Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from Incidents

© Eric C. Thompson 2018

Eric C. ThompsonCybersecurity Incident Responsehttps://doi.org/10.1007/978-1-4842-3870-7_11

11. Incident Response Story

Eric C. Thompson¹ 

(1)

Lisle, Illinois, USA

 

Following is an incident response story. The principals are an initial response team (IRT); a supplemental initial response team (SIRT), which the Chief Information Security Officer (CISO) and Vice President (VP) of Infrastructure join when events are escalated; the IT and extended initial response team (EIRT), in addition to the CIO and General Counsel; and, finally, an Executive Team that becomes involved once it has been determined that an incident has occurred and business impacts are probable. The team, once alerted to the initial incident, is expected to follow ...