Incident Response Book Review
Incident Response
Book Review
| by Dale Farris, President, Golden Triangle PC Club October 2001 This new O'Reilly book, "Incident Response," presents an excellent summary of technical information with guidelines for administrative planning so organizations can map out their responses to computer incidents. The special authors selected for this important work show how the incident response process needs to be planned, efficient, and as business-like as any other IT operation in a mature organization. Sadly, in truth computer crises happen, and being able to effectively respond to these crises makes good business sense. In this timely book, you will find a complete guide for organizations of all sizes and types that are addressing their computer security issues. Before this concept of incident response, computer network administrators mostly responded to computer intrusions and security problems. In November 1988, after the Morris Worm, several computer network administrators founded the Computer Emergency Response Team/Coordination Center (CERT/CC) in Pittsburgh, PA. This team was involved in countless hours of analysis of log files and file systems looking for clues to explain what had happened to their systems and to identify other systems on the Internet that had been broken into. In 1988, computer security was not on the top of most system administrator's lists of things to worry about. Information on security was hard to find and the resources of the Internet were not yet developed and there was very little in print to help administrators deal with security issues. What a difference now! Today, preparing to handle a computer security incident has become a top priority for most all system administrators, a sign of the times and the need now to be more diligent about protecting computer security than ever before. There are now several computer incident response teams formed around the country, mainly in the larger corporate information systems, and there are now several sources of information and tools to be used in this important work. These tools help keep systems secure, and many are also featured in this very important new book from O'Reilly. As businesses increase their online presence and dependency on information systems assets, the number of computer incidents also rises. These organizations are finally increasing their security postures. This is accomplished in three stages. First, organizations must develop and implement security plans and controls in a proactive effort. Secondly, they must work to ensure their plans and controls are effective by continually reviewing and adapting them to ensure that appropriate security is always in place. And finally, when controls are bypassed either intentionally or unintentionally, organizations must be prepared to act quickly and effectively to minimize the impact of these situations. The goal is to prevent an operational security problem from becoming a business problem that impacts revenue. With this book, you can learn guidelines to help plan a response to incidents and minimize any negative impact to a business. Waiting until an incident occurs is of course too late to begin planning how to address the situation. Incident response planning requires both administrative and technical roles. Both parties need to be familiar with the other's role, responsibilities and capabilities. This book is thus written for both administrators and managers, as well as the technical people, all needing to plan for and understand the response to computer incidents. Content Features What incident response is, and the problems of distinguishing real risk from perceived risk The different types of incident response teams, and advantages and disadvantages of each Considerations in planning and establishing an incident response team State of the Hack information about different types of attacks Recommendations and details about available tools for incident response teams Detailed information about all sorts of resources available to incident response teams Table of Contents The eight (8) thorough chapters include the following.
The two appendices include Appendix A, "FIRST,"
information on the Forum of Incident Response and Security Teams (FIRST),
the all-volunteer community organization comprised of incident response
teams from virtually every sector and around the world, and Appendix B,
"Sample Incident Report," regarding a real-world situation where
a technically-savvy manager arbitrarily shut down a firewall protecting a
critical server cluster supporting a major e-commerce company. |