Incident Response Report

Instructions:
Your deliverables for this assignment are:
⦁ Part A: Complete the Incident Report Form
⦁ Part B: Write Summary After Action Report in narrative format
First, you should complete the Sifers-Grayson Cybersecurity Incident Report Form (use the template found at the end of this file) using information provided in this assignment file. You should also consult the “Notes to Students” (below) for additional directions regarding completion of the form.
Next, perform a more thorough analysis of the information provided about the Red Team’s penetration testing and the vulnerabilities / security gaps which were uncovered. You should pay attention to areas where the incident response capability needs to be improved (people, processes, policies and technologies). Prepare a Summary Report of your findings and recommendations in narrative format. Your Summary Report should have four major sections. The required sections are:
⦁ Introduction (provide an overview of the purpose and contents of the report)
⦁ Analysis of the Incident (summarize what you know about the red team’s activities / the resulting security incidents using the information provided in the classroom and in this file). Your incident analysis should address: people, processes, policies, and technologies.
⦁ Lessons Learned (what went wrong in the incident response process, what did not happen that should have happened). Your lessons learned analysis should address: people, processes, policies, and technologies.
⦁ Recommendations for Improvements to Incident Response Capability (what needs to change, who should take actions, what actions must be taken to improve the incident response capability).
Your Task
You have been assigned to assist with After Action Reporting in support of the Sifers-Grayson Blue Team. Your immediate task is to assist in analyzing and reporting on a Red Team penetration test described later in this document. As part of that report, you will identify weaknesses and vulnerabilities exploited by the attackers (the Red Team), compile a set of lessons learned, and then make recommendations for actions the company should take to close the gaps in their cybersecurity posture (at a minimum, you must address the identified vulnerabilities and weaknesses that were exploited by the Red Team). The Blue Team has provided you with a set of enterprise architecture diagrams (see figures 1-4 in this file) to help with your analysis of the incident and preparation of the summary report. You should also use the readings from Weeks 1-4 to help you identify security gaps and incident response capabilities which the company needs to implement.
Background
Sifers-Grayson is a family owned business headquartered in Grayson County, Kentucky, USA. The company’s physical address is 1555 Pine Knob Trail, Pine Knob, KY 42721. The president of the company is Ira John Sifers, III. He is the great-grandson of one of the company’s founders and is also the head of the engineering department. The chief operating officer is Michael Coles, Jr. who is Ira John’s great nephew. Mary Beth Sifers is the chief financial officer and also serves as the head of personnel for the company.
Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its R&D DevOps and SCADA labs operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS) including section 252-204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information, provided by the federal government and stored on computer systems in the Sifers-Grayson R&D DevOps and SCADA labs, is protected from unauthorized disclosure. This information includes software designs and source code. The contract requirements also mandate that Sifers-Grayson report cyber incidents to the federal government in a timely manner.
The company has agreed to allow an external Red Team to conduct penetration testing of its operations to help ensure that it is able to meet the government’s requirements for cybersecurity and the protection of government owned sensitive but unclassified information. The company has also assigned personnel to conduct After Action Reviews of the penetration testing.
Company Operations
Engineering Department
The Engineering Department is housed in the company’s R&D center with a satellite facility at the test range. The desktop and laptop computers are a mixed bag of hardware (multiple manufacturers) running Windows 8.1, Windows 10, and variants of Apple’s OSX and iOS. The support for these computers and the internal networks is provided by the junior engineers assigned to one or more of the department’s development teams. The Engineering Department’s philosophy is that all of the company’s engineers should be trained and capable of providing support for any and all hardware, software, and networks used by the department. This training is provided through on-the-job experiences and mentoring by more senior engineers. When a problem arises, the department head or one of the lab supervisors assigns an engineer to find and fix the problem.