State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Appendix B: Comparison <strong>of</strong> <strong>Incident</strong><br />
<strong>Response</strong> Steps and<br />
Processes<br />
Type and Title <strong>of</strong><br />
Publication<br />
Author(s)<br />
Step or Process<br />
Material Covered and/or<br />
O<strong>the</strong>r Comments<br />
Books<br />
CERT Guide to<br />
System and<br />
Network <strong>Security</strong><br />
<strong>Practice</strong>s<br />
Julia Allen<br />
[Allen 01]<br />
Analyze information<br />
Communicate<br />
Collect and protect<br />
information<br />
Contain<br />
Eliminate all means <strong>of</strong><br />
intruder access<br />
Return systems to<br />
normal operations<br />
Implement lessons<br />
learned<br />
For comparison with <strong>the</strong> o<strong>the</strong>r references<br />
in this table, <strong>the</strong> “response”<br />
steps have been identified.<br />
This is a resource book for<br />
system/network administrators to<br />
harden/secure systems; prepare for,<br />
detect, and respond to security<br />
events and activity; and improve<br />
security configurations and procedures.<br />
<strong>Computer</strong> Forensics,<br />
<strong>Incident</strong><br />
<strong>Response</strong> Essentials<br />
<strong>Incident</strong><br />
<strong>Response</strong><br />
<strong>Incident</strong> <strong>Response</strong>:<br />
A Strategic<br />
Guide to Handling<br />
System and<br />
Network <strong>Security</strong><br />
Breaches<br />
Warren G. Kruse<br />
II and Jay G.<br />
Heiser<br />
[Kruse 02]<br />
Kenneth R. van<br />
Wyk and Richard<br />
Forno<br />
[van Wyk 01]<br />
Eugene Schultz<br />
and Russell<br />
Shumway<br />
[Schultz 02]<br />
Discovery and Report<br />
<strong>Incident</strong> Confirmation<br />
Investigation<br />
Recovery<br />
Lessons Learned/<br />
Recommendations<br />
Identification<br />
Coordination<br />
Mitigation<br />
Investigation<br />
Education<br />
Preparation<br />
Detection<br />
Containment<br />
Eradication<br />
Recovery<br />
Follow-up<br />
Technical, focusing on <strong>the</strong> investigation<br />
process (not on <strong>the</strong> incident<br />
response issues team management<br />
perspective)<br />
Written for management interested<br />
in building a team and issues that<br />
will need to be faced. Also focuses<br />
on responding to incidents and gives<br />
technical references/coverage <strong>of</strong><br />
tools <strong>of</strong> <strong>the</strong> trade, typical attacks,<br />
etc.<br />
Information relating to <strong>the</strong> forming,<br />
managing, and operating <strong>of</strong> a team.<br />
Good discussion <strong>of</strong> some <strong>of</strong> <strong>the</strong> issues<br />
that will be faced by team<br />
leads.<br />
<strong>Incident</strong> <strong>Response</strong>:<br />
Investigating<br />
<strong>Computer</strong><br />
Kevin Mandia<br />
and Chris Prosise<br />
[Mandia 01]<br />
Pre-incident preparation<br />
Detection<br />
Initial response<br />
The primary focus <strong>of</strong> <strong>the</strong> book is on<br />
investigation and specific techniques<br />
that can be used for investi-<br />
CMU/SEI-2003-TR-001 151
Change language