So the types of incident response
teams is the next topic we're going
to talk about.
So the first type of
incident response team is
going to be the central incident
response team.
And with the central incident
response team is going to be a
single team will respond
to and handle incidents throughout
the organization.
And that model is going to be very
effective for small organizations
and for organizations that don't
have a very large geographic
footprint.
The next type of team that you might
see is a distributed
incident response team.
And this type of team is good for
an organization that will have
multiple incident response teams,
and each of those teams will be
responsible for a
logical or physical segment
of the organization.
So the model is going to be very
effective for large organizations,
essentially, that have one team
for division or for organizations
with major computing resources
at different locations.
So you might have one team
per geographic location
or one team per major city.
Nevertheless, the team should be
part of a single and cohesive
coordinated entity so that the
incident response process
is going to be consistent across the
organization.
And that information is shared with
each of the teams.
And this is going to be important
because with multiple teams,
they may see different components
of the same incident or they
want to handle incidents in the same
manner. So it's just going to be
that consistency across
all of your incident response teams.
The next type of team that you're
going to see is going to be a
coordinating team.
And with the coordinating team,
an incident response team will
provide advice to other teams
without really having the authority
over those teams.
So an example of that is going to be
a department wide team that may
assist some other agencies,
team or some other team within the
organization.
And that model can be thought of
as essentially a sea search.
So you might see
one or two of these across
an organization or you might see
kind of a hybrid, depending
on what type of organization
that you're dealing with.
So the next topic
is going to be the incident response
team staffing.
So the first
part of the organization
team is going to be its employees.
The and these are going to be the
people that essentially perform all
the incident response work.
And they may have limited technical
and administrative support from
contractors.
Then you're going to have
essentially those that are partially
outsourced.
So the organization outsources
portions of the incident response
work. So all the incident response
duties can be divided among
the organization.
And one or more outsourced is in
many ways a few arrangements
have been become commonplace.
So the most prevalent arrangement is
for the organization to outsource
twenty four hours a day, seven days
a week, monitoring them, intrusion
detection, sensors, firewalls
and other security devices
to offset managed security service
providers.
So the MSP identifies
and analyzes suspicious activity,
and they're going to report each
protected incident to the
organization's incident response
team.
Then, after the MSP
essentially reports that
information, the team will then
be able to go in and decide and
categorize what type
of incident that they have going
back to that that earlier
discussion about policy,
of how grave the incident
might be and what type of response
is needed.
And then some organizations perform
basic incident response, work
in-house and can call on contractors
to assist with handling of
incidents, particularly those
that are more serious or more
widespread, essentially have
two diametrically opposed types of
teams, one that is
essentially taking care of the
monitoring 24 hours a day
and then where you might actually
monitor yourself and then
call in some some expertize
to to help deal
with that incident.
The next incident response team, the
type of team you're going to see, is
going to be a fully outsourced
team.
And the organization completely
will outsource its incident response
work typically to
an onsite contractor.
And this model is most likely to
use when the organization needs a
full time onsite incident
response team, but does not
necessarily have enough personnel
or qualified personnel available.
It is assumed that the organization
will have employees supervising and
overseeing the
incident response team
considerations.
Does your organization need
twenty four seven availability?
So most organizations need insurgent
support staff to be available 24/7
because most organizations
today are
spread out globally or
they're going to have a
twenty four hour up time on
their server.
So this typically means that the
incident handlers can be contacted
by phone, but it can also mean
that an on site presence is
required.
So real time availability is
the best for incident response
because the longer that incident
last, the more potential there
is for damage and loss.
So real time contact is needed
when working with other
organizations, for example,
tracing an attack back to its
source.
So the quicker you can get to an
incident, the more likely
it is that you can minimize the
damage. So 24/7
is something that you're probably
going to see very frequently.
So full time and part time team
members, organizations
with limited funding, staffing or
incident response needs
may have only a part time
incident response.
Team members and these
members might be serving as
more of a virtual incident response
team. And in this case, the
response team can be thought of as a
kind of volunteer fire department.
So when an emergency occurs, the
team members are contacted rapidly
and those who assist
or can assist do so.
Likely, it's possible that these
individuals have other jobs
or other duties that may take them
away from incident response or
doing something completely separate
could be the 30 people,
but it's unknown.
But an existing group such as the IT
Help Desk can act as
the first PFC for incident report.
And then the Help Desk members could
be trained to perform the initial
investigation and data gathering
and then alert the incident response
team. It appears that a serious
incident has occurred.
Another consideration
is going to be employee morale.
So incident response
work is very stressful.
Often these employees
are going to be on call
and this combination of the
stressful work and being control
essentially is going to make
incident response.
Team members become overly stressed,
and many organizations will struggle
to find individuals who are willing,
able and experienced
and skilled to participate
in twenty four hours of work.
So incident response team
considerations continues.
You may have segregated roles,
particularly due to cost.
So cost is a major factor, as
we discussed earlier,
especially if employees are required
to be on site.
Twenty four seven.
So organizations may fail to
include incident response, specific
cost and their budgets, such
as sufficient funding for training
and maintaining skills.
And because incident response teams
work with so many facets of I.T.,
its members are going to have to
have a much broader knowledge of it
and other staff members.
So they must understand how to use
the tools of the incident response,
such as digital forensic software,
which we're going to get into a
little later.
Other costs that may be overlooked,
our physical security for the team's
work areas and communications
mechanisms.
So if you have an organization that
wants to have an incident response
team, they may not understand
that they need to have persay, maybe
a Faraday cage area for someone
to conduct forensic
investigations.
So another consideration is going to
be staff experience.
Incident handling requires
specialized knowledge and experience
and several technical areas.
So the breadth and depth of
knowledge requires
requirements are going to vary
based on the severity of the
organization's risk.
So outsourcers may possess
deeper knowledge of intrusion
detection and forensics
vulnerabilities, exploit
and other aspects of security
that employees within the
organization might be able to
provide.
And also MSPs
may be able to correlate events
among customers so that they
can identify new threats quicker
and the individual than
individual customers could.
However, technical staff members
within the organization
will usually have a better knowledge
of the organizations operating
environment than they may be an
outsider, which can be
beneficial in identifying false
positives associated with
the organization, specific behavior
and the criticality of the response
required.