Incident- Response Policy

7. Why do you want to have the incident response handled by the security incident response team and not the IT organization?

The National Incident Management System is a systematic guideline on how to effectively plan, mitigate, respond and recover, from significant incidences especially those that encompass diverse interest and involves all levels of governments. It works hand in hand with the National Response Framework, which provides structure for incident management while NIMS provide the guide for all departments and agencies at all levels of government, nongovernmental organizations, and the private sector to work flawlessly during incident management to reduce loss of life and property (U. S. Department of Homeland Security, 2008). The core aspect of the National Incident Management System during incident response is the Incident Command System (ICS),

Selective application of the framework’s structures and procedures is also possible to account for differing factors in incidents and the resources available. Partnerships between government agencies at the local and federal level, private sector entities, communities and individuals become of the utmost importance in this design. They all play a key part, with each entity’s roles and responsibilities supplementing the group effort in realizing the mission. This system also allows for the development of a unified command. With the integration of all levels of the community, maintaining coordination and cohesion is also necessary. One command would permit for concentrated effort and proper allocation of skills and resources towards the common goal (National Response Framework Second Edition,

49). In order for all of the leaders of the different infrastructures to be successful at eliminating or mitigating such attacks they will need a common form of communication as all of their systems have been proven to affect each other. One tool to help eliminate such communication barriers is the National Incident Management System (NIMS). This system “is a standardized management plan that provides a core set of concepts for incident command and multi-agency coordination during emergency response” (Kamien, 2012, p. 486). With such systems as NIMS the government realized that no one system can work without the other and if one fails they all fail causing wide spread panic and various other hurdles for emergency responders to respond to. It is up to the government to realize that our world is no longer ran manually, but rather digitally so that we can better prepare for possible cyber attacks on our key critical infrastructures.

The National Incident Management System is a systematic approach to a national template when dealing with incident management. This is how incidents are managed across all agencies to ensure protection, response time, mitigation of duties, and recovery (Walsh, 2012, p.4). In order to use the National Incident management System effectively, you must use the five major components. These components are used throughout government organizations, non-government organizations, and private sectors. The five major components consist of: (1) preparedness; (2) communications and information management; (3) command and management; (4) ongoing management and maintenance; and (5) resource management (Walsh, 2012, p. 6).

First, Incident Response (IR) plan “is a detailed set of processes and procedures that anticipate, detect, and mitigate the effects of an unexpected event that might compromise information resources and assets.” (Whitman, 2013, p. 85). Consequently, Incident response planning (IRP) is the planning for an incident, which occurs when an attack affects information systems causing disruptions. On the other hand, Disaster Recovery (DR) plan “entails the preparation for and recovery from a disaster, whether natural or human-made.” (Whitman, 2013, p. 97). For instance, events categorized as disasters include fire, flood, storm or earthquake. Thus, the differences between an Incident Response (IR) plan and a Disaster Recovery (DR)

Incident information disclosure is an important, circuitous concern that requires acceptable centralized procedures in place to facilitate incident response processes and do not cause more harm for the organization and its audiences. Keeping information and operations secured, appropriately is of basic importance for any organization, which becomes the assignment of cyber

After the business continuity plan is completed Incident Response (IR) planning and incident response plan should be performed and established. An incident response plan is “a detailed set of processes and procedures that anticipate, detect, and mitigate the effects of an unexpected event that might compromise information resources and assets.” (Whitman) This is done by first forming an IR committee, establishing an IR policy that integrates the business impact analysis into the incident response plan.

This protection plan will address any security incidents such as security breach or emergency in the organization. The focus will be a coordination mechanisms which will be required to attain the vision and goals of the business prepared and instructed in an incident report. During the critical infrastructure protection plan there will be the need to review and revise any changes and prioritize to respond to changes in threat, technology, environment, business continuity, and other

Incident response and planning is very critical to a business. It’s important Greiblock Credit Union (GCU) financial firm maintain control of these incidents in a timely manner which could reduce cost, and risks. When responding to incidents one should always minimize the severity of all security incidents. The analyst should have a clear plan to resolving incidents, while containing the damage and reducing risks (Cichonski et al., 2012). According to Cichonski et all, (2012) most departments have a Computer Security Incident Response team, or designated personnel to handle the variety of incident responses related to Cyber Security. Based on the below, the information can be used in a technique to help an organization to determine the threat against the organization and identify if it’s truly a security breach or serious

As preparedness is the foundation to the National Preparedness System (NPS), the National Incident Management System (NIMS) is the common approach for managing incidents with concepts that provide for flexible but standardized sets of incident management practices; and provides the template for the management of incidents and operations in support of “all five National Planning Frameworks”. (FEMA NIMS 2015). The NIMS established the standardization of incident management protocols and procedures that all Federal, State, and local responders should use to conduct and coordinate response actions. Furthermore, the NIMS sets forth a “core set of doctrine, concepts, principles, terminology and organizational processes to enable effective, efficient,

Incident recovery begins with implementing the back-up and recovery plan which should already be in place

Not having valid evidence of a crime that just happened, results into organizations being responsible for the incidents faced. This kind of phenomenon subjects most agencies to look for possible solutions to their problems without relying on any correctional agency (Furnell et al., 2010). Eliminating the impossibility of having a reliable evidence, would work best as retrieving the actual truth behind the incident

The risks that face an organization are going to always be present. However, an incident response plan outlines procedures for handling security incidents that occur within the organization and for correcting and documenting the security issue in a timely manner. The incident response team is trained to effectively implement the incident response plan. By containing an attack, and limiting the amount of time that an attack is allowed to continue, further risks to the organization can be mitigated.

The information security incident management policy of Blyth’s Books was created in 2010 and has been reviewed four times in five years. Those covered by its scope are clearly stated. It stresses the importance of incident management to the organisation and has the support of upper level management.