Incident Response

by: Kenneth R. van Wyk & Richard Forno

Notify me when in stock

On-line Price: $53.95 (includes GST) Paperback package 234 40%Off Retail Price You save: $36.00 Sorry, this clearance item is sold out. For a fresh copy. ETA is TBA - Price Subject to Change.	Retail Price: $89.95 Publisher: O'REILLY,Sep-2001 Category: COMPUTER SECURITY Level: B/I/A ISBN: 0596001304 ISBN13: 9780596001308
Add to Shopping Cart

Are you ready for a computer 'incident,' such as a security breach? Incident Response shows you both the technical and administrative aspects of building an effective incident response plan. You'll learn about the different types of incidents and ways to respond to them, how to put together an incident response team, what procedures to use, what tools there are for investigating incidents, and where to find extensive online resources.

  Related O'Reilly Titles:

Building Internet Firewalls, 2nd Edition

Malicious Mobile Code

Securing Windows NT/2000 Servers for the Internet

      Full Description

Seventy percent of businesses reported security breaches in 2000, and the rate is on the rise. Is your organization ready to respond to such an incident head-on? Will you be able to tell whether an incident is an attack or a glitch in the system? Do you know how to assess the possible damage from an incident? Incident Response shows you how to answer questions like these and create a plan for exactly what to do before, during, and after an incident.

  The authors of Incident Response draw on years of experience developing and taking part in incident response teams at the highest levels of government and business. They guide you through both the technical and administrative details of effective incident response planning as they describe:

  What incident response is, and the problems of distinguishing real risk from perceived risk

The different types of incident response teams, and advantages and disadvantages of each

Planning and establishing an incident response team

State of the Hackr information about different types of attacks

Recommendations and details about available tools for incident response teams

Resources available to incident response teams

Whatever your organization's size or purpose, Incident Response shows how to put in place an incident-response process that's as planned, efficient, and businesslike as any other IT operation in a mature organization. Incidents happen, and being able to respond to them effectively makes good business sense.

Table of Contents

Foreword

  Preface

  1. What Is Incident Response?

          Real-Life Incidents

          What Is an Incident?

          About the Bad Guys

          What Is Incident Response?

          Risk Assessment and Incident Response

          Development of Incident Response Efforts

          Are You Ready? Are You Willing?

  2. Incident Response Teams

          Who Should Do It?

          Public Resource Teams

          Internal Teams

          Commercial Teams

          Vendor Teams

          Ad Hoc Teams

          Forum of Incident Response and Security Teams (FIRST)

          Now Who Should Do It?

  3. Planning the Incident Response Program

          Establishing the Incident Response Program

          Internal Versus External

          Types of Incidents

          Who Are the Clients?

          Summary

  4. Mission and Capabilities

          Roles and Responsibilities

          Staffing and Training

          Involving the Critical Players

          List of Contacts

          Setting Up a Hotline

          Establishing Procedures

          Awareness and Advertising

          Fire Drills

          Issues and Pitfalls

  5. State of the Hack

          The Moving Target

          Keeping Up with Attack Profiles

          Training

  6. Incident Response Operations

          We've Been Hit-Now What?

          Incident Response Processes

          While Under Pressure

  7. Tools of the Trade

          What's Out There?

          Network-Based Tools

          Network Monitors and Protocol Analyzers

          Network-Based Intrusion Detection Systems

          Network Vulnerability Scanners

          Other Essential Network-Based Tools

          Host-Based Tools

          Communications

          Encryption

          Removable Storage Media

          The Incident Kit

          If We Ruled the World

  8. Resources

          Security Information on the Web

          Incident Response Team Resources

          Commercial Incident Response Service Providers

          Antivirus Products

          Mailing Lists and Newsgroups

          U.S. Government Resources

          Training, Conferences, and Certification Programs

          Legal Resources

  A. FIRST

  B. Sample Incident Report

  Index