CIS 608 Logo

CIS 608 Logo
CIS 608 - Information Security Management

Friday, September 23, 2011

Post 019 - CIS 608

Assignment 4.2 (post to the Week 4 Forum)

This assignment is worth 50 points; 25 points for your original posting, and 25 points for participation.

Using the format provided in the text, design a basic incident response plan for your home computer, modifying for home use as necessary. Include all three phases for each of the following events:

• Virus attack (not caught by anti-virus software)

• Power failure

• Fire

• Burst water pipe

• ISP failure

In your response to others, comment whether anything is missing from the plan, or if you have suggestions for improvement.

Minimum Posting Requirements: You must post at least five messages to get credit for participation. The first message is your original posting is due by Wed. At least two of the other messages must be responses to other student original postings. This is a pass/fail type of grade. If you meet the minimum requirements you get the points. If you do not meet the minimum requirements, you'll get no points for participation. Messages must be posted on more than one day. Don't wait until the last minute!

Basic Incident Response Plan for the Slater-Roguska Household, 2011

William Slater

CIS 608 Information Security Management

Bellevue University

Week 4, Assignment 4-2

Gary Sparks, M.S. - Instructor

September 21, 2011

Introduction

This paper contains a brief Incident response for my home computers. My wife, Joanna Roguska is the User Department and I am the Technology Services Department.

1.

Virus Attack
(not caught by anti-virus software)

Before Attack

Users
  1. Keep anti-virus software running.
  2. Update virus signatures at least weekly.
  3. Attend virus awareness training.
  4. Learn how to detect and take basic steps during a virus attack.
  5. Perform back-ups of vulnerable data on a regular basis.
  6. Rotate most current backup media offsite.

Technology Services
  1. Provide education and training about virus attack awareness.
  2. Provide education about the dangers and attack profiles of the most prevalent kinds of malware attacks.
  3. Instruct users about proper method for data backups.
  4. Randomly test backups using restores to ensure the quality of the backup procedures, the training, and the quality of the media.
  5. Provide offsite backup media service.
  6. Ensure that a current Incident Response Plan is in place to deal with active attacks and post attack situations.


1.

Virus Attack
(not caught by anti-virus software)

After an Attack

Users
  1. Work with Technology services to determine the extent of data loss.
  2. Work with Technology Services to determine the root causes.
  3. Work with Technology Services to provide input updates to the Lessons Learned
  4. Work with Technology Services to provide input updates to the Incident Response Plan
  5. Work with Technology Services to provide input updates to the Security Awareness Training
  6. After Technology Services performs the restore, verify that the data restored properly.

Technology Services
  1. Inspect equipment to ensure there was no permanent damage.
  2. Obtain current backup media from offsite.
  3. Assess the extent of the damage and to determine if the attack is over
  4. Determine if the virus has polymorphed itself into a form were it is no is a quiescent state, waiting for some random period of to launch a new attack from the inside.
  5. Perform a restore.
  6. Review the incident to determine how the incident happened.
  7. Determine how to increase controls to prevent future occurrences.
  8. Update the Lessons Learned Log.
  9. Update the Security Education materials to incorporate the Lessons Learned
  10. Update the Incident Response Plan, if necessary to incorporate Lessons Learned


1.

Virus Attack
(not caught by anti-virus software)

During Attack

Users
  1. Follow training instructions that tell the user what to do when a computer is identified as being under attack.
  2. If possible, disconnect the network cable.
  3. If the computer is a wireless network device, shut it down immediately.
  4. Do not attempt to fix the problem.
  5. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.

Technology Services
  1. Be available for contact at an emergency contact number in case a computer comes under attack.
  2. Follow the Incident response plan and help the user to remain calm.
  3. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.
  4. Contact the owner to inform them that an attack is in progress.

2.

Power Failure

Before Attack

Users
  1. Attend Information Security Awareness Training that includes information about procedures for handling power outages
  2. Ensure that all computer equipment is working normally.
  3. Ensure that computers with critical data have an emergency UPS power supply and it the computer is plugged into the UPS, and working properly with the UPS,
  4. Ensure that the battery will allow time for proper shutdown.
  5. Perform back-ups of vulnerable data on a regular basis.
  6. Rotate most current backup media offsite.
  7. Have a flashlight with good batteries handy in case there is a power failure.

Technology Services
  1. Ensure that the Information Security Awareness Training that includes information about procedures for handling power outages.
  2. Ensure that the Information Security Awareness Training which includes information about Power Outages has been conducted with the user.
  3. Ensure that all computer equipment is working normally.
  4. Ensure that computers with critical data have an emergency UPS power supply and that the battery will allow time for proper shutdown.
  5. Instruct users about proper method for data backups.
  6. Randomly test backups using restores to ensure the quality of the backup procedures, the training, and the quality of the media.
  7. Provide offsite backup media service.


2.

Power Failure

After an Attack

Users
  1. Work with Technology services to determine the extent of data loss.
  2. Work with Technology Services to determine the root causes.
  3. Work with Technology Services to provide input updates to the Lessons Learned
  4. Work with Technology Services to provide input updates to the Incident Response Plan
  5. Work with Technology Services to provide input updates to the Security Awareness Training
  6. After Technology Services performs the restore, verify that the data restored properly

Technology Services
  1. Inspect equipment to ensure there was no permanent damage.
  2. Obtain current backup media from offsite.
  3. Assess the extent of the damage and to determine if the power outage is over
  4. Perform a restore.
  5. Review the incident to determine how the incident happened.
  6. Determine how to increase controls to prevent future occurrences.
  7. Update the Lessons Learned Log.
  8. Update the Security Education materials to incorporate the Lessons Learned
  9. Update the Incident Response Plan, if necessary to incorporate Lessons Learned


2.

Power Failure

During Attack

Users
  1. Follow training instructions that tell the user what to do when a power failure occurs
  2. Do not attempt to fix the problem.
  3. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.
  4. Use a flashlight to get to a safe place.

Technology Services
  1. Be available for contact at an emergency contact number in case a power failure occurs.
  2. Follow the Incident response plan and help the user to remain calm.
  3. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.
  4. Contact the owner to inform them that a fire is in progress.


3.

Fire

Before Attack

Users
  1. Attend Information Security Awareness Training that includes information about procedures for handling fires
  2. Ensure that all computer equipment is working normally.
  3. Ensure that there are smoke detectors nearby.
  4. Ensure there are A-B-C fire extinguishers nearby.
  5. Take fire extinguisher training yearly.
  6. Perform back-ups of vulnerable data on a regular basis.
  7. Rotate most current backup media offsite.
  8. Have a flashlight with good batteries handy in case there is a power failure associated with the fire.
  9. Have a respiration kit handy in case there are sudden toxic fumes

Technology Services
  1. Ensure that the Information Security Awareness Training that includes information about procedures for handling fires.
  2. Ensure that the Information Security Awareness Training which includes information about fires has been conducted with the user.
  3. Ensure that all smoke detectors are working normally.
  4. Instruct users about proper method for data backups.
  5. Randomly test backups using restores to ensure the quality of the backup procedures, the training, and the quality of the media.
  6. Provide offsite backup media service.


3.

Fire

After an Attack

Users
  1. Work with Technology services to determine the extent of data loss.
  2. Work with Technology Services to determine the root causes.
  3. Work with Technology Services to provide input updates to the Lessons Learned
  4. Work with Technology Services to provide input updates to the Incident Response Plan
  5. Work with Technology Services to provide input updates to the Security Awareness Training
  6. Work with Technology Services to acquire new equipment if necessary.
  7. After Technology Services performs the restore, verify that the data restored properly

Technology Services
  1. Assess the extent of the damage.
  2. Determine if new equipment is required. If so, work through the owner to purchase it.
  3. Obtain current backup media from offsite.
  4. Perform a restore.
  5. Review the incident to determine how the incident happened.
  6. Determine how to increase controls to prevent future occurrences.
  7. Update the Lessons Learned Log.
  8. Update the Security Education materials to incorporate the Lessons Learned.
  9. Update the Incident Response Plan, if necessary to incorporate Lessons Learned.


3.

Fire

During Attack

Users

1. Call 911.

2. Follow training instructions that tell the user what to do when a fire occurs

3. If possible, use the fire extinguisher to extinguish the fire.

4. If the fire cannot successfully be extinguished, evacuate the building.

5. If necessary user emergency respirator equipment to allow for safe breathing.

6. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.

7. Use a flashlight to get to a safe place.

Technology Services

1. Be available for contact at an emergency contact number in case a fire occurs.

2. Follow the Incident response plan and help the user to remain calm.

3. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.

4. Contact the owner to inform them that a fire is in progress.

4.

Burst Water Pipe

Before Attack

Users
  1. Attend Information Security Awareness Training that includes information about procedures for handling burst water pipes.
  2. Ensure that all computer equipment is working normally.
  3. Ensure that there are water pressure detectors nearby.
  4. Perform back-ups of vulnerable data on a regular basis.
  5. Rotate most current backup media offsite.
  6. Have a flashlight with good batteries handy in case there is a power failure associated with the fire.

Technology Services
  1. Ensure that the Information Security Awareness Training that includes information about procedures for handling burst water pipes.
  2. Ensure that the Information Security Awareness Training which includes information about burst water pipes has been conducted with the user.
  3. Ensure that all water pressure detectors are working normally.
  4. Instruct users about proper method for data backups.
  5. Randomly test backups using restores to ensure the quality of the backup procedures, the training, and the quality of the media.
  6. Provide offsite backup media service.


4.

Burst Water Pipe

After an Attack

Users
  1. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.
  2. Work with Technology services to determine the extent of data and equipment loss.
  3. Work with Technology Services to acquire new equipment if necessary.
  4. Work with Technology Services to determine the root causes.
  5. Work with Technology Services to provide input updates to the Lessons Learned
  6. Work with Technology Services to provide input updates to the Incident Response Plan
  7. Work with Technology Services to provide input updates to the Security Awareness Training
  8. After Technology Services performs the restore, verify that the data restored properly

Technology Services
  1. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.
  2. Assess the extent of the damage.
  3. Determine if new equipment is required. If so, work through the owner to purchase it.
  4. Obtain current backup media from offsite.
  5. Perform a restore.
  6. Review the incident to determine how the incident happened.
  7. Determine how to increase controls to prevent future occurrences.
  8. Update the Lessons Learned Log.
  9. Update the Security Education materials to incorporate the Lessons Learned.
  10. Update the Incident Response Plan, if necessary to incorporate Lessons Learned.


4.

Burst Water Pipe

During Attack

Users

1. Call Technology Services.

2. Follow training instructions that tell the user what to do when a burst water pipe occurs.

3. Turn off computer equipment.

4. If the flooding becomes severe, evacuate the building.

Technology Services

1. Be available for contact at an emergency contact number in case a burst water pipe occurs.

2. Follow the Incident response plan and help the user to remain calm.

3. Do not destroy or tamper with anything, because it could be evidence if a crime occurred.

4. Contact the owner to inform them that a burst water pipe situation is in progress.


5.

ISP Failure

Before Attack

Users
  1. Attend Information Security Awareness Training that includes information about procedures for an ISP failure.
  2. Ensure that all computer equipment is working normally.
  3. Ensure that key users have USB cellular modems as a back-door Internet access.

Technology Services
  1. Ensure that the Information Security Awareness Training that includes information about procedures for handling burst water pipes.
  2. Ensure that the Information Security Awareness Training which includes information ISP Failures has been conducted with the user.
  3. Ensure that all USB cellular modem devices are operable.
  4. Instruct users about the use of USB cellular modem devices are operable.

5.

ISP Failure

After an Attack

Users
  1. Attend Information Security Awareness Training that includes information about procedures for ISP Failure.
  2. Contact Technology Services.

Technology Services
  1. Review the incident to determine how the incident happened.
  2. Determine how to increase controls to prevent future occurrences.
  3. Update the Lessons Learned Log.
  4. Update the Security Education materials to incorporate the Lessons Learned.
  5. Update the Incident Response Plan, if necessary to incorporate Lessons Learned.


5.

ISP Failure

During Attack

Users

1. Call Technology Services.

2. Follow training instructions that tell the user what to do when an ISP outage occurs.

3. Attempt to connect to the Internet using a cellular modem USB device as a back-door internet connection.

Technology Services

1. Be available for contact at an emergency contact number in case an ISP outage occurs..

2. Follow the Incident response plan and help the user to remain calm.

3. Contact the owner to inform them that an ISP outage situation is in progress.

References:

Whitman, M. E. and Mattford, H. J. (2010). Management of Information Security. Course Technology: Boston, MA.

Posted by at
Labels:

1 comment:

  1. Cyber security training courses onlineJanuary 30, 2019 at 12:48 PM

    Nice blog. An incident response plan is a set of instructions to help IT staff detect, respond to, and recover from network security incidents.

    ReplyDelete

Subscribe to: Post Comments (Atom)