Incident Response

Issues and Pitfalls

Naturally, there are any number of mistakes that can be made in setting up an incident response team. While we couldn’t possibly hope to capture all of them here (our editors have set a maximum length for this book!), this section describes some of the more common pitfalls and how to avoid them.

Business Comes First

In commercial enterprises, business comes first. Even in noncommercial enterprises, this is true to some degree. One of the cardinal rules of incident response is never to hinder the company’s ability to do business. That is, the incident response team should understand that it plays a supporting role to the company’s business activities. As such, it is important for the team to put the needs of the business first. A common mistake for incident response folks is that they focus exclusively on the technical aspects of an incident and its resolution, without fully appreciating the business situation. It is not enough to say, for example, that a web site has been compromised by Attacker X using Tools Y and Z from Remote School A; instead, it is also vital to understand what business process has been impacted by the web site’s incident, and what the financial impact is.

For example, assume that a high-traffic e-commerce web server of a major dot com company is compromised by a vulnerability. Shutting the server down in the middle of the work day for the investigation may be the best course of action from the perspective of the incident response team, ...