Incident Response and the HSE Case Study Flashcards

This flashcard set covers vocabulary related to incident response workflows based on NIST recommendations and details of the 2021 Health Service Executive (HSE) cybersecurity incident.

Event

Any discrete observable thing that happens on a network or a system, such as a login event or a firewall blocking a connection.

Adverse cybersecurity event

An incident that has an ambiguous security state where it is not immediately certain if the event indicates something malicious or benign, such as logging in from an unusual device or location.

Cybersecurity incident

A malicious event that actually compromises or poses an imminent threat to the confidentiality, integrity, or availability (CIA) of systems or information.

NIST Cybersecurity Framework 2.0

A high-level framework adapted for incident response that defines broad categories of outcomes including Govern, Identify, Protect, Detect, Respond, and Recover.

Govern (NIST Outcome)

The oversight and supervisory pillar involving high-level planning for cybersecurity outcomes.

Identify (NIST Outcome)

The function involving asset management and risk management, such as assessing risks and vulnerability enumerations.

Protect (NIST Outcome)

The mechanism and safeguards used to manage security risks.

Detect (NIST Outcome)

The process of spotting potential incidents using logging systems and rules for generating alerts.

Triage

The stage of incident response where events are prioritized and investigators decide the scope, urgency, and level of escalation needed.

Containment

The act of "stopping the bleeding" by limiting damage, often through isolating compromised hosts, disabling accounts, or stopping malicious communications.

Eradication

The process of getting rid of attacker footholds, such as backdoors or malicious services, and eliminating the threat from the system.

Recovery

The process of turning systems back on and returning to normal operations in a way that ensures the systems are safe and trustworthy.

Patient zero

The initial point of entry for an infection; in the HSE incident, this was a malicious Excel document opened by a user.

Persistence mechanism

A method used by attackers to access a system in a way that will survive reboots, ensuring permanent access.

Cobalt Strike

A tool intended for red team simulation and pentesting that was used maliciously in the HSE incident to facilitate the attack.

Mimikatz

A software tool used in Windows environments to steal credentials in various ways.

Fail-safe default

A cybersecurity principle where a system's default should fail in a way that is safe, favoring false positives that block benign services over failing to block malicious ones.

Lateral movement

The process by which an attacker moves from one compromised system to others within a network, often using services like Remote Desktop.

Conti ransomware

The specific ransomware group and malware that encrypted the Health Service Executive (HSE) systems in Ireland in May 2021.

National Healthcare Network

The IT system for the Ireland government health care system that connects hospitals, admin centers, patient information systems, and labs.

Flat network

A network environment that is not well-segmented, making it easy for attackers to move through systems and difficult for administrators to selectively contain threats.