@iota-big3/sdk-security
Version:
Advanced security features including zero trust, quantum-safe crypto, and ML threat detection
730 lines • 27.9 kB
JavaScript
"use strict";
/**
* Incident Response Playbook Library
* Pre-built playbooks for common security incidents
*/
Object.defineProperty(exports, "__esModule", { value: true });
exports.PlaybookLibrary = exports.DDOS_PLAYBOOK = exports.PHISHING_PLAYBOOK = exports.DATA_BREACH_PLAYBOOK = exports.RANSOMWARE_PLAYBOOK = void 0;
const types_1 = require("../types");
/**
* Ransomware incident playbook
*/
exports.RANSOMWARE_PLAYBOOK = {
id: 'playbook-ransomware-001',
name: 'Ransomware Response Playbook',
description: 'Comprehensive response procedures for ransomware incidents',
type: types_1.IncidentType.RANSOMWARE,
severity: types_1.IncidentSeverity.CRITICAL,
version: '2.0',
author: 'Security Team',
approved: true,
approvedBy: 'CISO',
approvedAt: new Date('2024-01-15'),
automated: false,
requiresApproval: true,
estimatedDuration: 480, // 8 hours
tags: ['ransomware', 'critical', 'data-protection'],
compliance: ['NIST', 'ISO27001'],
phases: [
{
name: 'Initial Response',
order: 1,
requiredRole: types_1.ResponderRole.INCIDENT_COMMANDER,
estimatedDuration: 30,
steps: [
{
id: 'step-1-1',
title: 'Isolate Affected Systems',
description: 'Immediately disconnect infected systems from network',
action: types_1.ActionType.ISOLATE_SYSTEM,
parameters: {
method: 'network',
preserveEvidence: true
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'step-1-2'
},
{
id: 'step-1-2',
title: 'Activate Response Team',
description: 'Alert and assemble incident response team',
action: types_1.ActionType.NOTIFY_TEAM,
parameters: {
urgency: 'immediate',
includeManagement: true
},
automated: true,
requiresApproval: false,
timeout: 180,
onSuccess: 'step-1-3'
},
{
id: 'step-1-3',
title: 'Preserve Evidence',
description: 'Create forensic images of affected systems',
action: types_1.ActionType.COLLECT_LOGS,
parameters: {
type: 'full-forensics',
includeMemory: true,
includeDisk: true
},
automated: false,
requiresApproval: true,
timeout: 3600,
onSuccess: 'step-2-1'
}
]
},
{
name: 'Containment',
order: 2,
requiredRole: types_1.ResponderRole.SECURITY_ANALYST,
estimatedDuration: 120,
steps: [
{
id: 'step-2-1',
title: 'Identify Attack Vector',
description: 'Determine how ransomware entered the environment',
action: types_1.ActionType.CUSTOM,
parameters: {
investigation: ['email-gateway', 'web-proxy', 'vpn-logs']
},
automated: false,
requiresApproval: false,
onSuccess: 'step-2-2'
},
{
id: 'step-2-2',
title: 'Block Command & Control',
description: 'Identify and block C2 communications',
action: types_1.ActionType.BLOCK_IP,
parameters: {
source: 'threat-intel',
scope: 'global'
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'step-2-3'
},
{
id: 'step-2-3',
title: 'Disable Compromised Accounts',
description: 'Disable accounts showing signs of compromise',
action: types_1.ActionType.DISABLE_ACCOUNT,
parameters: {
criteria: 'suspicious-activity',
preserveAudit: true
},
automated: true,
requiresApproval: true,
timeout: 600,
onSuccess: 'step-3-1'
}
]
},
{
name: 'Eradication',
order: 3,
requiredRole: types_1.ResponderRole.SYSTEM_ADMIN,
estimatedDuration: 180,
steps: [
{
id: 'step-3-1',
title: 'Remove Ransomware',
description: 'Clean infected systems using AV/EDR tools',
