From National Institute of Standards and Technology | Jul 31, 2009
Computer security incident response has become an important component of information
technology (IT) programs. Security-related threats have become not only more numerous
and diverse but also more damaging and disruptive. New types of security-related
incidents emerge frequently. Preventative activities based on the results of risk
assessments can lower the number of incidents, but not all incidents can be prevented.
An incident response capability is therefore necessary for rapidly detecting incidents,
minimizing loss and destruction, mitigating the weaknesses that were exploited and
restoring computing services. To that end, this publication provides guidelines for
incident handling, particularly for analyzing incident-related data and determining the
appropriate response to each incident. The guidelines can be followed independently of
particular hardware platforms, operating systems, protocols or applications.
Because performing incident response effectively is a complex undertaking,
establishing a successful incident response capability requires substantial planning
and resources. Continually monitoring threats through intrusion detection and
prevention systems (IDPSs) and other mechanisms is essential. Establishing clear
procedures for assessing the current and potential business impact of incidents is
critical, as is implementing effective methods of collecting, analyzing and reporting
data. Building relationships and establishing suitable means of communication with
other internal groups (e.g., human resources, legal) and with external groups (e.g.,
other incident response teams, law enforcement) are also vital.
This publication seeks to help both established and newly formed incident response
teams. This document assists organizations in establishing computer security incident
response capabilities and handling incidents efficiently and effectively.
The attached Zip file includes:
- Intro Page.doc
- Cover Sheet and Terms.pdf
- Computer Security Incident Handling Guide.pdf
