Computer Incident Emergency Response Plan CIERP

1
Computer Incident / Emergency Response
Plan(CI/ERP)

• By Christopher Connolly

2
Introduction

• Embezzlement, theft, Internet abuse, and other
  unauthorized employment activity commonly occur
  at work.
• Many agencies and organizations developed the
  Computer Incident / Emergency Response Plan to
  handle these occurrences.

3
What Is The Purpose Of The CI/ERP ?

• The purpose of the CI/ERP is to provide a
  response to computer security incidences in a
  timely and coordinated manner to reduce their
  impact on the effectiveness of systems internal
  to an organization (Killmeyer, 2006).

4
CI/ERP Benefits Security Managers

• - Emergency Response Team can streamline the
  handling of an incident.
• - Provides a chain of custody
• - Limits the effectiveness of the incident
• - Recovers from the incident
• - Determines how to avoid similar incidences in
  the future
• - Determines how the incident originated
• - Estimates the impact of the damage

5
Implementing The CI/ERP

• Report the Problem
• Establish the Incident Report Form
• Contact Assistance
• Notify and Establish Meeting With Team
• Determine the Extent of the Incident
• Provide Periodic Status Updates
• Determine Steps to Restore Operations
• Develop and Implement the Action Plan
• Document All Actions
• Conduct Post-incident Review
• Continue to Monitor Area
• Close Out the Incident

6
Tips Of The Trade

• Emergency Response Team must train together so
  each member can work together smoothly and
  effectively.
• Each member should be selected based on their
  level of expertise.
• CI/ERP must be effective and efficient whether
  the incident is minor or on a large scale.
• Think big.
• Keep it simple and easy to use.

7
(No Transcript)
8
Summary

• The CI/ERP was developed to limit the
  effectiveness of an incident and prevent any
  future incidents.
• Each member of the emergency response team should
  have at least a specified role in the plan.
• For the plan to be fully developed,
  implementation must be exercised through
  training.

9
For More Information

• http//www.cert.org/csirts/Creating-A-CSIRT.html
• http//www.redhat.com/docs/manuals/enterprise/RHEL
  -4-Manual/security-guide/s1-response-plan.html
• http//labmice.techtarget.com/security/incidentres
  ponse.htm
• http//www.computerworld.com/printthis/2005/0,4814
  ,100720,00.html
• http//www.processor.com/editorial/article.asp?art
  iclearticles2Fp29222F23p222F23p22.asp
• http//articles.techrepublic.com.com/5100-10878_11
  -5905930.html
• http//www.ts.vcu.edu/policies/cert_procedure1.htm
  l

10
Questions

• ?