Digital Forensics and Incident Response - Third Edition

Table of Contents

Preface

Part 1: Foundations of Incident Response and Digital Forensics

1

Understanding Incident Response

The IR process

The role of digital forensics

The IR framework

The IR charter

CSIRT team

The IR plan

Incident classification

The IR playbook/handbook

Escalation process

Testing the IR framework

Summary

Questions

Further reading

2

Managing Cyber Incidents

Engaging the incident response team

CSIRT engagement models

Investigating incidents

The CSIRT war room

Communications

Rotating staff

SOAR

Incorporating crisis communications

Internal communications

External communications

Public notification

Incorporating containment strategies

Getting back to normal – eradication, recovery, and post-incident activity

Summary

Questions