Digital Forensics and Incident Response - Second Edition

The war room

Another consideration when engaging a CSIRT is the need to have a single location from which the CSIRT can operate. There are several terms in use for the physical location a CSIRT can operate from, such as a SOC or a crisis suite, but a simple term is a war room. A war room can be set up as is necessary, or, in some instances, a dedicated war room is set aside. In the former case, an existing meeting room is purposed as the war room for the duration of the entire incident. This is often the preferred option for those organizations that do not have a high enough number of incidents to necessitate a dedicated war room. For those organizations that experience a higher number of incidents or more complex incidents, there may be ...