Scribd
Upload
16 views23 pages

002 - Cybersecurity Fundamentals Incident Response BCP DRP

The document discusses incident response concepts including terminology, goals of incident response, components of an incident response plan including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities. It also discusses incident response teams, business continuity, and disaster recovery plans.

Uploaded by

ipnuippnuksbn
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
16 views23 pages

002 - Cybersecurity Fundamentals Incident Response BCP DRP

The document discusses incident response concepts including terminology, goals of incident response, components of an incident response plan including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities. It also discusses incident response teams, business continuity, and disaster recovery plans.

Uploaded by

ipnuippnuksbn
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 23

Module 2 : Incident Response, Business Continuity and Disaster Recovery

Concepts
INCIDENT TERMINOLOGY :
BREACH
INCIDENT
TERMINOLOGY :
EVENT
INCIDENT
TERMINOLOGY :
EXPLOIT
INCIDENT
TERMINOLOGY :
INCIDENT
INCIDENT
TERMINOLOGY :
INTRUSION
INCIDENT
TERMINOLOGY
: THREAT
INCIDENT
TERMINOLOGY :
VULNERABILITY
INCIDENT
TERMINOLOGY :
ZERO DAY
THE GOAL OF INCIDENT RESPONSE

• it is inevitable that adverse events will happen that have the potential
to affect the business mission or objectives.
• The priority of any incident response is to protect life, health and safety.
When any decision related to priorities is to be made, always choose
safety first.
• The primary goal of incident management is to be prepared.
Preparation requires having a policy and a response plan that will lead
the organization through the crisis.
• Every organization must have an incident response plan that will help
preserve business viability and survival.
• The incident response process is aimed at reducing the impact of an
incident
• incident response planning is a subset of the greater discipline
of business continuity management (BCM)
COMPONENTS
OF THE
INCIDENT
RESPONSE
PLAN
PREPARATION

• Develop a policy approved by


management.
• Identify critical data and systems,
single points of failure.
• Train staff on incident response.
• Implement an incident response
team. (covered in subsequent topic)
• Practice Incident Identification. (First
Response)
• Identify Roles and Responsibilities.
• Plan the coordination of
communication between
stakeholders.
DETECTION AND ANALYSIS

Monitor Monitor all possible attack vectors.

Analyze Analyze incident using known data and threat intelligence.

Prioritize Prioritize incident response.

Standardize Standardize incident documentation.


CONTAINMENT

GATHER EVIDENCE. CHOOSE AN APPROPRIATE IDENTIFY THE ATTACKER. ISOLATE THE ATTACK.
CONTAINMENT STRATEGY.
ERADICATION

Identify and mitigate all vulnerabilities that were Remove malware, inappropriate materials, and If more affected hosts are discovered (for example,
exploited. other components. new malware infections), repeat the detection and
analysis steps to identify all other affected hosts,
then contain and eradicate the incident for them.
RECOVERY

Enacting extreme care during the


Removing malicious content from Rechecking, testing, and verifying all recovery and restoration process so
infected systems components for functionality information systems are reliable
once more

Designing procedures that help Creating a written record of


Implementing a systematic approach
return information systems to full platforms and processes for testing
to testing, monitoring, and validating
functionality (e.g., establishing an and verification of restored systems
data systems to avoid future
agreed-upon timeframe to restore to provide guidelines for managing
compromise
data systems for use) another intrusion should it occur
POST-INCIDENT ACTIVITIES

IDENTIFY EVIDENCE THAT DOCUMENT LESSONS


MAY NEED TO BE RETAINED. LEARNED.
INCIDENT RESPONSE TEAM

Computer Incident Response Team Computer Security Incident Response Responsibilities :


(CIRT) Team (CSIRT)
Determine the amount and scope of damage caused
by the incident.
Determine whether any confidential information was
compromised during the incident.
Implement any necessary recovery procedures to
restore security and recover from incident-related
damage.
Supervise the implementation of any additional
security measures necessary to improve security and
prevent recurrence of the incident.
Representative(s) of senior management

INCIDENT Information security professionals

RESPONSE
Legal representatives
TEAM
MEMBERS Public affairs/communications representatives

Engineering representatives (system and


network)
THE IMPORTANCE OF BUSINESS CONTINUITY

to sustain business operations while Key part : communication


recovering from a significant disruption.
COMPONENTS OF
BUSINESS CONTINUITY PLAN
Immediate response procedures
and checklists (security and
List of the BCP team members, safety procedures, fire Notification systems and call
including multiple contact suppression procedures, trees for alerting personnel that
methods and backup members notification of appropriate the BCP is being enacted
emergency-response agencies,
etc.)

Contact numbers for critical


Guidance for management, members of the supply chain
including designation of authority How/when to enact the plan (vendors, customers, possible
for specific managers external emergency providers,
third-party partners)
THE GOAL OF DISASTER RECOVERY

the Disaster recovery plan (DRP) guides the actions of emergency


response personnel until the end goal is reached—which is to
see the business restored to full last-known reliable operations.

Disaster recovery refers specifically to restoring the information


technology and communications services and systems needed by
an organization, both during the period of disruption caused by
any event and during restoration of normal services.
COMPONENTS OF DISASTER RECOVERY PLAN
• Executive summary providing a high-level overview of the plan
• Department-specific plans
• Technical guides for IT personnel responsible for implementing and maintaining critical backup
systems
• Full copies of the plan for critical disaster recovery team members
• Checklists for certain individuals:
o Critical disaster recovery team members will have checklists to help guide their actions amid
the chaotic atmosphere of a disaster.
o IT personnel will have technical guides helping them get the alternate sites up and running.
o Managers and public relations personnel will have simple-to-follow, high-level documents to
help them communicate the issue accurately without requiring input from team members
who are busy working on the recovery.

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy