Incident Response

Seventy percent of businesses reported security breaches in 2000, and the rate is on the rise. This text shows how to be able to tell whether an incident is an attack or a glitch in the system, how to assess the possible damage from an incident, and how to create a plan for exactly what to do before, during, and after an incident. The authors of "Incident Response" guide the reader through both the technical and administrative details of effective incident response planning as they describe: what incident response is, and the problems of distinguishing real risk from perceived risk; the different types of incident response teams, and advantages and disadvantages of each; planning and establishing an incident response team; the state of the Hack information about different types of attacks; recommendations and details about available tools for incident response teams; and resources available to incident response teams. Whatever the size or purpose of the organization, this book shows how to put in place a planned, efficient and business-like incident-response process.

Table of Contents:
Foreword. Preface. 1. What Is Incident Response? Real-Life Incidents What Is an Incident? About the Bad Guys What Is Incident Response? Risk Assessment and Incident Response Development of Incident Response Efforts Are You Ready? Are You Willing? 2. Incident Response Teams Who Should Do It? Public Resource Teams Internal Teams Commercial Teams Vendor Teams Ad Hoc Teams Forum of Incident Response and Security Teams (FIRST) Now Who Should Do It? 3. Planning the Incident Response Program Establishing the Incident Response Program Internal Versus External Types of Incidents Who Are the Clients? Summary. 4. Mission and Capabilities Roles and Responsibilities Staffing and Training Involving the Critical Players List of Contacts Setting Up a Hotline Establishing Procedures Awareness and Advertising Fire Drills Issues and Pitfalls. 5. State of the Hack The Moving Target Keeping Up with Attack Profiles Training. 6. Incident Response Operations We've Been Hit-Now What? Incident Response Processes While Under Pressure 7. Tools of the Trade hat's Out There? Network-Based Tools Network Monitors and Protocol Analyzers Network-Based Intrusion Detection Systems Network Vulnerability Scanners Other Essential Network-Based Tools Host-Based Tools Communications Encryption Removable Storage Media The Incident Kit If We Ruled the World. 8. Resources Security Information on the Web Incident Response Team Resources Commercial Incident Response Service Providers Antivirus Products Mailing Lists and Newsgroups U.S. Government Resources Training, Conferences, and Certification Programs Legal Resources A. FIRST B. Sample Incident Report Index