CISA checklist

Last month, CISA (Cybersecurity and Infrastructure Security Agency) published its Cybersecurity Incident

& Vulnerability Response Playbooks: Operational Procedures for Planning and Conducting Cybersecurity Incident and Vulnerability

Response Activities in FCEB Information Systems . An appendix to this guide provides a checklist to use in responding to a security breach incident.

A bare description of the checklist can be boiled down to these steps:

1. Report the incident (to CISA) within one hour

2. Assess the operational and information impact.

3. Collect data about the incident.

4. Identify the technical basis of the incident - the IOC (indicators of compromise - such as a file hash or IP address) and the TTPs (tactics, techniques, and procedures - which describe why and how the attack took place).

5. Use a third party for intrusion detection.

6. Tune tools to mitigate the attack.

7. Implement a containment strategy - system backups; close ports and servers; prevent domain name resolution for attackers.

8. Eradication - reimage systems from backups.

9. Reset passwords and install updates and patches.

10. Post-Incident action - after action hotwash to evaluate the incident response.

11. Coordinate with the CISA and receive a CISA National Cyber Incident Scoring System (NCISS) priority level.

regex search to find a string when it repeats X number of times

If you want to run a regular expression for a string which appears at least X times successively, you can run this search:

^(?!(.*?x){4})(?=.*x).*$

This search will find the string 'X', entered after the first ? and then at the end of the second parentheses, whenever it appears Y number of times successively, Y being one less than the number entered in the curly brackets.

Selectable, but unsearchable text in a PDF

Even if you have text in a PDF which can be selected with a cursor it may not actually be searchable. If you search for a term which you are sure should appear in a document, and nothing comes up, verify that the text you can select and copy to your clipboard is actually searchable ASCII text. Acrobat, or another PDF Viewer may not be able to convert the text embedded in the PDF.

If this happens, try these solutions:

1. Under Edit . . . Preferences . . . Search, click the 'Purge Cache Contents' option.

2. Under Tools . . . Protection, run 'Sanitize Document'. This utility may remove hidden text.

If neither of these steps works, you may need to write the PDF as a new image and re-OCR. The problem can stem from a corrupted Unicode map. Acrobat uses two tables to store fonts - one for the shapes on the image, and another for the Unicode text. Software can interfere with the font mapping intentionally and render the PDF unsearchable.