3.3 Incident Response and Recovery Procedures Flashcards
(E-Discovery)
The electronic discovery of evidence
(E-Discovery)
Electronic inventory and asset control
must identify, track, classify, and assign ownership for important assets
(E-Discovery)
Data Recovery
the process of recovering data from damaged, failed, corrupted, or inaccessible storage devices when it cannot be accessed using normal data access methods
(E-Discovery)
Data Storage
strategies that includes backups to provide for recovery in the event of primary storage failure
(E-Discovery)
Data Ownership
establish data owners and responsibility for all custodial duties
(E-Discovery)
Data Handling
department managers that make decisions on how certain data should be used and managed
-data custodians are IT personnel that implement the decisions made by the data owners
(E-Discovery)
Legal Holds
process that permits organizational compliance with legal directives to preserve all digital and paper records in anticipation of possible litigation
(E-Discovery)
Data Retention policies
any data marked as legally requested data for destruction are immediately and indefinitely suspended until all relevant litigation has concluded
(Data Breach)
The release of information to an unauthorized party or environment
(Data Breach)
Detection and collection
examination of hardware and software alerts, surveillance cameras, logs, network traffic, error messages, and feedback from employees and customers
(Data Breach)
Data analytics
classifying the breach and assigning a priority level in order to ensure that the appropriate levels of attention and resources are provided to the incident
(Data Breach)
Mitigation
Encryption is gold standard
Encryption can protect data during storage, transit, and processing
(Data Breach)
Minimize
data minimization efforts can play a key role in both operational efficiency and security
“Dont keep what you dont need”
(Data Breach)
isolation
containing the incident to a limited area to prevent spreading
(Data Breach)
Recovery/reconstitution
?
(Data Breach)
Disclosure
the company must disclose all relevant data breach details to business stakeholders such as managers, human resources, and team leads
(Data Breach)
Response
when a data breach occurs, the firm must be ready to respond immediately
(Facilitate incident detection and response)
Hunt teaming
a comprehensive process of security teams seeking out any signs of attack against the organizational network
(Facilitate incident detection and response)
Behavioral Analytics
process of measuring and identifying how entities typically act, or behave, and later comparing these measured behaviors to future samples of potentially spot deviations
(Facilitate incident detection and response)
Heuristic Analytics
intelligently gathers data points from various host and network data sources within a specific environment
- it then scores each of these data point relative to one another to determine if the entity is threatening or not
(Facilitate incident detection and response)
Establish and review system, audit, and security logs
SIEM solutions are critical components of automated security systems used in continuous monitoring
(Incident and emergency response)
Chain of custody
detailed record of evidence handling, from its collection, preservation, and analysis, to representation in court and disposal
(Incident and emergency response)
Forensic analysis of compromised system
digital forensics is the application of scientific methods to electronic data systems for the purposes of gathering specific information from a system
(Incident and emergency response)
Continuity of operations
a continuity of operations plan refers to a government’s processes for maintaining functionality in the event of a serious public event
