Reference no: EM133931477

Assignment:

You are an analyst working at Techno Intelligence Threat Systems. They have an existing set of procedures to deal with these two unwanted security incidents:

• A suspected DDOS attack
• A suspected phishing attack

The existing procedure is as follows. Your boss believes that these procedures need to be improved.

• Identification of the network attack
• Disconnect the infected computer from the network
• Scan the computer with updated antivirus and antimalware, and remove all suspected files and software
• Connect the computer to the network

Read the above procedures for these two potential security incidents. Evaluate them and highlight issues with them that may result in poor handling of these incidents. Choose at least one subtask and discuss how it could be modified to improve the handling of the incidents.

Identification of the network - should include the scope and evidence documentation. I..e who, what, where, why and how. All incident identification should have 2 handlers - 1 to ID and assess the incident and another to gather evidence. Once an event is determined to be an incident the CIRT must be notified and designated command centre staff.

Write your evaluation as a report which you will forward to your boss.