in Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide." Having a system that is ready to lead agencies through the response could improve the speed and efficiency of that response.

Not only does the Security Module create dashboards of incident response data for managers, but empowers users to help maintain good and safe practices. Knowing what to do can be half the battle, and if someone else has navigated the stormy seas of a crisis, there is no reason why agencies can't follow along and make their journey a bit smoother.