Security Breach Incident Response procedure

In the event of any kind of unauthorised access to or exposure of an element of the services, as a result of which the confidentiality, integrity or availability of the data processed by Tradecloud or its Customers with the services is or may be breached (a Security Breach), Tradecloud will act according to this Incident Response Procedure.

This incident response procedure establishes the recommended organization, actions, and procedures needed to

• Recognize and respond to an incident;
• Assess the situation quickly and effectively;
• Notify the appropriate individuals and organizations about the incident;
• Organize the company’s response activities, including activating a command center;
• Escalate the company’s response efforts based on the severity of the incident; and
• Support the business recovery efforts being made in the aftermath of the incident.

Organization:

Tradecloud has established an incident response team. Consisting of the following persons:

1. Chief Technical Officer
2. System Engineer
3. Tech Lead
4. Chief Executive Officer
5. Chief Finance Officer

Incident reporting:

• The person within the Company who discovers the incident will immediately contact the response team. Starting at the first person listed and if not available immediately the next person on the list through Messaging, Telephone, Email or otherwise.
• In case the Security Breach is discovered by someone outside the Company, the contact details are:
  • support@tradecloud.nl or telephone: (+31) 85 401 97 60.

The person contacted within the response team will log:

1. The name of the caller.
2. Time of the call.
3. Contact information about the caller.
4. The nature of the incident.
5. What equipment or persons were involved?
6. Location of equipment or persons involved.
7. How the incident was detected.
8. When the event was first noticed that supported the idea that the incident occurred.

The response team will assess:

1. Is the breach business critical?
2. What is the severity of the potential impact?
3. Name of system being targeted, along with operating system, IP address, and location.
4. IP address and any information about the origin of the attack.

Contacted members of the response team will meet or discuss the situation over the telephone and determine a response strategy.

1. Is the incident real or perceived?
2. Is the incident still in progress?
3. What data or property is threatened and how critical is it?
4. What is the impact on the business should the attack succeed? Minimal, serious, or critical?
5. What system or systems are targeted, where are they located physically and on the network?
6. Is the incident inside the trusted network?
7. Is the response urgent?
8. Can the incident be quickly contained?
9. Will the response alert the attacker and do we care?
10. What type of incident is this? Example: virus, worm, intrusion, abuse, damage.

An incident ticket will be created. The incident will be categorized into the highest applicable level of one of the following categories:

1. Category one – A threat to public safety or life.
2. Category two – A threat to sensitive data
3. Category three – A threat to computer systems
4. Category four – A disruption of services

Communication

In the event of a Security Breach, Tradecloud shall immediately (ultimately within twenty four (24) hours from becoming aware of the security breach) inform its Customers and relevant authorities of this. This Notification includes in any event:

1. recommended measures for limiting the negative consequences of the security breach;
2. the identified and suspected consequences of the security breach on the processing of the Personal Data and
3. the measures taken or proposed for remedying those consequences.

Regarding each Security Breach, the Tradecloud shall lend all cooperation to its Customer, including the provision of sufficient information and support in respect of investigations by any regulators:

1. to remedy and investigate the breach and prevent future breaches;
2. to limit the impact of the breach on the privacy of the data subject or subjects; and/or
3. to limit the Customers’ damage as a result of the breach.

Actions

• Team members will use forensic techniques, including reviewing system logs, looking for gaps in logs, reviewing intrusion detection logs, and interviewing witnesses and the incident victim to determine how the incident was caused. Only authorized personnel should be performing interviews or examining evidence, and the authorized personnel may vary by situation and the organization.
• In the event that team members are not able to stop the breach themselves the use of third party experts is permitted.
• Team members will recommend changes to prevent the occurrence from happening again or infecting other systems.
• Upon management approval, the changes will be implemented.
• Team members will restore the affected system(s) to the uninfected state. They may do any or more of the following:

1. Re-install the affected system(s) from scratch and restore data from backups if necessary. Preserve evidence before doing this.
2. Make users change passwords if passwords may have been sniffed.
3. Be sure the system has been hardened by turning off or uninstalling unused services.
4. Be sure the system is fully patched.
5. Be sure real time virus protection and intrusion detection is running.
6. Be sure the system is logging the correct events and to the proper level.

Documentation

The following shall be documented:

1. How the incident was discovered.
2. The category of the incident.
3. How the incident occurred, whether through email, firewall, etc.
4. Where the attack came from, such as IP addresses and other related information about the attacker.
5. What the response plan was.
6. What was done in response?
7. Whether the response was effective.

Evidence Preservation:

• The Team members will make copies of logs, email, and other communication. Keep lists of witnesses. Keep evidence as long as necessary to complete prosecution and beyond in case of an appeal.
• Notify proper external agencies—notify the police and other appropriate agencies if prosecution of the intruder is possible. List the agencies and contact numbers here.
• Assess damage and cost—assess the damage to the organization and estimate both the damage cost and the cost of the containment efforts.

Review response and update policies:

• The team will plan and take preventative steps so the intrusion can’t happen again.

1. Consider whether an additional policy could have prevented the intrusion.
2. Consider whether a procedure or policy was not followed which allowed the intrusion, and then consider what could be changed to ensure that the procedure or policy is followed in the future.
3. Was the incident response appropriate? How could it be improved?
4. Was every appropriate party informed in a timely manner?
5. Were the incident-response procedures detailed and did they cover the entire situation? How can they be improved?
6. Have changes been made to prevent a re-infection? Have all systems been patched, systems locked down, passwords changed, anti-virus updated, email policies set, etc.?
7. Have changes been made to prevent a new and similar infection?
8. Should any security policies be updated?
9. What lessons have been learned from this experience?