- [Lecturer] As you can imagine,
when it comes to incident response
there are many stakeholders involved.
It is important to identify those stakeholders
before an incident happens.
According to NIST SP800-61.
It is important to identify groups
within the organization that may need to participate
in incident handling
so that their cooperation can be solicited
before it is needed.
Every incident response team relies on the expertise,
judgment and abilities of others.
Including management, information assurance,
IT support,
legal,
public affairs
and media relations,
human resources, business continuity planning
and physical security and facilities management.
Let's dig into these a bit more.
Management establishes incident response, policy,
budget, and staffing.
Ultimately management is held responsible for
coordinating incident response among various stakeholders
minimizing damage and reporting to Congress, OMB
the General Accounting Office GAO and other parties.
Information security staff members may be needed
during certain stages of incident handling prevention,
containment, eradication, and recovery.
For example, to alter network security controls such as,
firewall rule sets.
IT technical experts
or system and network administrators
not only have the needed skills to assist
but also usually have the best understanding
of the technology they manage on a daily basis.
Legal experts should review incident response plans
policies, and procedures to ensure their compliance with law
and federal guidance, including the right to privacy.
In addition, the guidance of the general counsel
or legal department should be sought.
If there's reason to believe that an incident
may have legal ramifications, including evidence collection
prosecution of a suspect or a lawsuit,
or if there may be need for a memorandum of understanding
or other binding agreements involving liability limitations
for information sharing.
Public relations and media relations,
depending on the nature of impact
of an incident, a need may exist
to inform the media and by extension the public.
Human resources,
if an employee is suspected of causing an incident
the human resource department may be involved.
For example, in assisting with disciplinary proceedings.
Business continuity planning,
organizations should ensure that incident, response,
policies and procedures
and business continuity processes are in sync.
Computer security incidents undermine the business
resilience of an organization.
Business continuity planning professionals
should be made aware of incidents and their impacts
so that they can fine tune business impact assessments
risk assessments, and continuity of operations plans further
because business continuity planners have
extensive expertise in minimizing operational disruption.
During severe circumstances they may be valuable
in planning responses to certain situations
such as denial of service conditions.
Lastly, physical security and facilities management
some computer security incidents occur
through breaches of physical security
or involved coordinated logical and physical attacks.
The incident response team also may need access
to facilities during incident handling.
For example, to acquire a compromised work station
from a locked office.