CO2517 Week 05

Recap: Put these in the right order

• Preparation

• Detection & Analysis

• Containment Eradication & Recovery

• Post-Incident Activity

Which of these describes an Incident Response Plan

• Provides a clear guide on exactly what to do during an data breach.

• Outlines the processes involved in declaring a disaster and ensuring continuity of business operations

• Describes how to maintain operations during and after an indicent

• Tracks the movement of evidence throughout the investigation

Answer explanation

The IR plan is the overarching document that gives your team clear guidance on exactly what to do during incidents, data breaches, and other pressure-packed situations when it’s easy to get overwhelmed. If you realize you may be facing a cybersecurity incident, the IR plan will help direct your actions.

What 2 types of information are typically in an IR Plan? Select two

• IR Information - such as the detection processes

• Organisational - such as the reporting mechanisms

• External Client Information - including competition information.

• Business Profit information

Which of these is NOT part of the Preparation for an Incident Response

• Incident Response Policy

• Incident Response Plan

• Standard Operating Procedures

• Monitoring

Answer explanation

Monitoring for some time after the incident to observe operations and check for abnormal behaviors is usually part of Recovery

Preparation includes communication elements, such as (choose two);

• Contact details of all staff as a IR Team.

• Contact details of all staff within the business.

• Escalation Process

• documentation for predicted questions.

Match the following to its purpose

• Policy limitations

• Roles and Responsibilities

• Objectives of the IR

• IR Scope

• Critical actors in the response.

• What goals are aimed for

• Why does this incident need to be managed.

• IR programme mission

Policy requirements should include the need to have all incidents recorded and __________ before analysis begins.

High-priority incidents should be escalated to the CEO.

• Yes

• No

Which of these should NOT be on an Incident Form?

• Date and Time of incident Detection

• Name of Reporter

• Impact Cost of Incident

• Observation method

IR Procedures include ;

• Instructions

• Checklists

• Some Flexibility

• Defined Solutions

• All of these options