State of the Practice of Computer Security Incident Response Teams ...

Type and Title of
Publication
Author(s)
Step or Process
Material Covered and/or
Other Comments
that were available to assist the incident
handling process.
The Methodology
of Incident Handling
Security Architecture
and Incident
Management for
E-business
Incident Response
and Reporting
Procedure for
State Government
State of Vermont
Incident Handling
Procedure
RFC 2196 Site
Security Handbook
Matthew
McGlashan, Australian
Computer
Emergency Response
Team
[McGlashan 01]
Internet Security
Systems
[Sokol 00]
State of
Nebraska
[Nebraska 02]
State of
Vermont
[Vermont 01]
Barbara Fraser,
Editor
[Fraser 97]
Identify scope and
assess damage
Communicate
Collect and protect
Apply short-term
solutions
Eliminate intruder
access
Return to normal
operations
Identify and implement
lessons learned
Incident preparedness
Alerting
Report and notification
Preliminary investigation
Decision and resource
allocation
Response
Recovery
Lessons learned
Detect the incident
Analyze the incident
Contain or eradicate the
problem
Provide workarounds or
fixes
Prevent re-infection
Log events
Preserve evidence
Conduct a postmortem/
apply lessons learned
Protect
Identify
Contain
Eradicate
Recover
Follow-up
Notification & exchange
of information
Protect evidence and
activity logs
Containment
Eradication
Recovery
Follow-up
High level; slide presentation
Provides a high-level overview of
best practices for the development
of an incident response process.
A draft report summarizing the
guidelines for CIO Cyberthreat Response
and reporting (applicable to
non-education state agencies,
boards, and commissions receiving
appropriation from the state Legislature,
or state agencies that have direct
connection to the state’s network.
An interim guideline for incident
response within the State of Vermont.
Revised version of RFC 1244. Provides
practical guidance for administrators
on developing computer
security policies and procedures.
154 CMU/SEI-2003-TR-001