Microsoft® Windows® 2000 Security Handbook

Building an Intrusion Response Team

This part of the chapter discusses how to build an IRT, or incident response team, within your organization. Having an IRT available 24 hours a day, 7 days a week, is important for your overall site security. It allows you to minimize the potential damage of an attack and lower the degree of risk that an attack will put your business goals on hold.

It is important here to mention that security breaches are rarely just technical issues. Often intra-organizational politics are involved. For this reason, I strongly recommend that you include at least one manager with some clout on your IRT. He or she can handle the political side of a security incident, allowing the technical people to act quickly and minimize ...