action: types_1.ActionType.QUARANTINE_FILE,
parameters: {
method: 'edr-clean',
verifyRemoval: true
},
automated: false,
requiresApproval: true,
onSuccess: 'step-3-2'
},
{
id: 'step-3-2',
title: 'Reset Compromised Credentials',
description: 'Force password reset for all potentially compromised accounts',
action: types_1.ActionType.RESET_PASSWORD,
parameters: {
scope: 'affected-users',
requireMFA: true
},
automated: true,
requiresApproval: true,
timeout: 1800,
onSuccess: 'step-3-3'
},
{
id: 'step-3-3',
title: 'Patch Vulnerabilities',
description: 'Apply security patches to prevent reinfection',
action: types_1.ActionType.PATCH_SYSTEM,
parameters: {
priority: 'critical',
testFirst: true
},
automated: false,
requiresApproval: true,
onSuccess: 'step-4-1'
}
]
},
{
name: 'Recovery',
order: 4,
requiredRole: types_1.ResponderRole.SYSTEM_ADMIN,
estimatedDuration: 240,
steps: [
{
id: 'step-4-1',
title: 'Restore from Backup',
description: 'Restore data from clean backups',
action: types_1.ActionType.RESTORE_BACKUP,
parameters: {
source: 'immutable-backup',
verifyIntegrity: true,
testRestore: true
},
automated: false,
requiresApproval: true,
onSuccess: 'step-4-2'
},
{
id: 'step-4-2',
title: 'Verify System Integrity',
description: 'Ensure systems are clean before returning to production',
action: types_1.ActionType.CUSTOM,
parameters: {
checks: ['file-integrity', 'registry-scan', 'network-behavior']
},
automated: false,
requiresApproval: false,
onSuccess: 'step-4-3'
},
{
id: 'step-4-3',
title: 'Monitor for Reinfection',
description: 'Enhanced monitoring for signs of persistence',
action: types_1.ActionType.CUSTOM,
parameters: {
duration: '30-days',
alertThreshold: 'low'
},
automated: true,
requiresApproval: false
}
]
}
]
};
/**
* Data breach playbook
*/
exports.DATA_BREACH_PLAYBOOK = {
id: 'playbook-breach-001',
name: 'Data Breach Response Playbook',
description: 'Response procedures for data breach incidents with compliance focus',
type: types_1.IncidentType.DATA_BREACH,
severity: types_1.IncidentSeverity.CRITICAL,
version: '1.5',
author: 'Security Team',
approved: true,
approvedBy: 'CISO',
approvedAt: new Date('2024-01-10'),
automated: false,
requiresApproval: true,
estimatedDuration: 720, // 12 hours
tags: ['data-breach', 'compliance', 'gdpr', 'privacy'],
compliance: ['GDPR', 'CCPA', 'HIPAA'],
phases: [
{
name: 'Initial Assessment',
order: 1,
requiredRole: types_1.ResponderRole.INCIDENT_COMMANDER,
estimatedDuration: 60,
steps: [
{
id: 'breach-1-1',
title: 'Confirm Breach',
description: 'Verify that a data breach has actually occurred',
action: types_1.ActionType.CUSTOM,
parameters: {
validate: ['data-access-logs', 'exfiltration-evidence', 'threat-intel']
},
automated: false,
requiresApproval: false,
onSuccess: 'breach-1-2'
},
{
id: 'breach-1-2',
title: 'Identify Data Scope',
description: 'Determine what data was potentially compromised',
action: types_1.ActionType.COLLECT_LOGS,
parameters: {
sources: ['database-logs', 'access-logs', 'dlp-alerts'],
timeframe: 'extended'
},
automated: true,
requiresApproval: false,
timeout: 1800,
onSuccess: 'breach-1-3'
},
{
id: 'breach-1-3',
title: 'Legal Notification',
description: 'Notify legal counsel and compliance team',
action: types_1.ActionType.NOTIFY_TEAM,
parameters: {
teams: ['legal', 'compliance', 'privacy'],
urgency: 'immediate'
