Reference no: EM132348871
Task : Computer Incident Response Team Plan -
• Loss of company information on a lost company-owned tablet that was left at a security checkpoint in an airport.
• Due to the swipe pattern being easily followed, the person was able to log in quickly to the device. All of the usernames and passwords had been saved on the device
COMPLETE ALL HIGHLIGHTED AREAS BELOW.
Appendix A - Incident Response Worksheet
Preparation:
What tools, applications, laptops, and communication devices were needed to address the Computer Incident Response for this specific breach?
Identification: When an incident is reported, it must be identified, classified, and documented. During this step, the following information is needed:
• Identify the nature of the incident
o What Business Process was impacted
o What threat was identified
o What weakness was identified
o What risk was identified
o What was the Risk Factor/Impact of the incident
o What was the RTO, MTD and RPO assigned to the business process
o What hardware, software, database and other resource were impacted
Containment: The immediate objective is to limit the scope and magnitude of the computer/security-related incident as quickly as possible, rather than allow the incident to continue to gain evidence for identifying and/or prosecuting the perpetrator.
• What needs to be done to limit the scope of the incident
Eradication: The next priority is to remove the computer/security-related incident or breach's effects.
• What needs to be done to mitigate the risk of the incident
Recovery: Recovery is specific to bringing back into production those IT systems, applications, and assets that were affected by the security-related incident.
• What needs to be done to recover the IT systems
o What procedures need to be used and are they covered in the Disaster Recovery Plan
o Would the Business Continuity Plan be executed in response to this incident
o Would any issues be identified that would lead to updates to the BIA, BCP or DR plans.