Incident Handling

Question 1

Incident Handling Phases

Answer 1

“Phase 1: Preparation
Phase 2: Identification
Phase 3: Containment
Phase 4: Eradication
Phase 5: Recovery
Phase 6. Lessons Learned”

Question 2

Phase 1: Preparation

Answer 2

“Establish applicable policies?
Build relationships with key players?
Build your response kit?
Create incident checklists?
Establish communication plan?
Perform threat modeling?
Build an incident response team?”

Question 3

Phase 2: Identification

Answer 3

“In this phase of the process, you determine whether or not an incident exists.
An event is defined as any observable occurrence in a system and/or network.
An incident is defined as an adverse event in a system and/or network or the threat of such an event.
Essentially, an event is anything that happens in your environment and an incident occurs when that event threatens or actually does harm to your environment.”

Question 4

Phase 3: Containment

Answer 4

“During the containment phase, you want to ensure that the incident
does not get any worse; if your company is planning on pursuing legal action, this is the phase in which you gather evidence.

To contain the incident, you might want to remove the system from the network; however, because it is a revenue generating system, management might not allow this to take place.

This is where the negotiating begins and it is important that you or your team has discussed these scenarios in advance with management in the preparation phase, so that you are prepared for them when they arise.
Some tasks that occur during the containment phase include:
Prevent further contamination of the system or network?
Preserve Evidence?”

Question 5

Phase 4: Eradication

Answer 5

“during this phase that you analyze the information that you have gathered to determine how the attack took place.
To prevent the incident from happening again”

Question 6

Phase 5: Recovery

Answer 6

“The recovery phase of this methodology is where you place the system back into the production environment.
In this phase, you work with your QA and business partners to validate that the system recovery is successful.
This involves testing the system to make sure that all business processes and function are back to normal.”

Question 7

Phase 6. Lessons Learned

Answer 7

“Utilize what you learned during the handling of the incident to
enhance and improve your incident-handling process.
? Complete the incident report and present findings to management.
? Look for ways to improve the process both from a technical and administrative aspect.
? Have a clearly defined plan for implementing these improvements.”