Incident Response Planning
Incident response planning is a critical component of information security. This chapter covers the essential aspects of an incident response plan (IRP): its definition, preparation, identification process, including detection and analysis, and the tools for these tasks. We also address the stages of remediation, from containment to recovery and mitigation, supported by specific capabilities. The chapter concludes by discussing post-incident activities to prepare organizations for future incidents.
The following topics will be covered in this chapter:
- What is an IRP?
- Preparation of an IRP
- Identification – detection and analysis
- Identification – incident response tools
- Remediation – containment/recovery/mitigation
- Remediation – incident response tools
- Post-incident activity
