A Structured Approach to Incident Response

Peter Stephenson

Digital incident response is one of the most difficult tasks facing information assurance professionals today. The notion of responding to a digital incident begs several questions: what is the primary purpose of the response? What are appropriate post-response activities? Who should coordinate the response? What is the nature of the response team? Should you include outside help? If so, who?

This seminar tackles the problem of incident response with a formalized approach based on pre-planning and structured execution. We will explore the problem of digital incident response, planning for incidents, developing a response team, containment of incidents, preparing for post-incident root cause investigation and responding to legal and regulatory requirements.

Throughout the two days, attendees will interact with colleagues in teams to produce incident response plans, address legal issues and prepare for an incident. At the end of the two-day session the teams will respond to mock incidents and present their results to the rest of the class.