The first responder.
First responder is the first to arrive on the scene, their job is to respond
accordingly, notify laboratory staff or whatever.
They're going to bring the incident to the attention of others.
Now, the first responder arrives first at the crime scene, they may
actually be arriving based on a notification.
This may or may not be the person who
actually initially detected the incident, but they'll be the first to respond and
they may actually bring in, say, reinforcements.
It could be an end user, network
administrator, or any other individual involved in day to day network operations.
End users, everybody should be trained
that if you see something, say something, not to just rip off the catchphrase you
see the airports regarding TSA security and all that.
But if something looks suspicious, you should report it.
When your system behaves abnormally,
most people know how their system responds on a day to day basis.
When something out of the ordinary happens or it seems sluggish or laggy,
sometimes we're hesitant to respond to request that because we know they're going
to toast to Reboot the machine and that's it.
But if there's something that seems out of
whack, it should be reported, at least investigated.
Yeah, I mean, it's false positives, but
it's better to error on the side of caution than on the side of noncaution.
First responders and end users,
administrators should be trained to report incidents for verification.
The first responder plays a key role in
some response and investigation process that can be great help in the early
detection of the incident impact, evidence collection, preservation, etc.
First responder, roles and responsibilities.
First off, reporting the incident.
Alerting management in incident response teams.
Containing it, you want to first allow no further damage.
First order business is usually containing.
However, that's not always the action to take.
In some situations, there may not be any imminent danger.
You may actually allow the attacker to continue just to see what they're up to.
We'll talk a little bit more about that in our forensics discussion.
Identify the crime scene, collecting the complete information about the incident,
protecting the crime scene, documenting findings, preserving temporary and fragile
evidence that will also come into discussion in forensics, and then
packaging and transporting electronic evidence.
Some of this, again, crosses the lines
between forensic staff and incident response staff.
Things to know before a first response.
As a first responder, you should review the organization's incident response plan.
Everybody should be aware of at least the reporting structure, which includes the
name and contact information on the local incident handling and response
team, escalation procedures for reporting and handling a suspected incident, and
then containment actions for various types of incidents.
All of this is recorded in your incident response policy or plan.
By the way, that incident response policy or plan that is considered to be sensitive
internal information should not be shared with outside sources.