Lost or Stolen Device Response Playbook

Lost or Stolen Device
Incident Response Playbook
Version history
Version Update Date Updated By Reason for Update
1.0 7/14/2021 FRSecure Initial Draft

Lost or Stolen Device – Incident Response Playbook
Purpose
To guide <ORGANIZATION> in responding to a lost or stolen device incident.
How to Use This Playbook

The steps in this playbook should be followed sequentially where appropriate. With many steps in the
Containment, Eradication, and Recovery steps, some overlap may occur and is expected.
Preparation
Note: Preparation steps should primarily be completed prior to an event or incident.
1. Determine the members of the Cybersecurity Incident Response Team (CSIRT).

a. The core CSIRT members should be comprised of individuals responsible for cybersecurity
only.
i. This may include some members of Information Technology roles, depending on the
organization size.
ii. The limited size of the core CSIRT is to assist with confidentiality and efficiency.
iii. The core CSIRT may be activated often to investigate security events that may or may
not result in an incident.
b. Assign roles and responsibilities to each member.
2. Determine extended CSIRT members.
a. This will often be Legal, Compliance, Public Relations, and Executive Leadership.
3. Define escalation paths.
a. Incidents may start as events, or as a lower impact/severity and then increase as more
information is gathered. Establishing an escalation path is critical to success.
4. Determine controls for lost or stolen devices.
a. Remote wipe capabilities.
b. At-rest encryption.
c. Multi-Factor Authentication.
Identification
1. Identify the nature of the device that has been lost or stolen.
a. Laptop?
b. Phone?
c. Tablet?
d. Other device such as desktop, server, other equipment, etc.
© FRSecure LLC., All rights reserved. | 6550 York Ave S #500, Edina, MN 55435 | 1-888-676-8657 | www.frsecure.com 2
2. Assess the criticality of data or accounts that may be present on the device.
3. Interview the user to understand the conditions around the lost or stolen device.
a. Was it misplaced?
b. Can you confirm that it was stolen?
c. Was the device logged in and active to any accounts?
4. Contact local authorities to report the loss.
a. Clear this process with legal counsel first.
Containment and Eradication

1. Disable or reset the password for any accounts that may be accessed via the lost or stolen device.
2. Perform remote wipe capabilities to eradicate any sensitive data on the lost or stolen device.
3. If the device is a laptop or other computer:
a. Disable any active directory accounts for the device.
b. Create alerts for any time the device contacts the network.
c. Disable any remote access associated with the device.
i. i.e. VPN accounts and certificates, Microsoft InTune, Exchange ActiveSync, JAMF, etc.
d. Remind user to disable or reset the password for any personal accounts in use on the device.
4. If the device is a phone, tablet, or other mobile device:
a. Disable active directory accounts for the device if applicable.
b. Disable any remote access associated with the device.
i. i.e. VPN accounts and certificates, Microsoft InTune, Exchange ActiveSync, JAMF, etc.
c. Create alerts for any time the device attempts to check-in or contact the network.
d. Contact the cellular provider to notify them that the device has been lost or stolen and any
associated hardware addresses should be blocked from access.
e. Remind user to disable or reset the password for any personal accounts in use on the device.
Recovery
1. Restore user work functionality with a trusted device.
2. Create alerts for any abnormal activity from the user accounts involved.
Lessons Learned
1. Conduct a meeting after the incident to discuss the following:
a. What things went well during the investigation?
b. What things did not go well during the investigation?
c. What vulnerabilities or gaps in the organization’s security status were identified?
i. How will these be remediated?
d. What further steps or actions would have been helpful in preventing the incident?
e. Do modifications need to be made to any of the following:
i. Remote management capabilities
ii. Application security
iii. Employee, IT, or CSIRT training
iv. Encryption capabilities

v. Access rights to sensitive information
2. Create and distribute an incident report to relevant parties.
a. A primary, and more technical, report should be completed for the CSIRT.
b. An executive summary should be completed and presented to the management team.
NEED HELP?
FRSecure is a full-service information security consultancy.
If you need assistance with anything in this resource, please don’t hesitate to reach out to us.
CONTACT US
(877) 767 – 1891 | 6550 York Ave S #500, Edina, MN 55435
For security emergencies, or quotes on services reach out to us here.
More resources

Lost or Stolen Device Response Playbook

Uploaded by

Copyright:

Available Formats

Lost or Stolen Device Response Playbook

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lost or Stolen Device Response Playbook

Uploaded by

Copyright:

Available Formats

Lost or Stolen Device

Incident Response Playbook

Version Update Date Updated By Reason for Update

1.0 7/14/2021 FRSecure Initial Draft

How to Use This Playbook

1. Determine the members of the Cybersecurity Incident Response Team (CSIRT).

Containment and Eradication

iv. Encryption capabilities

(877) 767 – 1891 | 6550 York Ave S #500, Edina, MN 55435

For security emergencies, or quotes on services reach out to us here.

You might also like