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'breach-2-1'
}
]
},
{
name: 'Containment & Investigation',
order: 2,
requiredRole: types_1.ResponderRole.FORENSICS_EXPERT,
estimatedDuration: 240,
steps: [
{
id: 'breach-2-1',
title: 'Stop Data Exfiltration',
description: 'Block ongoing data theft if still active',
action: types_1.ActionType.UPDATE_FIREWALL,
parameters: {
rule: 'block-outbound',
exceptions: 'business-critical'
},
automated: true,
requiresApproval: true,
timeout: 600,
onSuccess: 'breach-2-2'
},
{
id: 'breach-2-2',
title: 'Forensic Analysis',
description: 'Detailed forensic investigation of the breach',
action: types_1.ActionType.CUSTOM,
parameters: {
analysis: ['timeline-reconstruction', 'attacker-attribution', 'data-flow-mapping']
},
automated: false,
requiresApproval: false,
onSuccess: 'breach-2-3'
},
{
id: 'breach-2-3',
title: 'Impact Assessment',
description: 'Determine full impact including affected individuals',
action: types_1.ActionType.CUSTOM,
parameters: {
assessment: ['record-count', 'data-sensitivity', 'geographic-scope']
},
automated: false,
requiresApproval: false,
onSuccess: 'breach-3-1'
}
]
},
{
name: 'Notification & Compliance',
order: 3,
requiredRole: types_1.ResponderRole.LEGAL_COUNSEL,
estimatedDuration: 180,
steps: [
{
id: 'breach-3-1',
title: 'Regulatory Assessment',
description: 'Determine regulatory notification requirements',
action: types_1.ActionType.CUSTOM,
parameters: {
regulations: ['GDPR-72hrs', 'CCPA-notification', 'HIPAA-60days'],
jurisdictions: 'auto-detect'
},
automated: false,
requiresApproval: true,
onSuccess: 'breach-3-2'
},
{
id: 'breach-3-2',
title: 'Prepare Notifications',
description: 'Draft notifications for affected individuals and regulators',
action: types_1.ActionType.CUSTOM,
parameters: {
templates: ['individual-notice', 'regulatory-notice', 'media-statement'],
languages: 'affected-regions'
},
automated: false,
requiresApproval: true,
onSuccess: 'breach-3-3'
},
{
id: 'breach-3-3',
title: 'Send Notifications',
description: 'Send required notifications within compliance deadlines',
action: types_1.ActionType.NOTIFY_TEAM,
parameters: {
recipients: ['affected-individuals', 'regulators', 'partners'],
tracking: true
},
automated: false,
requiresApproval: true,
onSuccess: 'breach-4-1'
}
]
},
{
name: 'Remediation & Recovery',
order: 4,
requiredRole: types_1.ResponderRole.SECURITY_ANALYST,
estimatedDuration: 240,
steps: [
{
id: 'breach-4-1',
title: 'Fix Vulnerabilities',
description: 'Address security gaps that allowed the breach',
action: types_1.ActionType.PATCH_SYSTEM,
parameters: {
scope: 'breach-related',
verification: 'penetration-test'
},
automated: false,
requiresApproval: true,
onSuccess: 'breach-4-2'
},
{
id: 'breach-4-2',
title: 'Enhance Monitoring',
description: 'Implement enhanced monitoring and detection',
action: types_1.ActionType.CUSTOM,
parameters: {
controls: ['dlp-rules', 'behavioral-analytics', 'access-monitoring'],
retention: '1-year'
},
automated: true,
requiresApproval: false,
onSuccess: 'breach-4-3'
},
{
id: 'breach-4-3',
title: 'Credit Monitoring',
description: 'Arrange credit monitoring for affected individuals',
action: types_1.ActionType.CUSTOM,
parameters: {
service: 'enterprise-monitoring',
duration: '2-years',
coverage: 'comprehensive'
},
automated: false,
requiresApproval: true
}
]
}
]
};
/**
