Alan Castro
Unit 10 Discussion
Incident Response Strategies

What are the effective responses to a security breach?
The effective responses to a security breach starts with being prepared for one before it happens. Having a checklist to follow in case a security breach happens allows anyone who is taking care of the incident to know what steps to take without wasting too much time thinking of what to do.
Once a security breach has occurred, quick reaction by the IT team is essential for an effective response. Firstly the IT Team must secure all the critical devices on the network. Any devices that are immediately known to be compromised must be isolated. The IT team should also inform all users via email to instruct them what steps to take to assist the IT Team in effectively taking care of the incident.
Which actions would you recommend for each phase?
Preparation – I would recommend for the preparation phase that before any incident occurs, that there should be quick reaction checklist for all the possible security breaches and let the IT Team know where to access these checklist and how to use them beforehand. I would also suggest possible practicing using the checklists.
Detection – Detection of a security breach can be done through the use of IPS and IDS. Also utilizing tools that monitors all the network traffic and checking the security logs to spot any possible anomalies which could possible point to a security breach.
Containment – Once a security breach is detected, it is imperative for the IT team to figure out what devices are compromised and to isolate them from the rest of the network. By isolating the issue, it will make resolving the issue easier.
Eradication – To eradicate the security breach is dependent upon what type of security breach the IT Team is facing. In regards to a virus or malware, using anti-virus software or malware