5-2 Discussion_ Mindset_ Incident Response Procedures, Forensics, and Forensic Analysis

docx

School

Southern New Hampshire University *

*We aren’t endorsed by this school

Course

-510

Subject

Information Systems

Date

Oct 30, 2023

Type

docx

Pages

Uploaded by ElderLightning8081

Hello all, During a system audit a remote login was identified as an IP address located in North Korea. As our company currently does not have ties to North Korea we must take next steps as quickly as possible. As a defender of the system the incident response life cycle should be implemented in order to ensure that all bases are covered when dealing with the attack. The first step is preparation; however, the attacker has already entered the system and we are in the process of detection and analysis. The IP address has been located allowing network and data administrators to run the IP address and view the log books. This will tell the user what the attacker gained access to, where the attacker is located, and can assist in the next step of containment, eradication, and recovery. During this process in this case, the IP address would be contained and the attacker would no longer have access into the system as the defenders, network administrators would change the user information including new passwords, login information, and entry ways into the system (NIST, 2012). This assists in containing the attacker and prevents any further damage. This then allows the investigating user of the system to eradicate the attacker by examining where the attacker has been and where the attacker is. Firewall and anti-malware will then be introduced into the system to protect the company and eradicate the attacker. The next steps that need to be taken are post incident activity such as documentation and preparation for the next attack. Documentation will highlight what occurred, who was responsible, all parties involved, and the incident that occurred. The information technology team will then meet and review the incident response plan as a precaution for the next event. It is important to learn from the incident therefore the information technology team should remain trained and vigilant against attacks both internal and external.

Please see the below image for more information on the incident response life cycle (NIST, 2012). Reference NIST. (2012). Computer Security Incident Handling Guide . NIST Technical Series Publications. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Thank you all! Best, Ryan White

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version