* Phishing incident playbook
*/
exports.PHISHING_PLAYBOOK = {
id: 'playbook-phishing-001',
name: 'Phishing Response Playbook',
description: 'Rapid response procedures for phishing attacks',
type: types_1.IncidentType.PHISHING,
severity: types_1.IncidentSeverity.MEDIUM,
version: '1.2',
author: 'Security Team',
approved: true,
approvedBy: 'Security Manager',
approvedAt: new Date('2024-01-20'),
automated: true,
requiresApproval: false,
estimatedDuration: 60, // 1 hour
tags: ['phishing', 'email-security', 'user-awareness'],
compliance: ['NIST'],
phases: [
{
name: 'Rapid Response',
order: 1,
requiredRole: types_1.ResponderRole.SECURITY_ANALYST,
estimatedDuration: 15,
steps: [
{
id: 'phish-1-1',
title: 'Quarantine Email',
description: 'Remove phishing email from all mailboxes',
action: types_1.ActionType.QUARANTINE_FILE,
parameters: {
scope: 'organization-wide',
messageId: '{{email.messageId}}'
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'phish-1-2'
},
{
id: 'phish-1-2',
title: 'Block Sender',
description: 'Block phishing sender and domains',
action: types_1.ActionType.BLOCK_IP,
parameters: {
target: ['sender-ip', 'sender-domain', 'embedded-urls'],
scope: 'email-gateway'
},
automated: true,
requiresApproval: false,
timeout: 180,
onSuccess: 'phish-1-3'
},
{
id: 'phish-1-3',
title: 'Reset Compromised Accounts',
description: 'Reset passwords for users who clicked links',
action: types_1.ActionType.RESET_PASSWORD,
parameters: {
users: '{{incident.affectedUsers}}',
forceMFA: true,
notifyUser: true
},
automated: true,
requiresApproval: false,
timeout: 600,
onSuccess: 'phish-2-1'
}
]
},
{
name: 'Investigation & Remediation',
order: 2,
requiredRole: types_1.ResponderRole.SECURITY_ANALYST,
estimatedDuration: 45,
steps: [
{
id: 'phish-2-1',
title: 'Analyze Attack',
description: 'Detailed analysis of phishing campaign',
action: types_1.ActionType.CUSTOM,
parameters: {
analysis: ['header-analysis', 'url-reputation', 'attachment-sandbox'],
submitToThreatIntel: true
},
automated: true,
requiresApproval: false,
timeout: 900,
onSuccess: 'phish-2-2'
},
{
id: 'phish-2-2',
title: 'Hunt for Variants',
description: 'Search for similar phishing emails',
action: types_1.ActionType.COLLECT_LOGS,
parameters: {
query: 'similar-sender OR similar-subject OR similar-attachment',
timeframe: '7-days',
action: 'quarantine-matches'
},
automated: true,
requiresApproval: false,
timeout: 1200,
onSuccess: 'phish-2-3'
},
{
id: 'phish-2-3',
title: 'User Notification',
description: 'Alert users about the phishing campaign',
action: types_1.ActionType.NOTIFY_TEAM,
parameters: {
template: 'phishing-alert',
includeIndicators: true,
trainingLink: true
},
automated: true,
requiresApproval: false,
timeout: 300
}
]
}
]
};
/**
* DDoS attack playbook
*/
exports.DDOS_PLAYBOOK = {
id: 'playbook-ddos-001',
name: 'DDoS Response Playbook',
description: 'Response procedures for distributed denial of service attacks',
type: types_1.IncidentType.DENIAL_OF_SERVICE,
severity: types_1.IncidentSeverity.HIGH,
version: '1.0',
author: 'Network Team',
approved: true,
approvedBy: 'Network Manager',
approvedAt: new Date('2024-01-18'),
automated: true,
requiresApproval: false,
estimatedDuration: 120, // 2 hours
tags: ['ddos', 'availability', 'network-security'],
compliance: ['NIST'],
phases: [
{
name: 'Detection & Mitigation',
order: 1,
requiredRole: types_1.ResponderRole.NETWORK_ENGINEER,
estimatedDuration: 30,
steps: [
{
id: 'ddos-1-1',
title: 'Activate DDoS Protection',
description: 'Enable DDoS mitigation service',
action: types_1.ActionType.CUSTOM,
parameters: {
service: 'cloudflare-magic-transit',
mode: 'aggressive',
scrubbing: true
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'ddos-1-2'
},
{
id: 'ddos-1-2',
title: 'Rate Limiting',
description: 'Implement aggressive rate limiting',
action: types_1.ActionType.UPDATE_FIREWALL,
parameters: {
rules: ['rate-limit-api', 'rate-limit-web', 'geo-blocking'],
threshold: 'emergency'
},
automated: true,
requiresApproval: false,
timeout: 300,
onSuccess: 'ddos-1-3'
},
{
id: 'ddos-1-3',
title: 'Scale Resources',
description: 'Auto-scale infrastructure to handle load',
action: types_1.ActionType.CUSTOM,
parameters: {
scaling: 'emergency',
targets: ['web-servers', 'load-balancers', 'cdn'],
budget: 'approved-emergency'
},
automated: true,
requiresApproval: false,
timeout: 600,
onSuccess: 'ddos-2-1'
}
]
},
{
name: 'Analysis & Long-term Mitigation',
order: 2,
requiredRole: types_1.ResponderRole.SECURITY_ANALYST,
estimatedDuration: 90,
steps: [
{
id: 'ddos-2-1',
title: 'Traffic Analysis',
description: 'Analyze attack patterns and sources',
action: types_1.ActionType.COLLECT_LOGS,
parameters: {
sources: ['cdn-logs', 'firewall-logs', 'netflow'],
analysis: ['source-ips', 'attack-vectors', 'botnet-signatures']
},
automated: true,
requiresApproval: false,
timeout: 1800,
onSuccess: 'ddos-2-2'
},
{
id: 'ddos-2-2',
title: 'Block Attack Sources',
description: 'Permanently block identified attack sources',
action: types_1.ActionType.BLOCK_IP,
parameters: {
sources: '{{analysis.malicious_ips}}',
level: 'bgp-blackhole',
duration: '30-days'
},
automated: true,
requiresApproval: true,
timeout: 900,
onSuccess: 'ddos-2-3'
},
{
id: 'ddos-2-3',
title: 'Update Defenses',
description: 'Update DDoS protection based on attack analysis',
action: types_1.ActionType.CUSTOM,
parameters: {
updates: ['waf-rules', 'rate-limits', 'geo-policies'],
testing: 'required'
},
automated: false,
requiresApproval: true
}
]
}
]
};
/**
* Playbook library
*/
class PlaybookLibrary {
/**
* Get playbook by ID
*/
static getPlaybook(id) {
return this.playbooks.get(id);
}
/**
* Get playbooks by incident type
*/
static getPlaybooksByType(type) {
return Array.from(this.playbooks.values())
.filter(p => p.type === type);
}
/**
* Get all playbooks
*/
static getAllPlaybooks() {
return Array.from(this.playbooks.values());
}
/**
* Add custom playbook
*/
static addPlaybook(playbook) {
this.playbooks.set(playbook.id, playbook);
}
/**
* Get recommended playbook for incident
*/
static getRecommendedPlaybook(type, severity) {
const candidates = this.getPlaybooksByType(type);
// Prefer playbooks matching severity
const exactMatch = candidates.find(p => p.severity === severity);
if (exactMatch)
return exactMatch;
// Otherwise return first available
return candidates[0];
}
}
exports.PlaybookLibrary = PlaybookLibrary;
PlaybookLibrary.playbooks = new Map([
[exports.RANSOMWARE_PLAYBOOK.id, exports.RANSOMWARE_PLAYBOOK],
[exports.DATA_BREACH_PLAYBOOK.id, exports.DATA_BREACH_PLAYBOOK],
[exports.PHISHING_PLAYBOOK.id, exports.PHISHING_PLAYBOOK],
[exports.DDOS_PLAYBOOK.id, exports.DDOS_PLAYBOOK]
]);
//# sourceMappingURL=playbook-library.js.map