An incident response team is responsible for protecting an organization’s network and data making sure that it is secure. This team also needs to be able to quickly act upon and respond to a threat or attack to reduce, prevent, and or minimize any damages or losses during an incident. Where does this process begin?
The first component of responding to an incident is identifying a trigger event or events that alert and information the response team to suspicious or malicious behavior or activity. This identification of a trigger needs to be done accurately to best prevent and resolve any possibility of a reoccurring attack, this allows for a more efficient and timely response to a threat.
A trigger could result from a number of different things. …show more content…
This type of attack can be detected in a network as a mass volume of requests from a single application. These high volume requests from a single host or application for network resources that usually is not requested or required for that application, is a good indicator that an attacker is scouting the surface prepping for an attack. However, these activities happen often throughout an organization’s business day so reports are generated from each department or from an assigned team at the end of a business day to be reviewed and isolate inconsistencies in the processes from the normal processes of activity. On the other hand it would be very inefficient for an organization to constantly be watching all of these processes that occur daily and hourly.
In addition to those triggers, any sign of malicious and infectious software should also be flagged as a trigger. Though many malware programs are very efficient and effective in detection malware and removing malware, however some malicious software are more evasive than others and are able to avoid these defenses; examples of these triggers include alerts and blocking based on IP events, communication with a suspicious host, and DNS requests all of these threats should be handled in a quick and timely manner to reduce damage or …show more content…
Once systems return to expected service levels, an incident response team can then go through post incident. This process involves the team reviewing the attack, gaining knowledge from the attack and are then able to better secure the network and data from future attacks. After recovery and post incident, the organization may pursue legal actions against the attacker which could be an individual or a group that attempted the attack. The team will also report their findings and resolutions to upper management, this includes how the threat or attack was eliminated, what changes were made to prevent future attacks from happening again, and if any information was gathered to pursue legal actions against the