CHAPTER SUMMARY

You learned in this chapter what incident response policies are needed to respond effectively to security breaches. It’s important that policies define what an incident is. They should also state clearly how to classify an event. You also learned how to build a team charter. The chapter examined the difference between on-site response teams and teams that facilitate responses. The chapter discussed key roles and responsibilities within the team during an incident. The chapter discussed how incident plans are built, including the importance of a BIA assessment. Additionally, the chapter discussed the alignment among the BIA, BCP, and DRP.

The chapter also examined typical procedures you should follow during an incident. It examined key decisions that are needed at each step in responding to an incident. This includes containing the incident and gathering evidence. The chapter also discussed best practices and the importance of using outside firms to supplement an organization’s skill sets. Finally, the chapter explored how these principles are applied in the real world. Implementing well-defined incident response policies takes significant time and effort. However, the value in containing threats and limiting damage to an organization outweighs the costs.

KEY CONCEPTS AND TERMS

Business continuity plan (BCP)

Business continuity representative

Business impact analysis (BIA)

Disaster recovery plan (DRP)

Due care

Human resources representative

Incident

Incident response team (IRT)

Information security representative

Information technology subject matter experts

IRT coordinator

IRT manager

Legal representative

Public relations representative

Recovery point objectives (RPOs)

Recovery time objective (RTO)

CHAPTER 12 ASSESSMENT

  1. All incidents, regardless of how small, should be handled by an incident response team.
    1. True
    2. False
  2. Which of the following should not be in an information response team charter?
    1. Mission
    2. Organizational structure
    3. Detailed line budget
    4. Roles and responsibilities
  3. Which of the following IRT members should be consulted before communicating to the public about an incident?
    1. Management
    2. Public relations
    3. IRT manager
    4. All of the above
  4. As defined by this chapter, what is not a step in responding to an incident?
    1. Discovering an incident
    2. Reporting an incident
    3. Containing an incident
    4. Creating a budget to compare options
    5. Analyzing an incident response
  5. A method outlined in this chapter to determine if an incident is major or minor is to classify an incident with a(n) __________ rating.
  6. When containing an incident, you should always apply a long-term preventive solution.
    1. True
    2. False
  7. The IRT starts recording events once a(n) __________.
  8. During the containment step, you should also gather as much evidence as reasonably possible about the incident.
    1. True
    2. False
  9. To clean up after an incident, you should always wipe the affected machine clean and rebuild it from scratch.
    1. True
    2. False
  10. What value does a forensic tool bring?
    1. Gathers evidence
    2. Helps evidence to be accepted by the court
    3. Can take a bit image of a machine
    4. All of the above
  11. How important is it to identify the attacker before issuing a final IRT report?
    1. Critically important; do not issue the report without it.
    2. Moderately important; nice to have but issue the report if not available.
    3. Not important; focus on the incident and do not include identity of attacker even if you have it.
    4. Important; allow law enforcement to brief management about attacker’s identity.
  12. When analyzing an incident, you must try to determine which of the following?
    1. The tool used to attack
    2. The vulnerability that was exploited
    3. The result of the attack
    4. All of the above
  13. Which IRT member is responsible for handling the media?
  14. The business impact analysis (BIA) is created after the business has created a business continuity plan (BCP).
    1. True
    2. False
  15. What is the difference between a BCP and a DRP?
    1. A BCP focuses on the business recovery, and a DRP focuses on technology recovery.
    2. A DRP focuses on the business recovery, and a BCP focuses on technology recovery.
    3. There is no difference. The two terms mean the same thing.
  16. The BIA assessment is created by the IRT team primarily for use during a security incident.
    1. True
    2. False
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.142.135.190