Making an easy-to-implement IR plan
With the heightened security concerns in companies, it is quite easy for decision makers to come up with an over-ambitious IR plan that is out of the scope of the organization's resources to implement. While covering an incident in the best way possible is ideal, the limitations in terms of funds, skills, and time have to be factored in during IR planning. Furthermore, the plans need to be custom-developed for organizations to be direct and easy to follow. According to the US Department of Justice and NIST SP 800-61 (available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf), an IR plan should:
- Define who is responsible for each phase of the process
- Define how each IR phase will be carried out
- State the mission-critical data and systems and sensitive data that require the highest priority
- Explain how to preserve data for forensics (you can also check out
NIST SP 800-86for details on...
