Building Internet Firewalls, 2nd Edition

Chapter 27. Responding to Security Incidents

The CERT Coordination Center (CERT-CC) reports that, despite increased awareness, the first time many organizations start thinking about how to handle a computer security incident is after an intrusion has occurred. Obviously, this isn’t a great approach. You need a plan for how you’re going to respond to a computer security incident at your site, and you need to develop that plan well before an incident occurs.

There isn’t room here to detail everything you need to know to deal with a security incident: attacks are many and varied and change constantly; responding to them can involve a byzantine assortment of legal and technical issues. This chapter is intended to give you an outline of the issues involved and the practical steps you can take ahead of time to smooth the process. Appendix A, provides a list of resources that may provide additional help.

Responding to an Incident

This section discusses a number of steps you’ll need to take when you respond to a security incident. You won’t necessarily need to follow these steps in the order they’re given, and not all of these steps are appropriate for all incidents. But, we recommend that you at least contemplate each of them when you find yourself dealing with an incident.

In Section 27.4, later in this chapter, we’ll look again at each of these steps and help you figure out how to work them into the overall response plan that you should develop before an incident actually occurs.

Rules for ...