Overview of Control 19

00:00

Hey, everyone, welcome back to the course. So in the last video, we took a look at control 18 applications offering security and how it maps up to the NIST cybersecurity framework

00:09

in this for the award to take a look at control 19 which is all about incident response and management.

00:15

So why do we even care about instant responsible Number one? It's not a question of if an organization will be attacked or your organization will be attacked. It's really just a matter of when, Right? Maybe you're a smaller company is not that big of a deal right now because you're not being targeted. But maybe you're not a smaller company. You're a large company, get attacked every single day.

00:35

So at some point

00:36

there's going to be an incident, and you'll need to already have in place a response plan to that incident.

00:43

So sub control 19 1 1st off documenting the incident response procedures like, What are we actually doing? How are we doing it? Who's responsible? So putting that documentation in place so everyone understands what's the process after we have an incident of identifying that we do have an incident

01:00

verifying it's an incident responding to the incident. Any isolation we need to do and recovering from the incident and then also the after aftermath, Right? What do we do in all those steps of the incident response process?

01:18

Some control 19 2 is all about making sure people understand what they're supposed to be doing. Right? So assigning job titles and duties for the incident response process.

01:27

And so, for example, we need to let people know. Okay, once incident happens, you're going to be doing this right. You're gonna be doing that. And then also, who communicates with who, Right, So we're gonna have, like, a phone tea tree. So I call you and then you call Joey and then Joey call Sally and Sally calls,

01:48

uh, Tameka and Tameka calls Robert and Robert calls Jonathan, etcetera, etcetera. Right. So we have that in place, so we know who is responsible for what? When the actual incident occurs.

02:00

Sub control 19 3 doesn't eight specific management personnel to support incident? Hamli. So identify those stakeholders and those people that are gonna be key individuals to help you make decisions when an incident is transpiring.

02:15

So maybe that's the sizzle, right? The chief information security officer. For those I don't know what that is.

02:20

Maybe that's a security manager. Maybe that's the I T manager. Maybe it's the CEO, depending on the company. Maybe it's a C I o.

02:28

So this Identify. Who are these people? I levels of management. They're going to support

02:32

the decision making during the incident.

02:38

Sub Control 19 4 device some kind of organization wide standard for reporting incidents. So again, going back to the if you see something, say something but also taking that to the next level. Right? If I'm scanning logs and I look and I see that there's something that could be an incident,

02:53

how do I notify people? Right. How do I do in how do I notify that there is some kind of breach going on?

02:59

So just devising those standards in place of what's our process behind this? That's what we need to make sure that we do

03:07

some control. 19 5 maintaining contact information for reporting so your organization may have to report to different government entities. So just making sure that you have that contact information in advance and in a readily available place so you can report any type of security incident

03:23

some control. 19 6 published information regarding reporting computer anomalies and incidents. So basically, just letting people know. How do you actually

03:32

report this stuff? How do you let us know that there might be an incident going on or something wacky is going on? How do you report that to us? And you should continuously let those workforce members and know all about. That's if you update this. Make sure you let them know the new process for reporting. Reporting these things

03:52

some control. 19 7 conduct periodic incidents scenario session. So again, going back to the training right, It's doesn't It's no good if we put all this fancy in this incident response in place and then it all fall apart when people actually try to go do it. So we need to make sure we're continuously practicing. So becomes second nature when we actually do have an incident in our company.

04:13

And finally some control 19.8 create incidents scoring and prioritization. Shima. So, for example, if I identify that an incident is happening, is this actually

04:24

critical to my business, right? If this incident is allowed to continue,

04:29

will it shut down my operations. Will it meal? Maybe it's an attack may be. So will it take my sense of data like what actually occurs here? So we didn't prioritize those because there are a lot of things you could focus your attention on that could be potentially deemed as an incident. But we want to make sure that we prioritize those in

04:47

focus on the critical incidents first.

04:54

So in this video, we just talked about CIA's control 19. In the next video, we're gonna talk through how that maps up to Venice Cybersecurity framework. I also want to mention this module as well. We've got a couple of labs, just like the previous lab we did. These two labs are also just gonna have a short walk through video just to introduce you to the lab.

05:12

It's not going to show you step by step. However,