Fundamentals of Information Systems Security, 4th Edition

Incident Handling

As a reminder, an incident is an event that results in an actual or threatened violation of security policy. When an incident occurs, an organization needs to respond. The incident-handling process includes the following steps:

• Preparation

• Identification

• Notification

• Response

• Recovery and follow-up

• Documentation

You will learn about each of these steps in the following sections.

Preparation

The first step in an incident response program is to plan how to best respond to a variety of incidents and to build the incident response team (IRT). The IRT will have the training and documentation necessary to respond to incidents as they occur. Members of the IRT should be comfortable enough with one another to communicate freely ...