Security Policies and Implementation Issues, 3rd Edition

Procedures for Incident Response

There are a number of key steps necessary to effectively handle an incident. These steps are outlined in the incident response procedures.

FIGURE 12-2 depicts the basic steps of an incident response procedure. Notice the model is built as a continuous improvement model. This means that as lessons are learned from incidents, they are used to improve the incident response program itself. Notice that the controls in place before the incident are improved by people outside the IRT. Implementation of control recommendations is typically not handled by the IRT members. Each of the steps in Figure 12-2 is discussed in this section of the chapter. The important takeaway is that incident response is not a one-time process. ...