Part 6 - The Role of the Incident Response Manager
Video Activity
This lesson discusses the role of the Incident Response Manager. This is the employee within an organization who is responsible for overseeing how an incident is handled. They need to have a mix of both strong technical and communication skills. Other roles discussed in this lesson include: · Incident Response Lead · Incident Response Team In addit...
Join over 3 million cybersecurity professionals advancing their career
Sign up with
or
Already have an account? Sign In »
MicroCourse
Time
7 hours 56 minutes
Difficulty
Intermediate
CEU/CPE
4
Video Description
This lesson discusses the role of the Incident Response Manager. This is the employee within an organization who is responsible for overseeing how an incident is handled. They need to have a mix of both strong technical and communication skills. Other roles discussed in this lesson include: · Incident Response Lead · Incident Response Team In addition to their roles, those in incident response also need the support of and must communicate well with their management, information assurance, IT Support, legal department as well as public affairs and media relations, human resources, business continuity planning and finally security and facilities management.
Video Transcription
00:04
so gonna kind of transition to the people within the Incident Response team. And within that policy, you want to have that incident response manager
00:16
and that incident response manager. He's going to be that single employee who may have one arm or designated alternates, but he should be in charge of the overall incident response. So in your fully outsource model, this person is going to oversee and evaluate that outsourcing work, which were just talking about
00:36
all other models generally have a team manager in and one of your deputies we're going to assume authority in the absence of that of that manager managing director.
00:46
So managers typically perform a variety of tasks, leading acting as a liaison, upper management and other teams and organizations. They defuse crisis situations, and the insured team has the necessary personnel resources and skills. So it's likely the manager may not even start responding to incidents. But he's going to be that
01:06
12
01:07
kind of directs resource is and your personnel in order to respond to that incident
01:12
So manager should be technically adapted and have excellent communication skills, particularly an ability to communicate to a range of audiences. So you have to consider who that manager's going to be talking to. You may be talking to someone who is very technically proficient. He may need to know those details,
01:30
but he may have to translate that to
01:34
Maybe a C may not have the technical knowledge that manager,
01:40
but managers are ultimately responsible for ensuring the incident response activities are performance problems.
01:47
So the next role we would have been the policy is going to be your incident response, lead and members of your incident response team.
01:56
So in addition to the team manager, the deputy, some teams also have a technical lead or a person who have strong technical skills and incident response experience, who's going to assume oversight and the final responsibility for the final quality of teams technical work.
02:13
So the position of the technical lead should not be confused with position of the incident lead. Larger teams often assign an incident. Lead is the primary POC for handling certain incidents or specific incident on the incident. Lead is held accountable for the incidents handle,
02:30
so depending on the size of the incident Response Team and the magnitude
02:35
of the incident, the incident lead may not actually perform the actual incident handling rather coordinate the handlers activities, gather information from the handlers and provide incident response updates to the group and ensure that the team's needs are met.
02:51
Members of the Incident Response team should have excellent technical skills. Such a system administration network administration
02:59
programming, technical support, our intrusion detection
03:02
every team member should have good problems about solving skills and critical thinking abilities. So it's pretty common on some of these incident response team configurations to maybe have a rotational basis of who's going to be the technical lead or the incident response lead for that day. That weaker that one.
03:23
And what that does is that's going to help
03:25
provide
03:27
kind of the ability for the team. Have
03:30
Crossover said that individuals who know how to perform certain functions and tasks if somebody happens to be out of work or they happen to change jobs, get sick. It helps that team function better that way. Everyone knows exactly what's going on. What's expected?
03:51
Bills rolls,
03:53
uh, moving on. We have incident response interdependencies.
03:58
So management is going to be one of the first interdependencies that your team is going to have.
04:04
So management is going to establish the policy budget and the staffing for the teams. And ultimately management is going to be held responsible for coordinating incident response among the various stakeholders minimizing damage. Report to Congress O M B
04:21
the G A O if you happen to be a government agency,
04:26
or maybe they're gonna have to report to shareholders, are this the c e o c i o. It's all going to depend on how your organization works, but ultimately you're management is going to be responsible for reporting to those higher level entities.
04:43
So another end of interdependency that you're going to have this information assurance
04:48
so information security staff members made it to be involved in certain stages of the incident handling process. So prevention contained the eradication of recovery, for example, T all for network security controls, firewalls and rules set. So it made
05:04
extend over into your eye staff. If you don't have one of those
05:09
individuals on your incident response team to begin with,
05:14
I t support is going to be another interdependency. So I take technical experts. For example, system and network administrators not only have three needed skills to assess, but also usually have the best understanding of the technology they manage on a daily basis.
05:29
So this understanding can ensure that the appropriate actions are taken
05:34
for the affected systems, such whether to disconnect an attack system.
05:40
The next interdependency that you might have is going to be the legal department.
05:45
So legal experts should review incident response plans, policies and procedures to ensure their compliance with law. Federal guidance, the right to privacy. Maybe here
05:57
your policy within your department. Regardless, lawyers are gonna have to be involved to make sure everyone eyes legally covered and protected.
06:05
In addition, the guidance of your general counts of legal department
06:10
should be sought out. There's a reason to believe that an incident may have legal ramifications, including evidence collection, prosecution of the suspect or a lawsuit, or if there may be a need for some type of memorandum of understanding our other binding agreements involving liability of limitations for information sharing.
06:30
So generally, if you've got some type of legal question or legal requirement, I'm gonna have to involve lawyers, which will get into a little bit later in our legal discussion
06:40
interdependencies, continued public affairs and media relations, we kind of already handed on. That said, depending on the nature and the impact of an incident, need may arise to inform the media on by extension, the public. So again, if you had that target data breach the Sony hack,
06:59
you may end up adding to inform on you
07:00
customers about that incident. So getting those public affairs and media relations people involved is very important.
07:09
Human resource is is another interdependency that incident Response Team's may have to coordinate with.
07:15
So if an employee is suspected of causing an incident, three human resource Department may have to get involved for centrally assisting with disciplinary proceedings. Were fighting inflict
07:28
about that boy?
07:30
Also your Business Continuity Planning Department? They may also have to be involved, so organizations should ensure that incident response policies and procedures and business continuity planning processes are in sync.
07:45
So if your servers attack, maybe you're BCP team is going to have to get involved on order. The transition Teoh a different server, so computer security incidents undermined the business resilience of organization
07:59
businesses continue our continuity. Planning professionals should be made aware of incidents and their impact, so they confined to the business impact assessments, risk assessments and Continental operations plans
08:13
so further because businesses continuity planners have extensive experience in minimizing operational disruption during severe circumstances.
08:22
They may have that valuable information that could help the team remediate those incidents and get back to normal operating procedures. And an example of that could be a denial of service.
08:35
Uh, the next interdependency that you might experience is physical physical security facilities manager.
08:43
So some incidents occur through breaches of physical security and not necessarily technical security, are they? They involve coordinated, logical and physical attacks. So the Incident Response team may also need access to facilities during their response,
09:01
and we'll also need to secure an area, store, the recovered
09:05
data and on artifacts.
Up Next
