Incident Response

Question 1

What is Incident Reponse?

Answer 1

IR is the process of taking organized and careful steps when reacting to a security incident. Starts from identifying and reporting an incident.

Question 2

What are the responsibilities of IH&R team?

Answer 2

Incident Handling and Response Team is a group of specialized people who respond, remediate, mitigate, recover and communicate the impact of the incident.

Question 3

What roles can be identified within the IH&R team?

Answer 3

• Management (decision-maker)
• Information Security Team (incident discovery and containment)
• IT Staff (system/network administrator)
• Physical Security Staff
• Attorney (legal advice)

Question 4

Who’s the First Responder?

Answer 4

The person who first starts IR process and brings the incident to the attention of others. It may or not be the person you actually reported the incident.

Question 5

Responsibilities of first responder

Answer 5

Reporting, alerting, containing, identifying, collecting, protecting, documenting; preserving and packaging evidences.

Question 6

Why having an IH&R process is important?

Answer 6

Planned methodology that produces consistent, repeatable results that you can defend both process-wise and legally.

Question 7

Summarize IH&R process flow.

Answer 7

1. Preparation for incident handling and response.
2. Incident recording and assignment.
3. Incident triage.

Question 8

What is included in preparation for incident handling and response?

Answer 8

Scope, management approval, funding, developing the team.

Question 9

What are the most important features of training IH&R personnel?

Answer 9

• Teach personnel the IR plan
• Rotate team members to build confidence in various roles
• Mock drills

Question 10

What is included in the incident triage?

Answer 10

• Analysis and validation
• Classification
• Prioritization