M6D1: Incident Response Discussion

This activity will address module outcomes 1, 3, and 4. Upon completion of this activity, you will be able to:

• Identify why it is important to have a pre-established incident response plan. (CO 1, 2)
• Analyze how some breaches are detected. (CO 1, 2, 5)
• Evaluate various response efforts (CO 1, 3)

When cyber-attacks hit organizations, the consequences can be costly for years to come. Costs related to mitigation and recovery, corporate branding, and market share are often impacted after a major brief and (as reflected by the Target and Home Depot breaches, for example) a quick and effective response can help minimize the loss.

Having a systematic approach to incident detection and response can also provide a company with information they can use to strengthen the enterprise and address legal issues that may arise as a result of the attack. During this exercise, we will review two documents that examine response efforts.

Read the following documents and respond to the discussion question below.

• Creasey, J. & Glover, I. (2000). Cybersecurity incident response guide (Links to an external site.) [PDF file size 5.5 MB]. Retrieved from https://www.crest-approved.org/wp-content/uploads/2014/11/CSIR-Procurement-Guide.pdf
• Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (Links to an external site.) [PDF file size 1.4 MB]. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
• SWOT analysis 1: Looking outside for threats and opportunities (Links to an external site.) [PDF file size 398 KB]. (n.d.). Harvard Business School. Retrieved from https://inside.artcenter.edu/ed/file.php/26283/SWOT_Analysis_1_Loooking_Outside.pdf
• Zeltser, L. (2008, August 29). SWOT matrix for describing security posture (Links to an external site.). Retrieved from https://isc.sans.edu/forums/diary/SWOT+matrix+for+describing+security+posture/4939/

Respond to the following:

• Select one or two topics on incident response from the documents above and do a SWOT analysis of the topic(s).
• Describe and explain why the topic(s) is/are an important component of incident response?
• Are there challenges that should be considered in regard to implementation of the topic?