Unit 11 Topic D: Incident Response Policies

Front

An event that poses a threat to the business information, in regard to its confidentiality, integrity & availability

Back

An information security incident

Front

When an incident is detected or suspected, what is the first action that should take place?

Back

It must be reported to the appropriate person (probably the CSIRT team leader)

Front

When an initial assessment of the event takes place, what is the first thing to identify?

Back

Whether an actual incident has taken place at all

Front

When should the removal and secure storage of original hard disks take place?

Back

After evidence has been backed up but before the compromised system has been wiped

Front

Who should be contacted before notifying any external agencies?

Back

Legal representatives

Front

What name is given to the team that needs to be assembled as part of the IR policy?

Back

Computer Security Incident Response Team (CSIRT)