Incident response process

Question 1

What is a incident?

Answer 1

This is where a security measure has been breached, and your company could be at risk

Question 2

What is the incident response process

Answer 2

Preparation>Identification>Containment>Eradication>Recovery>Lessons learned

Question 3

Incident Response Process-Idenetiofacaion

Answer 3

Analysis of events, components of this are monitoring, detecting, alerting, and logging

Question 4

Containment - IRP

Answer 4

Response phase, interaction with affected systems, system shutdown, system isolation

Question 5

Eradication - IRP

Answer 5

Running a deep scan and quarantine, then removal, wipe and load, verification of eradication

Question 6

Recovery - IRP

Answer 6

Verification of eradication (required), rebuild from backups, reintroduce systems, restore back to normal state

Question 7

Lessons learned - IRP

Answer 7

Ask questions, what went right? what went well? what went wrong? What was affected? How was it affected? How was the attack accomplished? What are the improvements that can be done