search the web for an organization (i.e., company, government, university, etc.) that uses a computer incident response plan (CIRP). Discuss the scope, roles and responsibilities, escalation levels, and computer incident response team (CIRT). Feel free to modify these points based on what is available in the CIRP.

search the web for an organization (i.e., company, government, university, etc.) that uses a computer incident response plan (CIRP). Discuss the scope, roles and responsibilities, escalation levels, and computer incident response team (CIRT). Feel free to modify these points based on what is available in the CIRP.

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter10: Planning For Contingencies

Section: Chapter Questions

Problem 6RQ

See similar textbooks

Similar questions

State the details of an incident that you have read about (Example: breach due to attack, employee theft of data, etc.) and then use the incident response steps to analyze how you would handle the incident. Be certain to clearly name and define each step (Step 1: Identifying the Incident, etc.).
1. You've just been hired as a Chief Information Security Officer for a small startup. They've written four applications and just got funding to go live. Before they do so, they realized they've never had a cybersecurity professional, so they've hired you. While there are hundreds of things to do, you are asked to come up with a list of your top TEN (10) items, in a bulleted list, to focus on in the first day or two. These can be questions to ask or actions to take, and aren't meant to be the full solution, but the initial things you'll do to get control of the situation. Provide a NUMBERED LIST of TEN (10) items that is your initial list of priority areas to focus on and potential actions to take. Do not use more than one line per item. Many aswers are correct, so credit is given for coming up with ten good and comprehensive focus areas based on what we've covered in class, in the labs, and in our readings.
An organization's computer incident response plan may be accessed on the internet by searching for a company, government agency, or institution that implements one (CIRP). Set up an incident response team with responsibilities and escalation levels that are well defined (CIRT). There are several ways to customise these points in the CIRP.
Is there a company's procedure for sharing information in an incident response plan?
What is a Containment Strategy for an Incident? Give one example and talk about it.
No matter how an organization breaks up the incident response management process, the incident report team must have clear roles and a clear plan of action. Respond to the following in a minimum of 175 words: Discuss a policy and/or procedure regarding incident response priorities that an organization should have in place for its IT team. Share the circumstance, the potential policy, the team member(s) affected, and how it helps protect the organization.
NIMS has both strengths and weaknesses when it comes to crisis communication. No, I can't think of one that happened recently where NIMS didn't work the way it was supposed to. This could be because emergency managers don't have a lot of experience or aren't well-trained. It could also be because there aren't any standard operating procedures in place (SOPs).
There is a need for an Intrusion Detection System. Read the given parameters and write your decision about the type of intrusion detection system you would use to fulfill the requirements; Requirements: The intrusion detection system must - Monitor system activities for signs of suspicious behavior. - Analyze traffic and log malicious behavior - Provide visibility into what's happening on your critical security systems - Help to identify threats inside the network perimeter
List and describe the criteria used to determine whether an actual incident is occurring.
Where do you believe the responsibility for information security begins and ends in a company? In order to know when security policies and procedures become active and inactive, we must know how much control the organization has over those times. Perceived or actual, do you think any of these boundaries will be increased in size? If this is the case, tell us how and why you went about it. If this isn't the case, why is that?
The CISO approaches the interns who seem to be breaking various security standards, who express their displeasure. According to the organization, they don't encrypt their workstations, download unlicensed music, connect personal devices to corporate computers, spend too much time on social media, and download pornographic content on workplace systems. The CISO recommends that you create a security document (Rules of Behavior) that has at least 15 rules limiting what employees may and may not do when connected to the corporate network.
Help desk technicians should have four investigative questions ready to ask when a user comes in with the complaint, "My computer won't start." This will help them narrow down the possible causes of the issue and provide a more efficient resolution.