>> We're going to transition to
the people within the incident response team.
Within that policy, you want to
have that incident response manager.
that incidence response manager,
he's going to be that single employee
who may have one or more designated alternatives,
but he should be in charge of
the overall incident response.
In your fully outsource model,
this person is going to oversee and
evaluate that outsourcer's work
which we were just talking about.
All other models generally have
a team manager and one or more
>> deputies who are going to
>> assume authority in the absence
of that managing director.
Managers typically perform a variety of tasks
including acting as a liaison with upper management,
and other teams and organizations.
They diffuse crisis situations and they
ensure that the team has the necessary personnel,
resources, and skills.
It's likely that the manager may not
even start responding to incidents,
but he's going to be that one who directs resources
and your personnel in order to
>> respond to that incident.
>> Managers should be technically
adept and have excellent communication skills,
particularly an ability to
communicate to a range of audiences.
You have to consider who that
manager's going to be talking to you.
He may be talking to someone who
is very technically proficient.
He may need to know those details,
but he may have to translate that to maybe a CEO
who may not have
the technical knowledge that that manager have.
Managers are ultimately responsible for
ensuring that incident response activities
are performed properly.
The next row we would have in the policy is going to be
your incident response lead and
members of your incident response team.
In addition to the team manager and the deputy,
some teams also have a technical lead or
a person who has strong technical skills and
incident response experience who's
going to assume oversight and
the final responsibility for
the final quality of the team's technical work.
The position of the technical lead should not be
confused with position of the incident lead.
Larger teams often assign
an incident lead as the primary POC for handling
certain incidents or specific incident and
the incident lead is held
accountable for the incident's handling.
Depending on the size of
the incident response team and
the magnitude of the incident,
the incident lead may not
actually perform the actual incident handling,
but rather coordinate the handlers activities,
gather information from the handlers and provide
incident response updates to
the group and ensure that the teams needs are met.
Members of the incident response team should have
excellent technical skills such as
>> system administration,
>> network administration, programming,
technical support, or intrusion detection.
Every team member should have good problem
solving skills and critical thinking abilities.
It's pretty common in some of
these incident response team
>> configurations to maybe have
>> a rotational basis of who's going to be
the technical lead or
the incident response lead for that day,
that week or that month.
What that does is it that's going to help
provide the ability for the team to
have crossover so that
individuals know how to
perform the certain functions and task.
If somebody happens to be out of work
or they happened to change jobs or get sick.
It helps that team function better
that way everyone knows exactly what's going on,
what's expected of those roles.
Moving on, we have incident
>> response inter-dependencies.
>> Management is going to be one of
the first inter-dependencies that
your team is going to have.
Management is going to establish the policy,
budget and the staffing for the teams.
Ultimately management is going
>> to be held responsible for
>> coordinating incident response
among the various stakeholders,
minimizing damage and reporting to Congress,
OMB, the GAO,
if you happen to be a government agency,
or maybe they're going to have to report to
shareholders or the CEO or CIO.
It's all going to depend on how
>> your organization works,
>> but ultimately your management is going to be
responsible for reporting to
>> those higher-level entities.
>> Another inter-dependency that you're going
to have is information assurance.
Information security staff members may need to
be involved in certain stages
of the incident handling process,
so prevention, containment, eradication and recovery.
For example, to offer network security controls,
firewalls, and rule sets.
It may extend over into your IA staff if you don't have
one of those individuals
on your incident response team to begin what.
IT support is going to be another inter-dependency.
IT technical experts, for example,
system and network administrators,
not only have the needed skills to assess,
but also usually have the best understanding
of the technology they manage on a daily basis.
This understanding can ensure that
the appropriate actions are
taken for the affected systems,
such as whether to disconnect an attacked system.
The next inter-dependency that you might
have is going to be the legal department.
Legal experts should review incident response plans,
policies and procedures to ensure
the compliance with law,
federal guidance, the right to privacy,
maybe your policy within your department,
regardless, the lawyers are
going to have to be involved to
make sure everyone is legally covered and protected.
In addition, the guidance of
your general counsel or legal department should be
sought if there's a reason to believe that
an incident may have legal ramifications,
including evidence collection,
prosecution of a suspect or a lawsuit,
or if there may be a need for some type
of memorandum of understanding or other
binding agreements involving liability
of limitations for information sharing.
Generally, if you've got some type of
legal question or legal requirement,
you're going to have to involve lawyers,
which we'll get into a little bit later
in our legal discussion.
Inter-dependencies, continued,
public affairs and media relations.
We've already hinted on that.
Depending on the nature and the impact of an incident,
a need may arise to inform
the media and by extension the public.
Again, after you've had that Target data breach
or the Sony hack,
you may end up having to inform
your customers about that incident.
Getting those public affairs and
media relations people involved is very important.
Human resources is another inter-dependency
that incident response teams
>> may have to coordinate with.
>> If an employee is suspected of causing an incident,
the human resources department may have
to get involved or essentially
assisting with disciplinary proceedings or
fighting input about that point.
Also, your business continuity planning department.
They may also have to be involved.
Organizations should
ensure that incident response policies
and procedures and business
continuity planning processes are in sync.
If your server is attacked,
maybe your PCP team is going to have to get involved
in order to transition to a different server.
Computer security incidents undermine
the business resilience of an organization.
Businesses continue, our continuity
planning professionals should be made aware of
incidence and their impacts so they can fine
tune the business impact assessments,
risk assessments, and continuity of operations plans.
Further, because businesses continuity planners have
extensive experience in minimizing
operational disruption during severe circumstances,
they may have that valuable information
that can help the team remediate
those incidents and get
back to normal operating procedures.
An example of that could be a denial of service.
The next inter-dependency that you might experience
is physical security and facilities management.
Some incidents occur through breaches of
physical security and
not necessarily technical security,
or they may involve coordinated
logical, and physical attacks.
The incident response team may
also need access to facilities during
their response and will also need to secure
an area to store the recovered data and/or artifacts.