State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Type and Title <strong>of</strong><br />
Publication<br />
Author(s)<br />
Step or Process<br />
Material Covered and/or<br />
O<strong>the</strong>r Comments<br />
Crime<br />
System <strong>Security</strong>: A<br />
Management Perspective<br />
David L. Oppenheimer,<br />
David A.<br />
Wagner, and<br />
Michele D.<br />
Crabb<br />
[Oppenheimer<br />
97]<br />
<strong>Response</strong> strategy<br />
formulation<br />
Duplication (forensic<br />
backup)<br />
Investigation<br />
<strong>Security</strong> measure<br />
implementation<br />
Network monitoring<br />
Recovery<br />
Reporting<br />
Follow-up<br />
Isolate<br />
Identify<br />
Contain<br />
Terminate<br />
Eradicate<br />
Recover<br />
Perform follow-up<br />
gating various types <strong>of</strong> incidents.<br />
Short topics booklet that describes<br />
security issues at a high level for<br />
management<br />
Articles/Guides/White Papers/Special Publications<br />
Advance Planning<br />
for <strong>Incident</strong> <strong>Response</strong><br />
and Forensics<br />
Symantec Corp.<br />
[Symantec 01]<br />
Identify vital assets<br />
Hire experienced staff<br />
Secure individual hosts<br />
Secure your network<br />
Monitor devices<br />
Establish a response<br />
strategy<br />
Establish policies and<br />
procedures<br />
Overview <strong>of</strong> topic areas. Provides<br />
incident managing services<br />
<strong>Computer</strong> <strong>Security</strong><br />
<strong>Incident</strong> Handling<br />
Step by Step<br />
The SANS<br />
Institute<br />
[SANS 03]<br />
Preparation<br />
Identification<br />
Containment<br />
Eradication<br />
Recovery<br />
Follow-up<br />
Good reference guide, covered at<br />
high level. Outlines <strong>the</strong> list <strong>of</strong> actions<br />
to be taken at each <strong>of</strong> <strong>the</strong> six<br />
steps listed.<br />
Information Systems<br />
<strong>Security</strong> <strong>Incident</strong><br />
<strong>Response</strong><br />
IA Newsletter,<br />
Gordon Steele<br />
[Steele 02]<br />
References <strong>the</strong> SANS list<br />
High-level overview <strong>of</strong> incident<br />
response, planning, and management<br />
(similar to work covered by<br />
SANS, Howard).<br />
152 CMU/SEI-2003-TR-001
Change language