Time is of the essence in emergency response. Real-world first responders don’t wait for an emergency to prepare their gear. We’ve all seen firefighters with their boots and jackets laid out and ready to go. Necessary items are prepped, packed, and ready to go.
The same is true for cybersecurity incident response. When a cyberattack hits—and your business is down—there’s no time to waste. Every second counts. When you’re looking to rapidly respond and recover, a digital jump bag™ can be a great starting point.
Below, I describe the advantages of a digital jump bag, and how it fits into our Cohesity Clean Room solution. For a deeper dive into the subject, including our recommendations for what to put into a digital jump bag, please read our new white paper.
Physical jump bags, a checklist
Remember, it’s not a matter of if—but when—a cyberattack will happen. Resilience, the ability to get your business back up and running in a secure state, is paramount. Being prepared is more than just good advice. Preparation is essential to incident response and recovery.
I’ve been on the front lines of cyber response for over three decades. So, let’s go back in time to learn about “jump bags” and see how they fit into incident response today. A jump bag originally meant a physical container to be picked up on the way to a location that suffered a cyberattack. It contained the essentials to quickly investigate an incident, mitigate threats, and gather evidence. Contents of a physical jump bag could include:
Remember, immediate response is key. It’s easy to forget something when rushing around in an emergency. Having everything in one place limits the odds of forgetting something or leaving it behind by mistake.
The advantages of digital jump bags
Now that you know what a physical jump bag is, let’s fast-forward to today and examine a digital jump bag. Note: I’ve written about digital jump bags before. Here’s a quick refresher.
A digital jump bag is a protected and trusted repository that provides rapid access to the tools needed for remote acquisition and analysis. It’s a place where you can store the tools, software, configuration files, and documentation needed to respond to an incident in a vaulted immutable store—beyond the reach of adversaries.
What do you need for a positive outcome? You need a clean room—an isolated and secure environment where the security operations team can investigate and understand how the attack happened. And the IT operations team can use that to remediate the threats to ensure secure recovery. The digital jump bag is the foundation of a clean room. It supports the critical stages of incident response and recovery to allow you to restore securely. This minimizes the chances of reinfection or further attack—causing more downtime.
How the digital jump bag works with Cohesity Clean Room solution
The graphic below shows the four critical stages of incident response and recovery.
- Prepare: Earlier in this blog, I wrote, “Preparation is essential.” This is where you decide what goes into the digital jump bag.
- Initiate: Here’s where we recover the Minimum Viable Response Capability (MVRC)—the necessary tools for communication, collaboration, and incident investigation—from the digital jump bag to a trusted state inside the isolated clean room environment.
- Investigate: SecOps teams begin to investigate the threat using the security tools recovered to a trusted state.
- Mitigate: ITOps use what the SecOps team has uncovered to recover, clean, or rebuild systems.
With the Cohesity Clean Room solution, the choice to recover and clean or rebuild can be applied universally across all systems. Or it can be taken on a system-by-system basis, depending on the degree of compromise and relative level of effort.
Learn more
A digital jump bag is an important part of your incident response strategy. Cyberattacks will happen. Being prepared for this is key. Resilience, getting your business back up and running, is the goal. The digital jump bag is the backbone of a clean room environment and enables the MVRC. For more information:
- Get our white paper to learn more about what you should consider putting into your digital jump bag.
- Read the blog.
- Watch my video below on the Cohesity Clean Room solution:
