Principles of Incident Response and Disaster Recovery

PRINCIPLES OF INCIDENT RESPONSE & DISASTER RECOVERY, 2nd Edition presents methods to identify vulnerabilities within computer networks and the countermeasures that mitigate risks and damage. From market-leading content on contingency planning, to effective techniques that minimize downtime in an emergency, to curbing losses after a breach, this text is the resource needed in case of a network intrusion. Cover......Page 1 Title......Page 2 Statement......Page 3 Copyright......Page 4 Dedication......Page 5 Brief Contents......Page 7 Table of Contents......Page 9 Preface......Page 17 Upon Completion of This Material, You Should Be Able to:......Page 25 Introduction......Page 26 Information Security......Page 27 Overview of Risk Management......Page 36 Contingency Planning and Its Components......Page 47 Role of Information Security Policy in Developing Contingency Plans......Page 53 Chapter Summary......Page 58 Review Questions......Page 60 Hands-On Projects......Page 61 Endnotes......Page 69 Upon Completion of This Material, You Should Be Able to:......Page 71 Beginning the Contingency Planning Process......Page 73 Elements Required to Begin Contingency Planning......Page 76 Contingency Planning Policy......Page 78 Business Impact Analysis......Page 81 BIA Data Collection......Page 88 Budgeting for Contingency Operations......Page 100 Chapter Summary......Page 103 Review Questions......Page 104 Real-World Exercises......Page 105 Hands-On Projects......Page 106 Endnotes......Page 110 Upon Completion of This Material, You Should Be Able to:......Page 113 Introduction......Page 115 Data and Application Resumption......Page 117 Site Resumption Strategies......Page 134 Chapter Summary......Page 144 Review Questions......Page 146 Hands-On Projects......Page 147 Endnotes......Page 153 Upon Completion of This Material, You Should Be Able to:......Page 155 The IR Planning Process......Page 157 Developing the Incident Response Policy......Page 160 Incident Response Planning......Page 162 Assembling and Maintaining the Final IR Plan......Page 176 Chapter Summary......Page 178 Review Questions......Page 179 Hands-On Projects......Page 180 Endnotes......Page 187 Upon Completion of This Material, You Should Be Able to:......Page 189 Introduction......Page 191 Detecting Incidents......Page 192 Intrusion Detection and Prevention Systems......Page 198 Incident Decision Making......Page 232 Chapter Summary......Page 239 Review Questions......Page 241 Real-World Exercises......Page 242 Hands-On Projects......Page 243 Endnotes......Page 251 Upon Completion of This Material, You Should Be Able to:......Page 255 Building the CSIRT......Page 257 Outsourcing Incident Response......Page 276 Chapter Summary......Page 278 Review Questions......Page 280 Hands-On Projects......Page 281 Endnotes......Page 288 Upon Completion of This Material, You Should Be Able to:......Page 291 IR Response Strategies......Page 293 Incident Containment and Eradication Strategies for Specific Attacks......Page 299 Chapter Summary......Page 325 Review Questions......Page 327 Hands-On Projects......Page 328 Endnotes......Page 334 Upon Completion of This Material, You Should Be Able to:......Page 337 Introduction......Page 338 Recovery......Page 339 Maintenance......Page 341 Incident Forensics......Page 346 eDiscovery and Anti-Forensics......Page 379 Chapter Summary......Page 380 Review Questions......Page 382 Hands-On Projects......Page 383 Endnotes......Page 389 Upon Completion of This Material, You Should Be Able to:......Page 393 Introduction......Page 394 Disaster Classifications......Page 395 Forming the Disaster Recovery Team......Page 397 Disaster Recovery Planning Functions......Page 401 Information Technology Contingency Planning Considerations......Page 411 Sample Disaster Recovery Plans......Page 415 The DR Plan......Page 417 Chapter Summary......Page 418 Review Questions......Page 419 Hands-On Projects......Page 420 Endnotes......Page 431 Upon Completion of This Material, You Should Be Able to:......Page 433 Facing Key Challenges......Page 435 Preparation: Training the DR Team and the Users......Page 436 Disaster Response Phase......Page 447 Resumption Phase......Page 448 Restoration Phase......Page 449 Chapter Summary......Page 452 Review Questions......Page 453 Hands-On Projects......Page 454 Endnotes......Page 460 Upon Completion of This Material, You Should Be Able to:......Page 461 Introduction......Page 463 Business Continuity Team......Page 464 Business Continuity Policy and Plan Functions......Page 467 Implementing the BC Plan......Page 477 Continuous Improvement of the BC Process......Page 483 Maintaining the BC Plan......Page 489 Chapter Summary......Page 490 Review Questions......Page 491 Real-World Exercises......Page 492 Hands-On Projects......Page 493 Endnotes......Page 499 Upon Completion of This Material, You Should Be Able to:......Page 501 Introduction......Page 502 Crisis Management in the Organization......Page 503 Preparing for Crisis Management......Page 506 Post-crisis Trauma......Page 518 Getting People Back to Work......Page 520 Law Enforcement Involvement......Page 521 Managing Crisis Communications......Page 526 Succession Planning......Page 533 International Standards in IR/DR/BC......Page 537 Chapter Summary......Page 541 Real-World Exercises......Page 543 Hands-On Projects......Page 544 Endnotes......Page 549 Appendix A: Sample Business Continuity Plan for ABC Co.......Page 553 Appendix B: Contingency Plan Template from the Computer Security Resource Center at the National Institute of Standards and Technology......Page 561 Appendix C: Sample Crisis Management Plan for Hierarchical Access, Ltd.......Page 589 Glossary......Page 601 Index......Page 607