Digital Forensics and Incident Response - Second Edition

Engaging the incident response team

A CSIRT functions in much the same way as an urban or rural fire department. A fire department has specifically trained professionals who are tasked with responding to emergency situations with specialized equipment to contain and eradicate a fire. In order to engage a fire department, a citizen must contact emergency services and provide key information, such as the nature of the emergency, the location, and if there are any lives in danger. From here, that information is passed on to the fire department, which dispatches resources to the emergency.

The process of engaging a CSIRT is very similar to engaging a fire department. Internal or external personnel need to escalate indications of a cyber security ...