CYBERTHREAT RECOGNITION & MITIGATION: A GUIDE FOR SMALL & MEDIUM SIZED BUSINESSES (SMBs)This document is provided for educational and informational purposes only and is not intended and should not be construed as providing legal advice. U.S. Government and the IC Private Sector Public Sector Analyst exchange program partners (the “Exchange Program Partners”) do not warrant or assume any legal liability or responsibility for the accuracy,completeness, or usefulness of any information, apparatus, product, or process discussed in this document. U.S. Government and the Exchange Program Partners do not endorse or recommend any commercial products, processes, or services. The views and opinions expressed in this document do not necessarily state or reflect those of the U.S. Governmentor the Exchange Program Partners, and they may not be used for advertising or product endorsement purposes.2016 PUBLIC-PRIVATE ANALYTIC EXCHANGE PROGRAMPPAEP_58c5ee48-bbd4-11e6-8232-8cd8f7e90587This program enables intelligence community analysts and private sector partners to gain a greater understanding of how their disparate, yet complementary roles can work in tandem to ensure mission success.SMBsSmall and medium-sized businesses.Cyber Threat Recognition and Mitigation Group ContributorsDepartment of DefenseDefense Intelligence AgencyFederal Bureau of InvestigationAmgenHewlett Packard EnterpriseStratusCyber Small Business SecurityVirginia Department of TaxationArmera Cyber SolutionsImproved cybersecurity_58c5ef24-bbd4-11e6-8232-8cd8f7e90587To provide a path to improved cybersecurity_58c5f096-bbd4-11e6-8232-8cd8f7e90587PreparationPrepare for cyber-attack._58c5f1ae-bbd4-11e6-8232-8cd8f7e905871Small businesses must prepare for cyber-attack. The first three steps to prepare for a cyber-attack on your business involve PEOPLE, SYSTEMS, and BACK-UPS.PeopleEducate employees about the threat._58c5f244-bbd4-11e6-8232-8cd8f7e905871.1Step one, PEOPLE. Educate employees about the threat, starting with use of strong passwords and learning about threats like phishing.SystemsProtect your systems and data._58c5f2d0-bbd4-11e6-8232-8cd8f7e905871.2Step two, SYSTEMS. Protect your systems and data by using some of the many software tools available, starting with Anti-Virus and a Firewall.Back-UpBack up your data._58c5f366-bbd4-11e6-8232-8cd8f7e905871.3BACK-UPS, step three, gives you a do-over, after an attack instead of going out of business, it allows you to start again from where you left off.PreventionPrevent cyber-security breaches._58c5f3f2-bbd4-11e6-8232-8cd8f7e905872Some of the most affordable yet effective preventiontechniques that SMBs can employ to prevent cyber-securitybreaches include: firewalls, intrusion prevention softwareand Anti-Virus software, strong passwords with expirationtimers, disabling and uninstalling any unused services andsoftware to limit entry points into the system, applicationwhitelisting/black listing and physical access controls (e.g.locked doors, offices, cabinets).Software should also be patched with the latest vendorreleases so that known security flaws are closed.Firewalls_58c5f488-bbd4-11e6-8232-8cd8f7e905872.1Intrusion Prevention_58c5f51e-bbd4-11e6-8232-8cd8f7e905872.2Virus Protection_58c5f5b4-bbd4-11e6-8232-8cd8f7e905872.3Password Protection_58c5f64a-bbd4-11e6-8232-8cd8f7e905872.4Entry Points_58c5f6e0-bbd4-11e6-8232-8cd8f7e905872.5Whitelisting/Black Listing_58c5f780-bbd4-11e6-8232-8cd8f7e905872.6Physical Access_58c5f816-bbd4-11e6-8232-8cd8f7e905872.7Software Patches_58c5f8b6-bbd4-11e6-8232-8cd8f7e905872.8DetectionMonitor the network for advanced persistent threats._58c5f956-bbd4-11e6-8232-8cd8f7e905873Consider using a managed security service provider to monitor your network for advanced persistent threats. An endpoint security solution will provide additional security for your endpoints (laptops/workstations/servers). This defense-in-depth strategy enhances the security tools and best-practices in your prevention strategy. Your diligence is critical!Signs & SymptomsFamiliarize yourself with the signs and symptoms of an infected system._58c5f9ec-bbd4-11e6-8232-8cd8f7e905873.1Emerging Threats & Security UpdatesUse security resources and information channels to keep current on emerging threats and security updates._58c5fa96-bbd4-11e6-8232-8cd8f7e905873.2Security Service ProvidersKeep the contact information of security service providers that manage your security._58c5fb36-bbd4-11e6-8232-8cd8f7e905873.3Security Service ProvidersOther ProfessionalsIdentify other professionals that you can call to help you recognize and respond to security incidents and breaches. _58c5fbd6-bbd4-11e6-8232-8cd8f7e905873.4ResponseRespond thoroughly to incidents._58c5fcb2-bbd4-11e6-8232-8cd8f7e905874When an incident is detected, it is important to respond thoroughlyand timely.ContractsWork with pre-established contacts to contain, mitigate, and eradicate the threat._58c5fd5c-bbd4-11e6-8232-8cd8f7e905874.1Alerting & ReportingAlert affected parties and provide progress reports throughout the incident._58c5fe06-bbd4-11e6-8232-8cd8f7e905874.2RemovalEnsure all the attacker's artifacts are eliminated from affected systems._58c5feba-bbd4-11e6-8232-8cd8f7e905874.3Causes & SymptomsDetermine cause and symptoms of the incident._58c5ff64-bbd4-11e6-8232-8cd8f7e905874.4PatchesPatch all vulnerabilities._58c6000e-bbd4-11e6-8232-8cd8f7e905874.5RestorationRestore data appropriately from backups._58c600cc-bbd4-11e6-8232-8cd8f7e905874.6EvidencePreserve evidence so law enforcement action can potentially be taken against the perpetrator._58c60176-bbd4-11e6-8232-8cd8f7e905874.7Law Enforcement OfficialsRecoveryCreate a disaster recovery plan._58c60270-bbd4-11e6-8232-8cd8f7e905875Internet Service ProvidersHardware VendorsTrade AssociationsReady.govNISTSBAYou've been hacked, you've responded appropriately to the incident and now you need to recover. The extent of your recovery may include the computer room and environment, the hardware, connectivity to a Internet Service Provider (ISP), software applications, and restoration of your company's data.Help from your ISP, hardware vendor, trade associations or major clients may be available. A number of helpful ideas can be found on the Ready.gov, NIST, SBA and other official websites. If you have not yet created one, a disaster contingency planning policy or reference book can be crucial in times of crisis._58c6032e-bbd4-11e6-8232-8cd8f7e905872016-12-06http://files.constantcontact.com/311cbc2c401/29358b0c-5a58-4ba1-8aa4-0716037493b5.pdfOwenAmburOwen.Ambur@verizon.net