Incident response

We realise that security incidents are inevitable, so properly preparing for such incidents is a big part of what makes for good security. Powered by SophosLabs — a global threat intelligence and data science team — Sophos' cloud-native and AI-powered solutions secure the company against cyberattacks.

Sophos is one of the 600,000 organisations protected by Sophos products. Our plans focus on how we communicate securely and reliably during an incident, what roles we need to respond effectively, how we will respond to various types of incidents, analysing severity levels, and notifying customers and regulatory bodies as appropriate.

We have developed our plans with guidance from the NIST 800-61 Computer Security Incident Handling Guide and we frequently review these plans for compliance with industry standards.

Our highly skilled cybersecurity professionals develop and operate world-class incident response capabilities, including comprehensive monitoring, advanced detections, response automation, incident management, forensic analysis, and access to external experts. We believe that by being the first and most frequent users of Sophos products, along with our access to the product teams and SophosLabs, we are in a uniquely effective position to respond to cybersecurity incidents.

Outline of our incident response programme

Our mission at Sophos is to protect people from cybercrime by developing powerful and intuitive products and services that provide the world’s most effective cybersecurity for organisations of any size. Effectively responding to a broad range of potential security incidents is crucial to the success of the Sophos mission. Simply put: To protect our customers, our incident response programme needs to protect our products and our company.

Sophos uses the NIST 800-61 definition of a security incident: “a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.” This is an intentionally broad definition so that we can optimise for rapid response time, identifying areas for improvement and customer transparency. This definition also supports identifying any data leaks, which might not be included in a definition focused on confirmed attacks.

How we identify incidents

There are many ways Sophos identifies or becomes aware of security incidents. These include:

Security monitoring capabilities, often in our products, or complementary methods we have developed.
Bug bounty reports.
Penetration test findings.
Vulnerability analysis.
Code and application analysis.
Research and threat intelligence analysis.
Customer notifications.

To report a potential security incident, please see our Responsible Disclosure Programme .

Investigation and analysis

Following the detection or verified report of an incident, we initially leverage established communications channels to facilitate information-sharing among the incident response team.

A standard minimum agenda for an incident response investigation and analysis meeting is as follows:

Establish current facts.
Update on action status.
Agree on next actions.
Confirm assessment of the incident severity status: Sev1/2/3.
Agree on the timing for the next meeting.
Document minutes on the incident timeline, including actions and decisions.

Severity assessment

We have four incident severity levels.

Incident Severity Levels

Severity	Description
0	Critical incident with maximum impact.
1	Very serious incident with very high impact.
2	Major incident with significant impact.
3	Minor incident with low impact.

Our incident response managers set the severity of an incident based on the potential impact on the company and customers. We use various threat assessment criteria to determine the severity of an incident, including customer impact, functional impact, information impact, recoverability, data quantity and classification, threat actor, and business impact. Incident severity is re-evaluated at key points during the response process, and severity is adjusted as required.

Roles and responsibilities

At the outset of an incident, a single incident response manager is identified based on the incident’s assigned severity level. This role can be rotated when 24/7 cover is needed. A single incident response manager provides us with clear guidance so that we can act promptly and communicate efficiently.

Depending upon the nature of the incident we have varying roles required. Some of the most common roles include:

Incident Roles and Responsibilities

Role	Responsibility
IR Manager	Make decisions on severity rating, escalation, composition of full incident response team as well as initiate and run investigation.
Executive Sponsor	Communicate with Senior Management Team (SMT) as necessary and approve Sev 0/1 incident response decisions.
IR Team	Cross-functional team responsible for investigating, analysing, and containing cybersecurity incidents.
IR Programme Owner	Accountable for the incident response plan and cross-functional team preparedness, keeping IR plan and documentation up to date, and regular reviews.
Data Protection and Customer Communications	Make decisions about customer and other external notifications.

Containment, eradication, and recovery

The purpose of containment is to stop the effects of an incident before it can cause further damage. Once an incident is contained, we can take the time necessary to comprehensively address the issue.

After an incident has been contained, eradication may be necessary to eliminate components and side effects of the incident. For Sophos-targeted security incidents, we need to consider our corporate assets as well as our product assets, including our cloud offerings.

Common eradication tasks include:

Configuration or code changes/hot fixes.
Replacing or disabling systems.
Removing functionality.
Data quality clean-up.
Disabling breached user accounts.
Identifying and mitigating all vulnerabilities that were exploited.

In recovery, Sophos engineers restore systems to normal operation, confirm that the systems are functioning normally, and (if applicable) remediate vulnerabilities to prevent similar incidents. Our culture and approach to innovation as a security and cloud company help us to recover quickly. We rely on continuous integration and deployment capabilities across our businesses. We are continuously redeploying systems at scale and with speed.

Customer notification

Authenticity is one of our company values at Sophos. This value, reinforced by our company mission to protect, means we will notify customers as soon as possible if their data is involved in a confirmed incident or breach.

Post-incident activity

Once an incident has been addressed and resolved, we focus on learning from the incident. We hold post-mortem sessions to discuss how we handled the incident and the root cause of the incident. Based on these discussions, we adjust and improve our incident handling procedures and make improvements to our security profile to prevent and detect similar incidents more quickly in the future.

How we use our own tools to respond to incidents

The Sophos Global Security Operations Centre (GSOC) constantly monitors alerts from our infrastructure and hunts for anomalies across the estate. We achieve this by deploying and monitoring various detection tools, including the full suite of Sophos next-gen products.

Sophos Intercept X Advanced with EDR combines the capabilities of Intercept X with Endpoint Detection and Response (EDR) into a single-agent solution to help us deal with a wide range of threats. With Live Discover and Live Response, we can quickly identify threats, respond to them within minutes, remotely take forensic snapshots, and manage issues by isolating affected endpoints. We can use the forensic snapshot feature to identify any further IOCs and artefacts. Network artefacts are then blocked by our Sophos Firewall. To learn more about how we utilise the threat data provided by Intercept X, see https://news.sophos.com/en-us/2018/12/03/hunting-for-threats-with-intercept-x-and-the-windows-event-collector/
Sophos Firewall utilises intrusion prevention to help prevent and detect the latest network exploits. Our firewalls enable us to block malicious domains, URLs, and IP addresses, as well as analyse suspicious files transferred over the network via SophosLabs’ secure cloud environment. In certain places on the network, we also deploy Discover mode, where the firewall acts as a network sensor for IDS events and network activity reporting.
With more and more of our workloads moving to the cloud, we needed a tool that gives us visibility. We use Sophos Optix to help us identify and assess the cloud services that are risks to the business and proactively notify us about suspicious behaviour. It allows us to quickly answer key questions such as: Who owns it? With whom does it communicate? What are the roles and permissions being used? What rules and security groups are being used? The ability to quickly visualise the network and the roles utilised by its resources allows for efficient identification of any issues.
Sophos depends on a wide range of systems, and we can gather data from various Sophos and non-Sophos products alike. Whilst it can quickly become challenging to get contextual information about certain systems, during the detection and analysis phase of an incident, it is imperative that we obtain the correct information as quickly and efficiently as possible to enable us to make informed decisions. Sophos Fusion APIs give us the power to leverage Sophos Fusion and its integration partners: https://news.sophos.com/en-us/2019/12/19/unlocking-the-power-of-sophos-central-api/.