>> We move on to the elements
of an incident response policy.
One of the first topics is that
the policy governing incident response
is going to be highly
individualized to each organization.
No organization is going to have
the same incident response policy
because each organization is going to
have different threats that they face.
They're going to the different levels
of risk and different priorities.
But nevertheless, most policies
will include some of the same key elements.
The first element that we want to talk
about is the statement of management commitment.
Anyone who's been in any type of organization
for longer than a day knows that if
management doesn't really have priority on
certain task and
certain elements within the organization,
then they just fall by the wayside.
If it's not important to management,
why should it be important to the employees?
The statement of management commitment
is very important to see
that managers and leaders within
an organization care about incident response.
Then the next part of the policy is that
you need to have a purpose and objective of the policy.
What do you hope to
accomplish with your incident response policy?
What do you hope to accomplish by doing forensics?
The next portion of your policy is going
to be the scope of the policy.
Who does it apply to and under what circumstances?
Then you want to define essentially
your computer security incidents
related terms, because again,
every organization is going
to have different terminology,
different types of incidents.
You may have also other individuals coming into
the organization with
different backgrounds and experiences.
Essentially, you want to codify what types of incidents
that you have and the terminology that you're going to
use when referring to these incidents.
The next element of the policy,
is you're going to want to have
some type of organizational structure.
You're going to want to define the roles and
responsibilities and the level of authority
because the authority is
always very important in an organization.
Before you start doing
certain tasks and performing certain roles,
you want to understand what authorities do you have,
what legally can you or cannot do,
what is allowed by your
organization's policy and what is not.
Essentially the authority should
include what the incident response team can confiscate,
what they can disconnect,
how they monitor suspicious activity,
the requirements for reporting
certain types of incidents,
the requirements and guides for
external communication and information sharing.
What can be shared with whom?
When can it be shared over what channels?
Sometimes you're going to have to get
approval to share certain types of
information because it may
essentially damage the reputation of the company,
or it may have
proprietary information that you
don't want to necessarily get out.
The policy will essentially need
to cover those types of information.
Then if you have to hand off the
>> incident or escalate it,
>> that needs to be stated in the policy as well.
Then the prioritizing of the incidence and
the severity and the ratings that will help
the incident response team and those who are
reporting or triaging an incident
be able to identify which incidents should be,
essentially put at a higher priority or
investigated first or remediated first.
The next element that we want to
talk about is performance measures.
What does success look like?
How should incidents be
taken care of in a certain time-frame?
Where do incidents need to go?
Being able to measure some type of
performance and meaning that the incident response team
is performing as they should or if
they might need a course correction is very important.
Then lastly, as you're reporting and contact forms.
Because organizations are large,
incident response teams may be spread
out over the United States,
they could be spread out globally,
and not everyone within an organization
may be familiar with every other person,
so it's important to have
contact forms for individuals across the enterprise.
We're going to talk about more elements
of the incidents response plans.
Organization should also have
a formal focused and coordinated approach
to responding to incidents,
including an incident response plan that provides
the road map for implementing
the incident response capability.
Each organization needs a plan that makes
it unique requirements which
relates to the organization's mission,
size, structure, and functions.
Again, not every organization is going to have
the same methodology when
responding to certain incidents.
Some organizations may have
in-house incident response team,
other organizations may have
external incident response teams,
you may have a combination of the above.
It's important to list that so each individual on
the incident response team
knows exactly how they should go
about managing and handling these incidents.
Again, we are going to just summarize.
The incident response plan
should include the following elements,
so it's going to have your mission,
your statement and goals,
your senior management approval,
organizational approach to incident response,
how the incident response team will communicate with
the rest of the organization
and with other organizations,
metrics for measuring the incident response capability
and its overall effectiveness,
road map for maturing the incident response capability,
and how the program fits into the overall organization.
If you include these elements within
your incident response plan
and you're able to answer these questions,
it's likely that you will have
a very successful incident response team.
Another thing that I want to talk about
is essentially media policy.
Because the way that
the 21st century works in the 24 hour news cycle,
especially for large organizations,
when you have an incident such maybe as
the target data breach or the Sony hack,
it's important that if you're going
to talk to the media that you have
a defined media policy
because if you do not have that policy,
you can end up making you or
the organization look bad and you could
suffer additional loss on
top of the incident that you're having to respond to.
When looking at the policy,
the incident handling team should have
an established media communications
procedures that will comply with
the organization's policies on
media interaction and information disclosure.
Then for discussing the incidents with the media,
organizations might find it beneficial to
designate a single point of
contact or at least one backup,
and that's important on many aspects
>> because one is that
>> it assures a string lined focus on the media.
You don't have two or three individuals
saying two or three different things to reporters.
Then you're going to have someone who has
the experience of interacting
with reporters on a daily basis,
so it's not catching that person off guard,
so say who just got assigned that noble task.
Then the following actions are recommended for
preparing these designated contacts and
should also be considered for preparing
others who may be communicating with the media.
Conduct training sessions on
interacting with the media regarding incidents,
which should include the importance of
not revealing sensitive information,
such as technical details of
countermeasures that could assist other attackers,
and the positive aspects of communicating
important information to
the public fully and effectively.
If you've never dealt with the media before,
it can be quite daunting task.
It's important to just have
someone who has training in doing that,
who knows what they look like in front of the camera to
be able to represent themselves and
the organization in the best possible way.
Next, you're going to want to establish
procedures to brief media contacts on
issues and sensitivities regarding
a particular incident before
discussing it with the media.
The person that you're going to have
dealing with the media,
they may be great interacting,
they may be great on camera,
but they may not be the most technically savvy person
that's out there.
It's important to pre-brief
that person before they actually speak to the media,
so they'll be aware of certain questions that may be
paused by the media regarding an incident.
For example, an organization may want
members of its public affairs office and
legal department to participate
in all incident discussions with the media.
You want to maintain a statement of
the current status of the incident,
so communications with the media
are consistent and up-to-date.
You want to remind all staff of
the general procedures for handling media inquiries,
and then you want to hold mock interviews
and press conferences
during the incident handling procedures
>> of your response.
>> That should identify examples
of questions that might be asked by the media,
who attacked who, why would you attack,
when did it happen, how did it happen,
did this happen because you
have poor security practices,
how widespread is the incident,
what steps are you taking to determine what
happened and how to prevent a future occurrence,
what is the impact of the incident,
was any personally identifiable or PI exposed,
and what is the estimated cost of the incident?
Those are just examples of
questions that reporters might ask and
your media contact with essentially want to be
able to answer during that incident.