Software Quality Assurance

131inCident ManageMent

or modification of critical files, could happen for several reasons

other than a security incident, including human error. To determine

whether a particular event is actually a security incident needs to be

analyzed. It may be necessary to cooperate with other technical and

information security personnel to make a decision.

e IRT should work quickly to analyze and validate each inci-

dent. When the team believes that an incident has occurred, the

team should rapidly perform an initial analysis to determine the inci-

dent’s scope, such as which networks, systems, or applications are

affected; who or what originated the inciden ...