Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
The Six Stages of Incident Response
Following these simple steps can help your organization handle a serious data breach
2 Min Read
3:20 PM -- When you were reading about the TD Ameritrade hack, did you wonder what you would have done in that situation? Do you think your team has the skills and the tools to identify malicious code on your organization's computer systems? (See TD Ameritrade Breach Affects 6.3M Customers and Lawsuit Raises Questions on TD Ameritrade Breach.)
In Monday’s blog, I emphasized that your "first responders" have to have the training and tools necessary for dealing with various security incidents effectively and efficiently. Today, before I get too far ahead of myself and delve into incident response tools (because I really like IR tools), let's take a look at the six stages of incident response (IR).
Preparation: Be ready with the tools and training for incidents before they happen.
Identification: Identify incidents thoroughly; going through the IR process only to find a false alarm is no fun.
Containment: Contain the incident immediately to prevent possible collateral damage. This may mean revoking user accounts, blocking access at the firewall or updating antivirus rules to catch the malicious code.
Eradication: Get rid of the malicious code, unauthorized account, or bad employee that caused the incident.
Recovery: Make sure the system meets company standards or baselines, before returning it to service. Continue to monitor the system for any aberrant behavior to be sure that incident has been fully resolved.
Lessons Learned: Put together a report detailing what happened, why it happened, what could have prevented it, and what you’ll be doing to prevent it from happening again. Meet with management to go over the report and get buy-in for the changes needed to prevent similar incidents in the future.
These stages aren't difficult to read, but implementing them properly in a busy enterprise can be tricky. This is especially true when dealing with a compromise that impacts critical or customer-facing systems that must stay online to prevent financial loss.
This is when buy-in from management is crucially important. Top executives need to understand the situation in order to make informed decisions -- and it's your job to provide that information to them. Will you be ready?
-- John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading
About the Author
You May Also Like
More Insights
