1. Prerequisites
Before starting this runbook, ensure the following:
- Supply chain compromise has been identified or reported
- Incident ticket created
- Impacted vendor, software, or dependency identified
- Asset inventory available
- Software inventory available
- Cloud and SaaS inventories available
- Business owner identified
2. Step-by-Step Instructions
-
Identify the Affected Supply Chain Component
Determine:
- Vendor name
- Product name
- Product version
- Dependency name
- Integration type
- Deployment model
Identify whether the issue involves:
- Software supplier
- SaaS provider
- Cloud provider
- Managed service provider
- Open-source dependency
- Hardware supplier
Document findings.
-
Collect Publicly Available Details
Gather:
- Vendor advisory
- Security bulletin
- CVE references
- Vendor communications
- Threat intelligence reporting
- Known indicators of compromise
Determine:
- Nature of compromise
- Attack vector
- Known attacker activity
- Published impact guidance
Document findings.
-
Identify Organisational Exposure
Review:
- Asset inventory
- Endpoint inventory
- Server inventory
- Cloud inventory
- SaaS inventory
- Development environments
Identify:
- Affected systems
- Affected business units
- Affected users
- Affected environments
Document all impacted assets.
-
Determine Version Exposure
Review:
- Installed versions
- Running versions
- Deployment dates
- Update history
- Configuration details
Determine:
- Vulnerable versions
- Supported versions
- Patched versions
- Unsupported versions
Document findings.
-
Review Trust Relationships
Assess:
- API integrations
- Service accounts
- Federation relationships
- OAuth integrations
- Vendor access paths
- Administrative access
Identify:
- Direct trust relationships
- Indirect trust relationships
- Privileged access paths
Document findings.
-
Assess Potential Impact
Determine whether compromise could result in:
- Remote code execution
- Credential theft
- Data exposure
- Privilege escalation
- Malware deployment
- Supply chain malware propagation
- Administrative access abuse
Assign impact rating.
-
Review Available Telemetry
Review:
- Authentication logs
- EDR telemetry
- Cloud audit logs
- SaaS audit logs
- Administrative activity
- Network activity
Look for:
- Indicators of compromise
- Suspicious access
- Unexpected changes
- Suspicious execution
Document findings.
-
Determine Scope Expansion Requirements
Assess whether additional investigation is required for:
- Downstream dependencies
- Connected vendors
- Partner environments
- Shared infrastructure
- Shared credentials
- Shared integrations
Expand investigation scope where necessary.
-
Recommend Response Actions
Determine whether to:
- Disable integrations
- Restrict vendor access
- Patch affected systems
- Rotate credentials
- Revoke tokens
- Isolate systems
- Activate additional playbooks
Document recommendations.
-
Update Incident Record
Record:
- Affected products
- Impacted assets
- Exposure assessment
- Trust relationship review
- Telemetry findings
- Recommended actions
- Escalation decisions
Attach supporting evidence.
3. Post-Action
Upon completion:
- Ensure affected assets have been identified
- Ensure vulnerable versions have been documented
- Ensure trust relationships have been reviewed
- Ensure impact assessment has been completed
- Ensure response recommendations are documented
- Ensure incident ticket is updated
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Contributed to the Arcana Incident Response Documentation Framework.