Lessons Learned from Capital One’s Incident Response Plan

There were many missteps that led to the Capital One breach, but what’s the one thing that went as planned? From our perspective, Capital One’s incident response plan seemed to function as intended. Incident response is incredibly important following a breach – that’s why having a plan and team in place is required by so many information security frameworks. The data proves the importance of incident response plans as well. IBM’s 2019 Cost of a Data Breach reports that organizations with an incident response team and extensive testing of their plans could save, on average, about $1.2 million on the typical data breach. In Capital One’s case, though, this incident will cost $100 to $150 million in 2019 alone. Is developing and testing an incident response plan worth millions to your organization?

Capital One’s Incident Response Plan

The Justice Department’s Compliant includes the report that was submitted to Capital One’s Responsible Disclosure program on July 17, 2019. By the end of that month, Capital One announced the breach to the public and explained what they knew, the mitigation work they’d already performed, and which customers were impacted.

Capital One - Responsible Disclosure

From Capital One’s announcement, we can determine they took the following steps to validate and mitigate the reported findings:

  • Immediately fixing the configuration vulnerability
  • Working with the FBI to arrest the person responsible
  • Determining exactly what type of information was compromised and how many individuals in the US and Canada were impacted
  • Performing an analysis to determine if the information was shared or used for fraud
  • Notifying customers
  • Answering FAQs like: What was the vulnerability that led to this incident? When did this occur? Was the data encrypted and/or tokenized? Did this vulnerability arise because you operate on the cloud?
  • Making information about the incident available on their online and easily accessible

When a household name like Capital One has a major breach, it makes headlines for years. There are major legal and regulatory ramifications for Capital One to answer to, but as far as basic incident response goes, we admit that Capital One seems to have had a thoughtful, tested incident response plan. This was vital in reassuring the public that, even though their AWS configurations had a vulnerability, Capital One knew how to handle the situation.

The key to an incident response plan is testing it in tabletop exercises, employee training, and other scenarios to determine if it will actually work. When organizations go through information security audits, their auditor will have high standards for the plan and the testing of the plan. What would’ve happened if Capital One wasn’t prepared to react to this incident? Would data have been used for fraud or compromised even further?

6 Steps to Incident Response

With today’s threat landscape, it’s not a matter of if your organization will fall victim to a cyberattack or data breach, but when it will happen. We believe basic incident response plans should have six steps:

  1. Preparation – What are we doing to prevent an incident? How are we limiting the impact of an incident? Have we tested our policies and procedures?
  2. Detection & Identification – How would we identify and detect malicious activity? How do we report an incident?
  3. Containment – Has the appropriate personnel been notified? What evidence should be collected? Have we fully assessed the scope of the damage? How can we prevent further damage?
  4. Remediation – Has a complete a forensic analysis performed? Can we make changes to prevent a repeat incident?
  5. Recovery – Have we securely restored the system? Do we have continuous monitoring to ensure problem is resolved?
  6. Lessons Learned –What gaps can we now identify? Have we regained customer confidence? Have we reviewed controls and processes to prevent future attacks?

It’s not only up to IT to develop an incident response plan – many other areas of your organization will be involved, especially C-levels and boards of directors. In Capital One’s case, the CEO responded the public about the breach.

If your organization was breached, would your team know what to do? What would the headlines say about your incident response plan? Are you confident in your plan?

If you want to ensure that everyone at your organization knows their role in incident response, let’s talk today about how to train and test your incident response plan.

More Incident Response Resources

SOC 2 Academy: Incident Response Best Practices

Horror Stories: Timehop’s MFA Mishap

Breach Notification: Who, When, Why

Understanding Data Breaches with Benjamin Wright

Data Security Breaches Occur Every Day

It’s become quite common to see reports in the headlines about data security breaches as different types of organizations are targeted every day. The types of information or data that is stolen as a result of a breach are things like social security numbers, credit card numbers, Protected Health Information (PHI), and Personally Identifiable Information (PII), trade secrets, or intellectual property. The most important thing to consider when it comes to protecting against data breaches is it’s not a matter of if, but when, so be sure to prepare for a breach with both prevention and recovery in mind. It’s also important to be aware of what state and/or federal data breach notice laws may apply to you in the event of a security incident at your organization.

