So lastly, we're going to talk
about what does this incident
response team do, we've covered
quite a bit of topics
throughout this throughout the
section of the course.
So essentially an incident response
team at the force level that's going
to be responsible for intrusion
detection.
So that first tier, an
incident response team, often
assumes the responsibility
for that intrusion detection.
And the team generally benefits
because it should be poised to
analyze incidents more quickly
and accurately based
on the knowledge of games of
intrusion detection technologies.
So that's at the very lowest
first tier level.
So after there's already been an
incident detected,
the response and remediation
process would come next.
And that's where the team would
essentially go in and
respond to that incident,
become aware of it, investigate
what's going on, and then determine
how the incident should be
remediated in order to keep it from
spreading or getting worse.
The next phase that
the incident response team would be
responsible for is advisory
distribution.
So a team may issue advisories
within the organization regarding
new vulnerabilities and threats.
So automated methods
should be used whenever appropriate
to disseminate information.
So, for example, the National
Vulnerability Database provides
information via email.
RSS feeds with new
vulnerabilities are added to it.
So advisers are often the most
necessary when new threats are
emerging, such as high profile
social or political events.
So celebrity wedding that
attackers are likely going to
leverage in social engineering.
Only one group within the
organization organization should
distribute computer security
advisories to avoid duplicated
effort and conflicting information.
So depending on how your team
is organized, you may have
an incident response team that is
also charged with these
advisory distributions.
Are you may have like a threat
intelligence aspect
separate from your incident response
team, but regardless that that
entity that sends out this
information should be coordinated
and it should be coming out from one
person. So, again, the policy
should stay within the organization
as responsible for this.
The other aspect of what incident
response teams are responsible
for education and awareness.
So education awareness
essentially are resource
multipliers.
The more users and type of staff
that know about detecting,
reporting, responding to incidents,
the less grain that there's going to
be.
I've just read an article the other
day that about 40 percent of people
who receive some type of phishing
email will click on the
link regardless
of whatever is is in the e-mail.
So still, it involves
educating those employees because
that 40 percent out there, that's
that's probably going to spend 90
percent of your time, if not more.
So getting those individuals
educated about what to do
is very important.
And lastly, information sharing.
So incident response teams often
participate in information sharing
groups such as Zachares
or Regional Partnerships,
according according to incident
response, teams often manage the
organization's incident response
sharing efforts.
They made aggregate information
related to incidents and share that
information with other organizations
and ensure that pertinent
information is shared within the
enterprise. So we'll
go into that a little bit later.
As far as threat intelligence
and information sharing and
reporting, but overall, I know
this was a was a long section, but
it's a very important section.
Obviously, people just want to start
diving into the incident response,
but it's important to have the
policy step first.
If you don't have that policy in
place and they often do something
wrong, you may violate
policy or law or you may
put the company, organization
or entity that you're working for at
risk. So it's very important
to have this policy codified
that everyone in the incident
response team be aware of
policies, rules and regulations
that they're supposed to follow in
order to ensure a cohesive
incident response.
So this concludes the
incident response policy
section of the course.
So I hope you enjoyed the
video.
And please check back and continue
watching more of the incident
response and advance forensics
cause.