>> Now let's talk a little bit
about what we're going to do if
our monitoring indicates that
negative events have occurred on the network.
That would involve an incident response and
sometimes it can lead to forensic investigations.
With the incident response process,
you have four basic steps
and they need to happen in order.
One preparation, two identification,
three containment eradication and
recovery and four lessons learned.
Regarding preparation, the best thing to
prepare for an incident is before it happens.
As obvious as that seems,
it doesn't always go that way.
But this is where we get our policies and
procedures and order and
train our incident response team.
On the test you could see the abbreviation IRP,
which refers to as incident response policies.
You could also see see CIRT,
which is computer incident response team.
There are various other acronyms that are
related to these same concepts.
Before the test, I think you will most likely
see CIRT team and IRP.
Regarding identification,
when we talk about things that occur on the network,
it's important to understand that
an event is simply a change in state.
It's not necessarily negative or positive.
But if an event or
multiple events have a negative impact on the network,
that's when it becomes an incident.
An incident is always negative and
only after we identify an event as being an incident,
then we will move on to containment,
eradication, and recovery,
and then lessons learned.
Now, I'll just mention for identification
earlier when we talked
about implementing security controls,
we mentioned KRIs,
which are key risk indicators.
We talked about that way in
the beginning when we talked about risk management.
We said that when we implement a control,
we need to have various alerts in place to make us
aware that a risk is going to materialize.
For example, when I see
network utilization go about 50 percent
for a sustained period of time,
that might be an indication of denial
>> of service attack.
>> That's the KRI. One of the things that
makes incident response successful
is to know what we're looking for,
and then to set up those KRIs and map them to
alarms or triggers to let us
know where there is an incident.
Also, we have our IDS and IPS,
incident detection system and
>> incident prevention system.
>> We have a lot of tools that we can use
to determine if there has been an incident.
But it's all about using them
together and using them effectively.
Once we've prepared an identified an incident,
what do we do?
We contain the problem.
This means isolating it and preventing the spread of
malware or any infection from one host to another.
You want to isolate the systems and quarantine them.
That doesn't mean powering off the systems
unless that is the only choice you have.
If you have to power down the system,
you might be getting rid of evidence that you'll want
later, so you want to avoid that.
Isolate the system in
the least disruptive manner that you possibly can.
Now with eradication, we want to
get whatever is on the system off a bit,
whether it's malware or some infection.
But essentially, we want to
remove the source of the problem.
Then recovery means we're going to
get back to full operations.
An incident isn't over until
you are back up and running completely.
Then after that, we're going to
document what happened and what we learned.
It's always critical to document your lessons
learned so you can apply them for the future.