There seems to be a lack of distinction between a security incident and a data breach; not every security incident constitutes a security breach. A breach has occurred when sensitive, protected, or confidential information has been accessed or stolen by someone without the proper authorization to do so. Maybe it’s a lost laptop, a malicious hacker, or accidentally sending sensitive information to the wrong person, it’s important to carefully evaluate every security incident to ensure you are following all applicable data breach laws in the event of an actual breach.

KirkpatrickPrice uses the Six Steps of Incident Response to help organizations determine the severity of a security incident and how to efficiently and effectively remediate. When developing your own incident response plan, take a look at these six common stages of incident response:

1. Preparation

Always document policies and procedures for appropriate disaster recovery to ensure that recovery and remediation will happen quickly. Are you prepared to handle an incident that could happen today?

2. Detection and Identification

What kind of incident has occurred? What is the severity? Has there been loss or exposure of sensitive data? Were any laws or contracts violated? How much information was impacted by the incident?

3. Containment

Notify the right people at the right time to help reduce the damage of a security incident and isolate the infected or compromised area.

4. Remediation

Resolve any issues, malicious code, responsible personnel, threat, etc. What security gaps need to be addressed at this time?

5. Recovery

Implement all appropriate policies and procedures to get back up and running and continue to monitor that the incident has been fully resolved.

6. Lessons Learned

Make sure you know why the incident occurred so you can ensure that the same incident will not happen again.

For more insights on data security, follow @BenjaminWright on Twitter. To learn how KirkpatrickPrice can help you meet your compliance objectives, contact us today!

Video Transcription

A topic in the news is Data Security Breach. We see a lot of reports about organizations notifying the public that they’ve suffered some kind of a breach of information security. So an example of Data Security Breach could be that social security information has been compromised, or maybe credit card information is no longer protected. There are many laws covering Data Security Breaches. Those laws can be state laws, federal laws, or they might be the laws of other countries. These laws  are not uniform and therefore it can be quite confusing for an organization to figure out exactly which law applies when the organization thinks it may have a security breach.

Not every security incident constitutes a Data Security Breach. You may have a lost laptop computer, maybe an employee loses a smart phone, maybe an employee accidentally sends sensitive information to the wrong people. Not every one of these kinds of incidents turns out to be a Data Security Breach under the relevant laws for which you need to give notice. Therefore, when an organization sees that it has an incident, it needs to conduct an appropriate investigation and follow the rules of law in order to determine, “have I achieved the point of having a breach? If I have, then I need to give the appropriate notices under the laws that apply.”

In order to learn more about the course that I teach at the SANS Institute, you can click the link below. Also, another link below provides more information about me and my work in private practice.

Benjamin Wright

Benjamin Wright

Attorney & SANS Instructor

Attorney Benjamin Wright helps others navigate the law of technology.

He teaches the Law of Data Security and Investigations for SANS Institute, the premier authority for training information security professionals and digital forensics experts. That 5-day bootcamp is unique in the world.

Wright is author of The Law of Electronic Commerce (Wolters Kluwer) and Business Law and Computer Security (published by SANS).

Mr. Wright advises clients -- in the US and throughout the world -- on privacy, cryptocurreny, e-discovery, data breaches, ethical hacking, smart contracts, IT outsourcing contracts, and forensic investigations (e.g., social media and mobile apps).

Anthem Data Breach: Recent Hack Affects Millions

Joseph R. Swedish, CEO of Anthem Inc., one of the largest healthcare providers in the US, announced Wednesday, that despite efforts to appropriately safeguard their information, they suffered a major cyberattack. This attack is said to have affected as many as 80 million people.

According to Anthem, this attack compromised both patient and employee information, names, birthdays, medical ID’s, Social Security numbers, street addresses, email addresses, and employment and income information. Swedish said in a letter published on a website about their response to the incident, “Once the attack was discovered, Anthem immediately made every effort to close the security vulnerability, contacted the FBI, and began fully cooperating in the investigation.” ( They have since taken measures to improve their security environment by fully evaluating their systems.

