IR Basic and Derived

00:04

incident response. Now it's kind of interesting because this is one of the most essential things that we do to guarantee that were configured properly to withstand attacks is we work on how we respond to those incidents and we plan on our incidence response.

00:22

But it's interesting. This is such a short,

00:24

um, because you're short section. So we look at the basic security requirements, So we have to establish an operational incident handling capability for our information systems, including adequate preparation, detection, analysis, containment recovery and user response activities.

00:42

The reason I go through and I read that whole

00:44

piece preparation, detection, analysis, containment in recovery, those air widely accepted as the steps to incident response.

00:56

So the first and most important step is we have tohave preparation, and we need a universal, inconsistent approach

01:06

to incident response. This is something where our users shouldn't be operating on the fly, right? This should be very, very controlled and very well documented. In a point in time, I should be able to look to documentation and find out what to do next. All right, then we detect that there actually has been

01:25

an attack Violation Analysis is really important here

01:29

because many times we have activities that might appear to be an incident that perhaps aren't. Maybe it's a mistake that's been made. Maybe it's normal traffic,

01:38

whatever that may be. So we detect the fact that there has been incident. Then we analyze it. We look for things like, What's the scope of the attack or of the incident? Ah, and then we would move into thinking about how can we best contain it? We don't want Oh, you know, we want to contain it. We will limit the damage.

01:57

But we also want to make sure that we preserve any evidence that we might need

02:02

and then recovery. Let's get back to where we were ahead of time and then I would follow that up certainly with the next bullet point. Basic security requirements, track document and report incidents, making sure the appropriate officials or authorities

02:21

or, you know, the incident response team, whatever that may be.

02:24

But the,

02:25

uh that the appropriate parties are notified, and that's so essential because part of that is gonna be documentation, and that documentation is gonna go into our lessons learned and will hopefully help us avoid a similar incident. the future, right?

02:43

All right. So the only derive security requirement is