Creating an Incident Response Policy
Part 1: Research Incident Response Plans
Components of an Incident Response Plan
The University of Californias incident response plan can be found at the following link: UC Information Security Incident Response Standard.
The key components of the UC Incident Response Plan are preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Preparation involves creating, training and supporting the incident response team so that it has all the necessary tools to conduct adequate response, such as defined roles, processes, plan, suppliers for assistance, and so on. Detection and analysis consist of determining whether an incident has occurred, and gathering preliminary data to understand the nature and scope of the incident. The goal of containment, which follows, is to limit the impact of the incident; short-term containment (immediate response) and long-term containment (actions to be taken until the system is restored) characterize the two approaches of this step. Eradication involves eliminating the cause of the incident, which may involve deleting malware and identifying and mitigating vulnerabilities. Recovery refers to restoring and validating system functionality, making sure that systems are clean, and looking for any signs of vulnerabilities that could still be exploited. Post-incident activity is conducted after the incident is resolved, and the team analyzes what happened and how it was handled. It is the final step that is meant to help learn from the incident and improve future response efforts.
Six-Stage Methodology for Incident Response
The six-stage methodology for performing incident response as described at Flylib.com consist of making sure that an organization is ready to respond to an incident (prepared), that it can detect when a situation is a security incident (identify), that it can isolate the systems affected by the incident (contain), that it can remove the cause of the incident and prevent the spread of malicious parts (eradication), that it can...
…prevent further damage; long-term measures to isolate the affected systems.
4. Eradication: Removal of malicious code, malware, and any other threats; mitigation of vulnerabilities.
5. Recovery: Restoration of systems and data from backups; validation of system integrity.
6. Lessons Learned: Post-incident analysis to identify areas for improvement and update policies and procedures accordingly.
Guidelines
There should always be clear and timely communication with stakeholders during an incident. Detailed documentation of all actions taken during an incident should be made. The team should adhere to all relevant legal and regulatory requirements. There should be regular review and update of the incident response policy and procedures.
Conclusion
An effective incident response policy is important for all organizations. The Bankwise Credit Unions policy as outlined above represents a guide for incident response. It reflects industry best practices and adheres to all regulatory requirements. With this policy, the organization can protect its assets, data, and reputation, and comply with the GLBA and other relevant…
