[工学]IncidentResponse.ppt

You can’t determine if an incident has occurred unless there are detection techniques. It makes sense that there is a detection technique and/or metric for each risk of concern. The above tools do not need to be implemented, depending on the decision of risk assessment. However, they are useful tools for detecting incidents. Here it is time to determine the root of the problem and its effects. Testing incident response can start with easier operations and proceed to more complex. Often part of the problem is the long time it takes or the errors which are made, which can be optimized by practice. In court it is likely that there may be a disagreement of the drives and connectors that were available on the computer(s). Therefore, a picture of the computers and site may be required to eliminate all ambiguous discussion in court. * This is in an abbreviated form to fit on a slide. The Method of Detection is how we will know if an incident occurs. There may be many methods. The procedural response can refer to another document, which has a more extensive description. (Short form shown here) You may remember from MASH (TV show and movie) that Triage is about stopping bleeding and prioritizing injuries to maximize the probability of survival. Same thing here: determining what is wrong and taking the correct first actions until the bleeding stops and the experts are ready to take over. How to declare a disaster involves more than communication; it also means when to declare a disaster, as opposed to some lesser incident. You want your response to be proportional to the scale of the incident . If you overreact (shutting down the entire network over one unauthorized entry) you’ll waste a lot of time and money. If you underreact, the incident may become a lot worse than it already is. * Triage happens at a hospital: When you come in you are asked questions to determine how long you can wait to see a doctor. (You get prioritized compared to the other emergency