Incident Response Policies and Procedures

Question 1

What is an incident?

Answer 1

An incident is an event that disrupts normal business operations. An incident response plan outlines the steps to take following the discovery and confirmation of an incident.

Question 2

Incident-response procedure

Answer 2

There are six steps, including: Preparation
Identification
Containment
Eradication
Recovery
Lessons learned

Question 3

Preparation

Answer 3

Conduct training.
Conduct practice drills (mock data breaches).
Ensure all resources are approved and funded.

Question 4

Identification

Answer 4

Determine if there is a breach or violation of your security policy.

Question 5

Containment

Answer 5

Data preservation (drive seizure or copying).
Data integrity.
Chain of custody.

Question 6

Eradication

Answer 6

Use only for other types of breaches:

Determine root cause of breach.
Remove malware.

Question 7

Recovery

Answer 7

Reintroduce affected systems into production environment.
Re-imaging, restore from backup.
Monitor.

Question 8

Lessons learned

Answer 8

Discuss the breach.
What has the incident-response team learned after implementation of the incident-response plan?
What can the team do better next time?