Considering an online banking or paypal-type web application with
What are best practice security measures for damage control, assuming
have been compromised.
I can only think of transaction logs that allow understanding and reverting all malicious transactions made. What else is commonly used?
Most banking sites limit the amount of money transferred in a specific timeframe. You will not be able to perform transactions that have a greater value than say € 5000.00 in a single 24 hour period without prior notice to your bank. This prevents/limits the most harmful cases of fraud.
Additionally all (at least all german banks) will use some sort of second factor per transaction that requires the users specific consent for every transaction.
A transaction log is always a good idea, and can be used as a valuable feature for your customers too.
It is difficult to balance damage control mechanisms and usability. Some mechanisms are deemed intrusive by a user while some can be abused by phishers for social engineering.
e.g.
Damage Control is pretty broad so I would actually have you categorize them more, for example ask:
What information does the company need to prevent a breach?
Ideally, nobody wants to be breached, or at a minimum we want our reaction time to be so good as to limit harm. This can be location based tracking, time of use tracking, habit tracking, standard Username/password w/ 2FA, device usage, policies etc.
This are things that a company does actively to:
What information does the company need to resolve the breach?
The adage of "it's not if but when something happens" is pretty prevalent. Once something occurs, what is the fastest way to resolve it? What are auditors, legal and/or law enforcement going to need or want?
This might be audit logs, transaction logs, location logs. This really focuses on:
How do you communicate with user?
The first two are straight forward, this one varies greatly since it's your direct interaction with users. This is really PR/company driven and the things you might think about are:
This last one honestly is not my forte. I personally want all the detail and feel the Who, What, When, Why, and How of a breach of should be fully communicated. I know plenty of people in the security community who don't feel this way, and certainly not my executive level who have to consider the entire company.
Above all, this is not an individual issue or even a single business units responsibility, you really need to drive it all levels.
