Chapter 10. Managing Security Incidents

The focus of this chapter will be on presenting the idea of security incidents and response. First, we will define a security incident and then move on to developing the process of responding, including roles and procedures for remediation. Getting buy-in from other teams outside of security, including management, is key to the success and effectiveness of an incident response capability. The Taking action section will cover both internal response and leveraging of third parties when necessary. This chapter focuses on the basics of developing and implementing a security incident response capability in the enterprise. Incident response forms and process flow are included in Appendix E, Security Incident Response Resources.

This chapter covers the following:

• Understanding what defines an incident

• Developing security incident processes

• Building an incident response team

• Developing an incident response plan

• Taking action on security incidents