IR-2: Incident Response Policy

To properly address and prepare for incidents within the organization, an incident response team should be formed. The team will be responsible for analyzing security issues and taking necessary responsive measures. An IR team should be made up of: Incident Response Manager (supervises and prioritizes actions during the detection, analysis and containment of an incident, also responsible for conveying the special requirements of severity incidents to all of the company); Security Analysts (work

7. Why do you want to have the incident response handled by the security incident response team and not the IT organization?

The National Incident Management System is a systematic guideline on how to effectively plan, mitigate, respond and recover, from significant incidences especially those that encompass diverse interest and involves all levels of governments. It works hand in hand with the National Response Framework, which provides structure for incident management while NIMS provide the guide for all departments and agencies at all levels of government, nongovernmental organizations, and the private sector to work flawlessly during incident management to reduce loss of life and property (U. S. Department of Homeland Security, 2008). The core aspect of the National Incident Management System during incident response is the Incident Command System (ICS),

These three living documents work hand-in-hand, continuously evolving to improve consistency and account for changing conditions. The National Preparedness Goal, as of 2011, sets the vision and overall policy for nationwide preparedness. The National Incident Management System provides the template for managing incidents at all levels, while the National Response Framework gives structure to national-level incident management and response policy. (pg. 2)

The “Critical infrastructure, or CI, is a subcategory of infrastructure that includes those assets, systems, and networks, whether physical or virtual, which are so vital that their failure or destruction would have a debilitating impact on security, governance, public health and safety, public confidence, commerce, or other societal factors” (Bullock, Haddow, Coppola, 2016). According to the 2013 US National Infrastructure Protection Plan (NIPP) there are 16 of these sectors and throughout this paper we will discuss a cyber attack on the water supply sector. The best way to discuss the above will be through the evaluation of the impact that a cyber-attack could have on our water supply, and the probable third and fourth order effects from

To better understand the National Incident Management System we must first understand why there was a need for such a program. There are several emergency incidents to date that would show that this system was needed. However I believe that it can be brought back to the fires in the 1970’s. (Boles, Coniglio, Martin, & Martin, 2012) The main incident that provide beyond a doubt that this system was needed was the 9/11 tragedy. That day changed not only how we respond and handle situations like this but, it also changed America and all her citizens. We realized that we are more susceptible to an attack on our own lands than we thought. Gone went the idea that we are only as safe we think.

The National Response Framework also known as NRF was built off of the National Incident Management System. The NRF plan was finalized and in action in January of 2005, right after Hurricane Katrina. NRF is an organization that is used prepare and respond to emergencies and terrorist attacks, they also help respond to disasters that happen all over the world, they help make sure that people get what they need in emergencies and they make sure that any medical care that is need in time of a disaster is provided.

Both the national response framework and National Incident Management system are plans set in place to provide a response to domestic incidents and both are overseen by the Federal Emergency Agency. While they are both similar they do have distinguishing characteristics (Haddow, G., Bullock, J, & Coppola, D. 2014). The National Response Framework incorporates a formal plan that involves both local, state, federal, and non-government agencies that works seamlessly together to provide a response that if followed properly can be proven to have a successful ending to an emergency situation. The most important concept behind the National Response Framework is that Federal Government does not supersede local government and combines the government

This means that this system can be used for a variety of incidents, hazards, and impacts, despite its size or location. There are five major components that need to be understood about this system: Command and Management, Preparedness, Resource Management, Communications and Information Management, and Ongoing Management and Maintenance (FEMA, 2017). Each of these components apply very well to the management of a serious disaster that Homeland Security and public agencies may have to deal with. By using this policy program, it organizes key information and distributes important duties and gives direction in order to lessen the chaos that can transpire during a disaster event. Following, the Incident Command System is a very convenient tool when managing a serious disaster.

The determination of which individuals are assigned to the response team will be determined by the skills that are needed to respond. A physical security threat as compared to a virus infestation will result in the appropriate team member’s notification. This component should remain flexible, as incidents may escalate or change throughout the life span of the incident.

The goal of creating better transportation security systems to move people and cargo more securely and efficiently attribute to the protection phase of the domestic preparedness cycle. The ability to move cargo safely and efficiently through our national ports makes them an economically critical infrastructure, which coincides with the Department of Homeland Security’s initial goals and the domestic preparedness cycle (Cordner, 2016). The response phase of the domestic preparedness cycle parallels the goals of information-sharing and increasing overall preparedness, which lead to the creation of the National Incident Management System. The National Incident Management System established a common set of terms and procedures used during multiagency coordination, unified command, and the identification of equipment, resources, and common protocols for processing events and disseminating information regarding an incident (Cordner, 2016, p. 433). The standardization of communication and procedures display how the Department of Homeland Security goals and the

This diagram shows the way EOC coordinate functions to response effectively. The EOC coordinates the multiagency, intergovernmental incident response to ensure it forms an effective and efficient effort. The EOC is also the central node of the incident information network. It is the point through which information is released to the mass media and the public (p. 370). There are also EOC located within Departments. Each EOC assembles, deploys, and controls the resources within its jurisdiction (p. 371). Not only that, the coordination is across municipalities and also with county and state EOCs. This coordination is based in a series of actions that assesses agent- and response- generated demands, gathers demand-relevant resources, and deploys

The risks that face an organization are going to always be present. However, an incident response plan outlines procedures for handling security incidents that occur within the organization and for correcting and documenting the security issue in a timely manner. The incident response team is trained to effectively implement the incident response plan. By containing an attack, and limiting the amount of time that an attack is allowed to continue, further risks to the organization can be mitigated.

Automatic Alerts are issued by the organizations notification system and are communicated through appropriate channels. Predefined personnel are alerted when a specific indications of compromise are detected. Incident response personnel respond to detected suspicious events by taking scripted, appropriate actions to remediation suspicious events.

The information security incident management policy of Blyth’s Books was created in 2010 and has been reviewed four times in five years. Those covered by its scope are clearly stated. It stresses the importance of incident management to the organisation and has the support of upper level management.