The communication and coordination plan is vital to success of the recovery. Now the incident has been discovered the CSIRT team needs to be notified. The team lead needs to roll down the incident response procedures and identify who needs to be contacted. This action will ensure that the proper level of response is applied and minimize and further damage to the organizations networks and reputation. Controlling who knows of the incident will prevent an attacker from being tipped off to your recovery and detection efforts. All communication will be coordinated with Legal and Communication Representative.
BMF will develop a comprehensive communication plan that will separately address each of the three audiences and continue to develop …show more content…
Using clues from the automatically generated IDS alarms, forensic examiners can pinpoint which system logs to further examine.
Internet Service Provider Records
Internet addresses, email header information, time stamps on messaging help the analyst piece together interactions and processes that will give them a snapshot of the crime committed. Evidence can be found on the Internet such as chat rooms, instant messaging and websites.
Malware Installation
Malware refers to a variety of malicious software, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software. These codes are often hidden in websites or embedded in web advertisements (Goodrich, 2012).
Live System Data After a suspect system is identified, all traffic coming to and leaving the system should be captured to include searching for hidden files inserted by malware, most likely located in alternate data streams (Overton, 2008).
Virtual