DER.2.3 Clean-Up of Extensive Security Incidents

In order to clean up an APT incident, a management committee MUST be created to plan, coordinate, and monitor all the necessary activities. The committee MUST be provided with all the managerial authority necessary for its tasks.

If a management committee of this kind was already in place when the APT incident was detected and classified, the same committee SHOULD also plan and oversee the cleaning process. If a specialised forensic service provider has already been brought in to analyse the APT incident, it SHOULD also be involved in the clean-up effort.

The idea of setting up a crisis team SHOULD be examined if the IT systems in question are too compromised to continue operating or the clean-up measures are very extensive. In this case, the management committee MUST monitor the clean-up measures. The management committee MUST then report to the crisis team.

Before an APT incident is actually cleaned up, the management committee MUST define a cleaning strategy. Here, it MUST be decided in particular whether the malware can be removed from the compromised IT systems and whether certain IT systems have to be reinstalled or replaced completely (including their hardware). Furthermore, the IT systems to be cleaned MUST be defined. These decisions MUST be based on the results of a previous forensic examination.

All the IT systems affected SHOULD be reinstalled. Afterwards, the organisation's recovery schemes MUST be followed. Before backups are restored, however, forensic examinations MUST be performed to ensure that no manipulated data or programs will be transferred to a reinstalled IT system.

If the organisation decides that it does not want to reinstall all of its IT systems, a targeted APT clean-up process MUST be implemented. To minimise the risk of overlooked backdoors, IT systems MUST be specifically monitored after the clean-up to see if they are still communicating with the attacker.

The network segments affected by an APT incident MUST be isolated completely. In particular, these network segments MUST be cut off from the Internet. In order to effectively lock out the attacker and prevent them from covering their tracks or sabotaging other IT systems, the network segments MUST be isolated simultaneously.

The network segments to be isolated MUST be determined in advance through forensic analysis. This MUST identify all the segments affected. If this cannot be guaranteed, all suspicious network segments MUST be isolated along with all those that are only theoretically infected.

To effectively isolate network segments, all local Internet connections (e.g. additional DSL connections in individual sub-networks) MUST be documented as comprehensively as possible and taken into account.

All access data MUST be changed after an affected network is isolated. Furthermore, access data managed in a centralised manner MUST also be reset, including in Active Directory environments or when the Lightweight Directory Access Protocol (LDAP) has been used.

If the central authentication server (domain controller or LDAP server) has been compromised, all the users on it MUST be blocked and have their passwords changed. This MUST be implemented by experienced administrators and with the help of internal or external forensics experts, if necessary.

If TLS keys or an internal certification authority (CA) has been compromised by the APT attack, corresponding keys, certificates, and infrastructures MUST be regenerated and redistributed. The compromised keys and certificates MUST also be reliably blocked and withdrawn.

If a forensic examination determines that the attackers used a technical vulnerability to penetrate the network of the organisation in question, this vulnerability MUST be closed. If the attackers were able to compromise the IT systems as a consequence of human error, organisational, personnel-related, and technical measures MUST be taken to prevent similar incidents in the future.

After the affected network has been cleaned successfully, the IT systems MUST be returned to production operations in a controlled manner. In so doing, all the previously used IT systems and installed programs that were used to observe and analyse the attack MUST either be removed or incorporated into the productive environment. The same MUST be done with communication and collaboration systems procured for the purpose of cleaning. Evidence and decommissioned IT systems MUST either be deleted or destroyed securely, or archived appropriately.

After an APT attack, all the IT systems affected SHOULD be hardened. This SHOULD be based on the results of forensic examinations. In addition, there SHOULD be a further check on whether the affected environment is still secure.

If possible, IT systems SHOULD already be hardened as they are being cleaned. Safeguards that cannot be performed on short notice SHOULD be added to an action plan and implemented in the medium term. The CISO SHOULD draw up the plan and check that it has been implemented properly.

Secure communication channels SHOULD be established for the management committee in question and the employees charged with cleaning. If third-party communication services are used, care SHOULD be taken to ensure that a secure communication channel is selected.

Whether hardware needs to be replaced completely after an APT incident SHOULD be considered. If suspicious behaviour is still observed after cleaning the individual IT systems affected, the respective systems SHOULD be replaced.

If an organisation wants to prevent a previous attacker from performing another APT attack on its IT systems, the organisation SHOULD change the internal design of its network environment. Furthermore, mechanisms SHOULD be established that can be used to quickly detect a recurring attacker.