CompTIA Security+ SY0-601 Cert Guide, 5th Edition

Chapter 27

Summarizing the Importance of Policies, Processes, and Procedures for Incident Response

This chapter covers the following topics related to Objective 4.2 (Summarize the importance of policies, processes, and procedures for incident response) of the CompTIA Security+ SY0-601 certification exam:

• Incident response plans

• Incident response process

  • Preparation

  • Identification

  • Containment

  • Eradication

  • Recovery

  • Lessons learned

• Exercises

  • Tabletop

  • Walkthroughs

  • Simulations

• Attack frameworks

  • MITRE ATT&CK

  • The Diamond Model of Intrusion Analysis

  • Cyber Kill Chain

• Stakeholder management

• Communication plan

• Disaster recovery plan

• Business continuity plan

• Continuity of operations planning (COOP)

• Incident response team

• Retention policies

A recent ...