Incident Response


Having the right processes in place to respond quickly and effectively makes the difference between minor incidents and major disasters...
Hisham Haneefa
Mind Map by Hisham Haneefa, updated more than 1 year ago
Hisham Haneefa
Created by Hisham Haneefa over 2 years ago

Resource summary

Incident Response
  1. Incident Phase
    1. Preparation
      1. CSIRT


        • * Establish and maintains the incident response plan * Make sure the team members understand the plan Test the plan Get management approve to the plan
        1. Detection And Analysis
          1. Incident Analysis
            1. Containment, Eradication, Recovery
              1. Containment: Isolate the infected system
                1. Eradication: Eradicate the system
                  1. Recovery: After remedition recover all the system
                    1. Post-Incident Follow up
              2. Disaster Recovery
                1. Types
                  1. Natural Disasters
                    1. Human- Caused
                    2. Disaster Recovery Plans(DRP)
                      1. Disaster Recovery Controls
                        1. Preventing Controls
                          1. Detective Controls
                            1. Corrective Controls
                            2. Test/Trainings
                              1. Table Top
                                1. Functional test
                                  1. Operational
                                2. Business Cont Plan
                                  1. Business Cont Planning
                                    1. RTO - Recovery Time Objective
                                      1. RPO - Recovery Point Objective
                                        1. MTTR- Mean TIme To Repair
                                          1. Mean Time Between Failures
                                          2. Business Cont Considarations
                                          3. Digital Forensics
                                            1. Evidence
                                              1. Identifying and acquiring
                                                1. Data Acquisition
                                                  1. System Images
                                                    1. Network Traffic and logs
                                                      1. Surveillance Videos
                                                        1. Hashes Or Checksums
                                                          1. photos of scene
                                                            1. Witness interveiwed
                                                          2. Protecting and Storing
                                                            1. Chain Of Custody
                                                            2. Digital Forensic Devices
                                                              1. leave in the current power state
                                                                1. Disconnect from Network
                                                                  1. Refrain from opening file or applications
                                                                  2. Order Of volatility
                                                                    1. CPU storage
                                                                      1. Process and Routing tables
                                                                        1. Kernel Operations
                                                                          1. System Storage
                                                                            1. Temp Files
                                                                              1. Fixed media
                                                                                1. Removable devices
                                                                                  1. Tape/DVD/Paper
                                                                  Show full summary Hide full summary


                                                                  2.4 Incident Respone and Recovery Procedures
                                                                  DJ Perrone
                                                                  Security+ Incident Response Steps and Tools
                                                                  Lyndsay Badding
                                                                  Jekyll and Hyde
                                                                  BIOLOGY B1 4
                                                                  Macbeth Notes
                                                                  Bella Ffion Martin
                                                                  A-Level Law: Theft
                                                                  Certification Prep_1
                                                                  Tonya Franklin
                                                                  ENG LIT TECHNIQUES
                                                                  Heloise Tudor
                                                                  Skeleton and Joints
                                                                  Colleen Curley
                                                                  The Changing Natural Environment Part 2
                                                                  R S
                                                                  Weimar Republic - Problems facing it from 1918 - 1923
                                                                  Kiya Bhayani