Incident Response

Appendix B. Sample Incident Report

This is a sample incident report regarding a real-world situation where a technically-savvy manager arbitrarily shut down a firewall protecting a critical server cluster supporting a major e-commerce company. The names, titles, and locations have been changed.

Incident Chronology

09:10

Eric Austin (Chief Engineer) calls Security stating that he noticed the Denver Internet firewall is down.

09:17

Mark Brackett (Security Director) asks if the firewall is down due to the scheduled on-site work that he knows will happen soon. Steve Dormann (Operations Manager) is located and replies at 09:41 that that work will happen next week and that today’s problem is not related to any scheduled work activities. Various conference calls and ad-hoc meetings involving the cognizant managers are held to get a handle on the situation and develop courses of action.

11:24

Paula Neal (Network Architecture Manager) reports that she turned off the Denver firewall from home since she noted that the site was losing 7 out of 10 DNS queries to the rootserver located at that location.

14:30

Word that the Sprint T-1 to Denver (connecting to that rootserver) is down. Operations staff are unable to access the site to determine the scope of the problem.

16:30

Adam Cronin (Rootserver Technical Coordinator) reported that the Denver firewall was brought up earlier this afternoon; however, as of this writing, the T-1 connection from Sprint is still inoperative. Security can see that ...