Unit 11 Topic D: Incident Response Policies

An event that poses a threat to the business information, in regard to its confidentiality, integrity & availability

• An information security incident

• A total data recovery failure

• A backup server breach

• A power failure in the server room

When an incident is detected or suspected what is the first action that should take place?

• It must be reported to the appropriate person (probably the CSIRT team leader)

• Whoever discovers the incident must perform an initial assessment of the event

• Switch off the servers so that no more breaches can take place

• Ignore it and hope it goes away

When an initial assessment of the event takes place, what is the first thing to identify?

• Whether an actual incident has taken place at all

• How to minimise the risk

• Who is going to be responsible for performing the incident response

• Whether or not it is an internal security breach

Two things that need to be identified during an initial assessment of an incident:

• Type of attack

• Severity of attack

• How much it will cost to resolve the incident

• Whether or not to inform the police

Containing the damage and minimising the risk has five areas, including which of the following?

• Protecting people’s safety

• Protecting sensitive data

• Minimising disruption to computing resources

• Ensuring that no-one knows that an incident has taken place

Following a security incident, which of the following four things are required to be identified and documented?

• The nature of the attack

• The origin of the attack

• The intent of the attack

• What systems & files were compromised

• How much it will cost to resolve the incident

Which of the following two reasons explain why two backups are required when protecting evidence following a security incident?

• To be used as evidence

• For data recovery

• In case the evidence has been tampered with

• Checks on data inconsistency

When should the removal and secure storage of original hard disks take place?

• After evidence has been backed up but before the compromised system has been wiped

• After the compromised system has been wiped but before external agencies are informed

• As soon as the security breach has been identified

• After the system backups have been restored

Who should be contacted before before notifying any external agencies?

• Legal representatives

• The media

• The IT department

• The HR department

What name is given to the team that needs to be assembled as part of the IR policy?

• Computer Security Incident Response Team (CSIRT)

• The Avengers

• The A-Team

• Cyber Response Unit Security Team (CRUST)