HIPAA laws mandate that you properly safeguard the Personally Identifiable Information (PII) that you collect, and data breaches such as this can often result in heavy fines. There are specific guidelines in regards to protecting this information as well as reporting a breach once it has been discovered. In too many cases, businesses scramble to pick up the pieces as a result from a breach rather than already having in place a strong defense to protect the PII for which they are responsible. This is a scary time for the cyberworld, and with the discovery of this massive data breach we should be encouraged to continue to improve and strengthen our security measures as the landscape continually evolves.

If you need help assessing your current security environment or need help developing your Incident Response Plan, call us today at 800-770-2701 for a free consultation.

2014: The Year of Updating Frameworks

As the world continues to be pressured with information security challenges, over the last 12 months, major compliance frameworks have recently been updated or are currently updating. In today’s current climate, incidents and breaches are occurring more frequently, and at a much larger scale. With this in mind, many entities have realized these threats and are beginning to closely analyze the gaps in the current frameworks (HIPAA, ISO 27001:2013, FISMA/NIST 800-53, PCI DSS v3.0). Our number one business goal is to protect any critical assets, so it’s important to understand all of these changes and the impact they have on your organization. The most notable updates have been to the HIPAA, ISO 27001, FISMA, and PCI DSS frameworks.

Why should these updates be important to you? Let’s face it – it’s the new reality. Almost every industry is having the “compliance discussion”. Security threats aren’t just for big companies anymore, and the fines and loss of business can be an unfortunate impact of not being compliant.


Let’s begin with the healthcare industry. The HIPAA law strives to address the protection of patient information. We want to keep information private. That is what we are most after. The Security Rule enables privacy by establishing the approach of how to protect information so privacy can be obtained. Last September, the Omnibus Rule became effective to strengthen the Business Associate requirement. All covered entities are now required to ensure that their Business Associates are HIPAA compliant, and these BA’s can now be held directly responsible by the Department of Health and Human Services for their compliance. Where do you begin in assessing your vendors? Conduct a risk assessment of all vendors and determine which are the most at risk and monitor accordingly.

ISO 27001

ISO 27001 can be considered the grandfather of all information security frameworks. Most new publications reference ISO 27001 as a starting point, as this framework is internationally recognized and applicable. The ISO 27001:2013 update provides specific requirements for establishing, implementing, maintaining, and continually improving an information security management system. Your information security management process must be a system that is continually operating and improving based on changing risks. The core change is not revolution, but rather evolution. The standard has been reorganized and more harmonized and has made risk assessment focus a key change to the standard. Requirements for management commitment and preventative action have also be revised, with a greater emphasis on setting the objectives, monitoring performance, and metrics.


The FISMA Act is a set of guidelines for selecting and specifying security controls for information systems that process, store, or transmit Federal information. The Act references that NIST publishes Special Publications as important updates that should be referred to. NIST 800-53 is specifically pointed towards as a reference for how to select controls and what it is that you need to implement for your systems. NIST 800-53 expects the important element of risk assessment to determine which controls apply, to what degree they should be applied, and what areas specifically should be considered. Learn more about the FISMA audit process.


The payment card industry is probably what we’ve been hearing the most about. With all of the current breaches targeting retailers and service providers, the council has sought out to address the causes of these breaches and strengthen the industry. The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS v3.0 is an update to the security standard, and is available for implementation this year. Compliance with v2.0 is still an option only through January 2015. There were three major updates to the PCI DSS. There is a new Penetration Testing requirement that states an implemented penetration testing plan should be in place to verify that controls are operational and effective. Service Provider responsibilities have also been updated. Since security is a shared responsibility, service providers are now required to include written vendor acknowledgement for each DSS requirement for which they’re responsible. The last major change in PCI DSS v3.0 is in regards to password requirements and the enhanced awareness to ensure password security. Learn more about PCI DSS compliance audits.

It’s important to ask yourself, which of these frameworks apply to me? Which apply to my vendors? Performing a Risk Assessment can help you determine what is important to you and your organization, allowing you to assess from there. Security is no longer passive. Technology is evolving quickly, along with techniques used by hackers. As the compliance frameworks continue to update, it’s important to understand that security must now be active and always evolving.