Incident response is necessary for rapidly detecting incidents and restoring computing services after
a security event to assist organizations in establishing computer security incident response capabilities
and handling the National Institute of Standards and Technology created.
And I asked the Espey hundred six one our two publication which is a guide for computer security incident
handling.
If you follow the link in the resources for this lecture it will take you to a PTF version of this guide.
Now let's take a look at the incident response process handling an incident should include four major
phases preparation detection and analysis containment eradication and recovery and post incident activity.
The preparation phase is used to make sure that you have your ducks in a row in case there is an incident.
Some key examples would be equipment for analyzing compromised devices and the proper communication
channels junkets can be built with all the necessary tools so that you and your team are ready to quickly
respond to an incident.
The detection and analysis phase can be difficult due to there being so many event types and source
technologies.
Here are some and I asked you recommendations for making incident analysis easier and more effective.
Things like network profiling understanding normal behaviors with anomaly detection log retention policies
event correlation
and among other things keeping accurate time to make sure that you can properly correlate events.
Next we have the containment eradication and recovery phase.
This phase is primarily used to prevent additional damages.
Preserve evidence and to maintain now work availability as you'd expect.
The faster you can discover the attacking host and contain it the better off you are.
The longer a compromise host is on the network the more time the attacker has to spread and create back
doors on the network you'll want to look for log ins throughout the network and logs during the time
of the attack to make sure that the attacker didn't compromise other hosts on the network.
Once an incident has been contained evidence should be collected and documented with information such
as computer identifications and collection details.
Especially since you may need it for a legal proceeding.
After the storm clears eradication may be necessary to eliminate components of the incident such as
deleting malware and disabling breached user accounts as well as identifying and mitigating all vulnerabilities
that were exploited for some incidents.
Eradication is either not necessary or has performed during recovery.
In recovery administrators restore systems to normal operation confirm that the systems are functioning
normally and remediate vulnerabilities to prevent similar incidents.
The last to stop the incident response process is the post incident analysis phase is used to take a
step back and assess why the incident happened and what your organization could have done differently
to improve their incident response process.
This can be accomplished by holding internal meetings to discuss lessons learned and update processes
accordingly.