So here's an example
of what essentially
someone might consider to be a
very simple question.
However, the answer to the question
doesn't necessarily turn out to
be the best.
And when it comes to establishing
your worldview, I was curious, what
newspapers and magazines did
you regularly read
before you were tapped?
For this to stay informed,
to understand most of them,
again, with a great appreciation for
the press, for the media,
I mean, I'm curious to hear
all of them, any of them that
have been in front of me
over all these years.
I have been I have a vast
variety of sources
where we get our news.
Alaska isn't a foreign country
where it's kind of suggested, it
seems like, wow, how could
you keep in touch with the rest of
Washington, DC may be thinking and
doing when you live up there in
Alaska? Believe me, Alaska is
like a microcosm of America.
So obviously that wasn't
the best response
that she could have possibly given.
I'm sure that Sarah Palin has
talked to the media at least once
or twice in the past and kind of
knows some of the questions that
they might be asking.
So it could have been good for her
to maybe prepare a statement
ahead of time or at least think of
some of the questions that
could be asked.
And also essentially
was a very simple question that
turned out to have a long
and drawn out answer that didn't
really cast her in the best possible
light. So essentially,
Katie Couric was just asking for
Sarah Palin to name one newspaper,
any newspaper, and
maybe she was flustered,
but she wasn't able to write an
answer. It didn't make her look the
best.
So moving
on, communicating with
law enforcement might also
be something that an organization
would have to do, depending
on the type of incident
that you're going to encounter.
So law enforcement should also be
contacted through designated
individuals in a manner consistent
with the requirements of the law
enforcement agency and
the organization's procedures.
You may also want to have a
designated person that does this
again, like the media, someone who
is familiar with contact law
enforcement, someone who knows the
questions that law enforcement ask.
And it just helps build
relationships so many
organizations prefer to have.
One incident response team member
is the primary point of contact
with law enforcement.
And this person should be familiar
with the reporting procedures for
all relevant law enforcement
agencies and prepared to
recommend which agency, if any,
should be contacted.
And note that the organization
typically should not contact
multiple agencies because doing
so might result in jurisdictional
conflicts.
So, again, it's just important to
have in that policy
who does contact law enforcement?
When should they contact law
enforcement and what issues should
they report? So that's essentially
just going back and making sure
that's codified in your instant
response policy.
So communicating with outside
parties, we've talked about the
media, we've talked about
law enforcement organizations.
There may be other entities that
you're going to have to communicate
with outside
of the organization.
One of the first ones will be
your ISP.
So an organization may
need assistance from its ISP,
blocking a major network based
attack and or tracing it.
So it would be common
that someone within the incident
response team has to communicate
with the ISP.
So it might be beneficial
to the organization to figure
out points of contact for that ISP
for certain types of events
that will streamline the process
for dealing with the incident
and then owners of attacking
address. So oftentimes
when an organization is attacked, it
may not be
from within their organization,
probably be from outside of the
organization.
So essentially
they're going to have to communicate
with maybe another organization's
ISP.
So the tax are originating from an
external organization's IP address
based incident.
Handgrips may want to talk to the
designated security contact
organization to alert them
to the activity or to ask them
to collect evidence.
It is highly recommended to
coordinate such communications with
U.S. cert or
some other type of entity
that deals with incident response.
So whoever your
organization designates
to, to report to or coordinate
with, it's important
to get with that entity in order to
help coordinate that response
for an external ISP.
You may also want to talk with
software vendors, incident
handlers.
They want to speak with a software
vendor about suspicious activity
that they're seeing within software.
This contact could include questions
regarding the significance of
certain log entries are known,
false positives for certain
intrusion detection signatures
for minimal information regarding
the incident may be needed.
Need to be revealed, more
information may need
to be provided in some cases, for
example, if a server appears to
have been compromised through an
unknown software vulnerability.
You would want to go back to that
software vendor to see
if they may be knew of the
vulnerability or are there some
type of patch that you can
can implement?
And software vendors may also
provide current information, such as
no threats to help organizations
understand the current threat
environment.
So secure is just building that
network.
Obviously, if you could go out and
talk to the software vendors before
you had an incident, that
would generally be the best way
to handle them.
You may also want to talk with other
incident response teams
so an organization may experience
an incident that is similar to the
ones handled by other teams.
So by proactively sharing this
information that facilitates
a more effective and efficient
incident response handling
procedure.
So talking to other teams
can provide advance warning that can
increase your preparedness,
helps you develop some type of
situational awareness.
So groups such as the form
of the incident response and
security teams first are
the government form of the incident
response and security teams
first.
And then the anti phishing working
group are
our common incident response teams
and they promote information sharing
among each of the groups.
So you may also have to communicate
with the external affected parties
and an incident may affect
external parties directly.
For example, an outside organization
may contact your organization
and claim that one of the
organization's users is attacking
them. So that
may be something that you'll have to
deal with as well.