Incident Response

Preface

As businesses and other institutions increase their online presence and dependency on information assets, the number of computer incidents also rises. Consequently, these organizations are finally increasing their security postures. This is accomplished in three stages. First, organizations must develop and implement security plans and controls in a proactive effort. Secondly, they must work to ensure their plans and controls are effective by continually reviewing and adapting them to ensure that appropriate security is always in place. And finally, when controls are bypassed either intentionally or unintentionally, organizations must be prepared to act quickly and effectively to minimize the impact of situations. The goal is to prevent an operational security problem from becoming a business problem that impacts revenue. This book provides guidelines to help organizations plan their responses to incidents and minimize any negative impact to their businesses.

When responding to an incident, there are a number of considerations:

• What happened?

• What has been damaged?

• What business process are being impacted and how do we minimize those impacts?

• Who did it and what did they do?

• How did they do it?

• Can and should any forensic information be preserved?

• What are the legal issues?

• Is the damage continuing or has the activity been contained?

Waiting until the incident occurs is too late to begin planning how to address the situation. Incident response planning requires both administrative ...