In today’s blog post, I will walk you through a scenario in which a Root Cause Analysis was performed on a fictitious company called DIVECORP. This type of exercise is required if a security breach occurs, and this also serves as a good template for a Root Cause Analysis.

Hope you enjoy…

Scenario: DIVECORP is a global organization that specializes in deep-sea diving expeditions, with offices located in Florida, Bali, and Mexico. One day, an employee named John, who works at the Bali office, received an email from an unknown sender with an attachment claiming to be a safety briefing for the upcoming diving expedition. Without thinking twice, John downloaded the attachment and inserted a USB drive with a file with the same name as the email attachment. The file contained malware, which created a command and control (C2) session with a remote server.

A few hours later, the malware spread to the computer’s registry, and the attackers managed to access the system. Since John was a diving team member, he had access to the corporate file server named fs01, which contained sensitive information such as client details, employee records, and financial data. The attackers could infect the fs01 server with ransomware, encrypting all the files and demanding a ransom to restore them.

When the DIVECORP IT team discovered the issue, they immediately activated their incident response plan. In addition, they initiated a root cause analysis to determine how the malware could infiltrate their systems and cause such significant damage.

Root Cause Analysis:

  1. Gathering Information: The first step of the root cause analysis is to gather information about the incident. The IT team collects information from different sources, such as logs, network activity, and employee interviews. They determined that the initial infection occurred when John downloaded the attachment from an unknown sender.
  2. Identifying the Cause: The next step is to identify the incident’s root cause. The IT team determined that the cause of the incident was the lack of employee awareness and training. For example, John was unaware of the risks of opening an attachment from an unknown sender, nor was he aware of the importance of scanning USB devices for malware before inserting them into a system.
  3. Determining the Corrective Actions: The IT team determined that corrective action was required to prevent future incidents. They implemented an employee awareness training program to educate employees on the risks of opening email attachments from unknown senders, the importance of scanning USB devices for malware, and how to recognize and report suspicious emails. They also decided to implement endpoint protection software to scan email attachments and USB devices before employees access them.
  4. Implementing the Corrective Actions: The final step is implementing the corrective actions determined in step 3. DIVECORP IT team held a training session for all employees, covering the abovementioned topics. They also implemented endpoint protection software deployed to all company systems. Finally, the IT team performed an overall assessment of their cybersecurity controls and implemented additional measures to ensure that such incidents are avoided in the future.

Conclusion: Cybersecurity incidents can occur at any time, and it is crucial to have an incident response plan to respond quickly. The root cause analysis process helps organizations identify the cause of the incident and implement corrective actions to prevent similar incidents from happening in the future. By implementing cybersecurity best practices, such as employee awareness training and endpoint protection, organizations can reduce their risk of falling victim to cyber-attacks.