Incident response

Overview of our incident response program

Our mission at Sophos is to protect people from cybercrime by developing powerful and intuitive products and services that provide the world’s most effective cybersecurity for organizations of any size. Effectively responding to a broad range of potential security incidents is critical to the success of the Sophos mission. Simply put: To protect our customers, our incident response program needs to protect our products and our company.

Sophos uses the NIST 800-61 definition of a security incident: “a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.” This is an intentionally broad definition so that we can optimize for rapid response time, identifying areas for improvement and customer transparency. This definition also supports identifying any data leaks, which might not be included in a definition focused on confirmed attacks.

How we identify incidents

There are many ways Sophos identifies or becomes aware of security incidents. These include:

• Security monitoring capabilities, often in our products, or complimentary methods we have developed.
• Bug bounty reports.
• Penetration test findings.
• Vulnerability analysis.
• Code and application analysis.
• Research and threat intelligence analysis.
• Customer notifications.

To report a potential security incident, please see our Responsible Disclosure Program.

Investigation and analysis

Following the detection or verified report of an incident, we initially leverage established communications channels to facilitate information-sharing among the incident response team.

A standard minimum agenda for an incident response investigation and analysis meeting is as follows:

• Establish current facts.
• Update on action status.
• Agree on next actions.
• Confirm assessment of the incident severity status: Sev1/2/3.
• Agree on the timing of the next meeting.
• Document minutes on the incident timeline, including actions and decisions.

Severity assessment

We have four incident severity levels.

Incident Severity Levels

Our incident response managers set the severity of an incident based on the potential impact to the company and customers. We use various threat assessment criteria in determining the severity of an incident, including customer impact, functional impact, information impact, recoverability, data quantity and classification, threat actor, and business impact. Incident severity is reassessed at key points throughout the response process and severity is adjusted as necessary.

Roles and responsibilities

At the outset of an incident, a single incident response manager is identified based on the incident’s assigned severity level. This role can be rotated when 24/7 coverage is required. A single incident response manager gives us clear direction so we can take immediate action and communicate effectively.

Depending upon the nature of the incident we have varying roles required. Some of the most common roles include:

Incident Roles and Responsibilities

Containment, eradication, and recovery

The purpose of containment is to stop the effects of an incident before it can cause further damage. Once an incident is contained, we can take the time necessary to comprehensively address the issue.

After an incident has been contained, eradication may be necessary to eliminate components and side effects of the incident. For Sophos-targeted security incidents, we need to think about our corporate assets as well as our product assets, including our cloud offerings.

Common eradication tasks include:

• Configuration or code changes/hot fixes.
• Replacing or disabling systems.
• Removing functionality.
• Data quality cleanup.
• Disabling breached user accounts.
• Identifying and mitigating all vulnerabilities that were exploited.

In recovery, Sophos engineers restore systems to normal operation, confirm that the systems are functioning normally, and (if applicable) remediate vulnerabilities to prevent similar incidents. Our culture and approach to innovation as a security and cloud company helps us to recover quickly. We rely on continuous integration and deployment capabilities across our businesses. We are constantly re-deploying systems at scale and with speed.

Customer notification

Authenticity is a one of our company values at Sophos. This value, reinforced by our company mission to protect, means we will notify customers as soon as possible if their data is involved in a confirmed incident or breach.

Post-incident activity

Once an incident has been addressed and resolved, we focus on learning from the incident. We hold post-mortem sessions to discuss how we handled the incident and the root cause of the incident. Based on these discussions, we adjust and improve our incident handling procedures and make improvements to our security profile to prevent and more quickly detect similar incidents in the future.