Incident Reponse Process [38]

There are several phases of the incident response process. They are:

1. Preparation [38]

   • Establishment and training of the incident response team

   • Acquisition of necessary tools and resources

   • Selection and implementation of controls

2. Detection and Analysis [38]

   • Detection of security breaches

   • Analysis of impacts and reach

3. Containment, Eradication, and Recovery

   • Containment of incidents

   • Mitigation of incident impacts

   • Eradication of incident cause

   • Recovery from incidents

4. Post-Incident Activity [38]

   • Incident reports:

     • • Cause

       • Cost

       • Future incident prevention steps

NIST Recommendations [38]

• "Acquire tools and resources that may be of value during incident handling." [38]

• "Prevent incidents from occurring by ensuring that networks, systems, and applications are sufficiently secure." [38]

• "Identify precursors and indicators through alerts generated by several types of security software." [38]

• "Establish mechanisms for outside parties to report incidents." [38]

• "Require a baseline level of logging and auditing on all systems, and a higher baseline level on all critical systems." [38]

• "Profile networks and systems." [38]

• "Understand the normal behaviors of networks, systems, and applications." [38]

• "Create a log retention policy." [38]

• "Perform event correlation." [38]

• "Keep all host clocks synchronized." [38]

• "Maintain and use a knowledge base of information." [38]

• "Start recording all information as soon as the team suspects that an incident has occurred." [38]

• "Safeguard incident data." [38]

• "Prioritize handling of the incidents based on the relevant factors." [38]

• "Include provisions regarding incident reporting in the organization’s incident response policy." [38]

• "Establish strategies and procedures for containing incidents." [38]

• "Follow established procedures for evidence gathering and handling." [38]

• "Capture volatile data from systems as evidence." [38]

• "Obtain system snapshots through full forensic disk images, not file system backups." [38]

• "Hold lessons learned meetings after major incidents." [38]

NIST Computer Security Incident Handling Guide [38]

Related Terms