Best Practices for Security Incident Response
Here’s a helpful white paper by Kerry Thompson that describes best practices that you should follow when responding to a security incident.
I like the part about the incident team. Here’s an exerpt:
An incident team for a small to medium enterprise is almost always two people. One will be the technical lead who will perform the bulk of the remedial work, and the other will be a backup person reporting to management and recording the actions taken. Further people may be involved depending on the size of the organisation, usually in the reporting chain rather than in direct involvement. These may include:
- the IT manager
- the CEO/CIO/CTO
- Media relations
- Legal
- Law enforcement
Always get help if you feel the situation is getting out of hand. For example, in one case an incident involving malware infection dragged on for two weeks before someone was called in to diagnose the problem and resolve it within an hour. Get equipment and software tools if required.
Other areas covered include:
- Forming a plan for resolution
- Return to operation
- Preventing reoccurance
- Review the causes
- Review resolution
- Create a final report