Week-3_Incident Response .pptx------------------

--------------------------------------------------------------

1. CSEC 1001 Foundation of Computing and Cyber Security

2. Outline Incident Response Planning Incident Response lifecycle

3. Introduction to Incident Response Planning

4. Incident Management An incident is an unplanned event that interrupts or reduces the quality of an IT service. Think of it as any situation where a system, application, or network component fails or is compromised, disrupting normal operations. An incident is an event that has actually or potentially compromised the confidentiality, integrity, or availability of an organization's information systems or data, or a violation of security policies and procedures.

5. Incident Management

6. Incident Management It is an unplanned interruption to an IT service, or reduction to quality of an IT service or failure Configuration Item (CI) Incidents would not happen if we had infinite security budgets we had infinitely capable security personnel However, things can go wrong In spite of your best attempts We call them incidents Important to develop standard procedures to respond to incidents Refine these procedures based on experience

7. Incident Management ISO27002 Section 10 is all about incident management You should use ISO27001 to build the foundations of information security in your organization , and devise its framework You should use ISO27002 to implement controls Legal requirement for certain industries (e.g., banks, e-commerce, public institutions) Highly recommended for all organisations

8. Types of Incident s CIA related incidents Other types of incidents Reconnaissance Attacks This is when an attacker probes your network to find weaknesses. A common example is port scanning , where they check for open digital "doors" on DSL and cable modem connections are more exposed than others because they are usually open (through port scanning, vulnerability scans)

9. Types of Incident s CIA related incidents Other types of incidents Repudiation An incident where someone performs an action and later denies having done it. For example, a user illegally transfers funds and then claims their account was hacked. Harassment (through harassing messages using like email and instant message) Using digital tools like email or instant messaging to bother, threaten, or embarrass someone.

10. Incident Response: Three Major Parts of Cycle Incident Response Countermeasures Detection Actions taken to deal with an incident to eliminate or minimize the impact.

11. Incident Response lifecycle P r e p a r a t ion Detection Investigation Remediation Recovery Containment

12. Incident Response Lifecycle 1) Preparation : This phase involves establishing and implementing policies, tools, and resources to handle incidents efficiently. It includes training, deploying detection and prevention technologies, and setting up incident response teams. 2) Detection : In this stage, the incident is identified. It involves monitoring systems for signs of security breaches or suspicious activities, like unauthorized access or malware. 3) Containment : Once an incident is detected, immediate actions are taken to limit its impact and prevent further damage. Containment strategies can be short-term (like isolating affected systems ) or long-term ( applying security patches or configurations ).

13. Incident Response Lifecycle 4) Investigation : This phase involves gathering and analyzing data to understand the scope and nature of the incident, including how it happened, what systems were affected , and identifying the root cause. 5) Remediation : The goal here is to resolve the incident by eliminating the threat . This could involve removing malware and closing security vulnerabilities . 6) Recovery : Once the threat is neutralized, systems and services are restored to normal operations. This includes verifying that the incident is fully resolved and no residual issues remain.

14. Questions