事件响应

Who are the Key Players on an 事件响应 Team? 

IR团队中的关键成员是至关重要的，他们应该根据企业的独特情况量身定制行动 违反. 安全组织应该为以下核心职能确定特定的个人或团队: 

• 事件管理这一核心角色需要广泛的技术知识和管理和IR方面的经验. 这个角色的人作为一个整体的项目经理来监督技术任务的完成, as well as information gathering for all involved stakeholders.
• Enterprise incident investigation这就是在大企业工作的挑战与在小公司工作的挑战不同的地方. 大型组织中的大型漏洞需要利用跨团队的技术和伙伴关系来快速协助跨主机(甚至远程主机)的取证，以便团队可以找到 妥协指标 – as well as potential scope – as quickly as possible.
• 技术分析: These roles require technical know-how, 团队中最好有专门研究特定领域的分析师, 比如恶意软件分析, 取证分析, 事件日志分析, 网络分析. 这些分析师发现的任何信息都应该与IR团队的其他成员共享.
• 事故范围: What was the extent of the 违反? That's a crucial question any IR team will need to know. 这个问题的答案可能会随着IR和调查的进行而改变, especially as technical analysis continues.
• 危机沟通: Sharing the findings of the investigation, as well as the scope 和 potential outcomes, will need to happen both internally 和 externally. 经验丰富的危机沟通团队应该向正确的受众传达正确的细节. Their responsibilities may include 违反 notifications, 监管的通知, employee 和/or victim notifications, 新闻发布会, 如果需要.
• Legal, human resources, 和 regulatory concerns如有违约 regulatory or compliance considerations, 团队中要有懂得如何处理披露要求或与执法部门合作的人，这一点很重要, such as a government representative. For teams that do not have in-house expertise for these requirements, specialized legal expertise on retainer is a worthwhile investment.
• 执行决策任何违规行为都可能影响组织的公众形象和财务状况, which is why executive leadership should always be involved. 在调查和调查过程中，将会有关键的决策点, 在这些关键时刻，团队将需要高管的意见.
• 报告和补救: While working on IR, it is important to document everything. 有了这些信息, 团队应该能够拼凑出漏洞的整个故事:攻击者做了什么, 他们是何时以及如何做到的, 和 what they managed to compromise. This will make it possible to create a detailed response plan for 补救和缓解 recommendations to recover from the 违反, 希望能帮助组织抵御未来类似性质的攻击.

What is an 事件响应 Plan? 

An IR plan delineates what steps need to be taken, 是谁干的, when a 违反 or security crisis occurs in an organization. 一个强有力的响应计划应该使团队能够迅速采取行动，并尽可能快地减轻损失. 每一刻都很重要. 这就是为什么紧急事件响应者要经过定期的模拟训练和流程审查, 所以当情况出现时，他们几乎通过肌肉记忆知道如何行动.

To prevent slow responses from occurring in your organization, responders should have a carefully mapped IR plan, rehearsed regularly for a variety of possible scenarios. 关键组织利益相关者和c级高管的支持也很重要, 因此，您的团队知道，支持他们迅速有效地采取行动.

毕竟, when a security incident occurs, it’s not just technical teams that need to act; non-technical resources – such as legal 和 communications – as well as outside parties will need to be involved, especially if you partner with a 安全服务提供商.

What are Managed 事件响应 服务? 

托管IR服务由外部供应商提供，旨在帮助任何成熟度的组织, 大小, 和 skillset better prepare for 和 manage a 违反. 这些托管服务提供商可以通过以下方式帮助解决战略和战术差距:

• Developing robust security programs:如果您不确定您的事件检测程序是否涵盖了与您的组织相关的所有可能的突发事件, 托管IR服务可以帮助您提高对事件和违规行为的准备程度. 
• Conducting tabletop exercises:让您的内部IR团队通过他们的步伐，并通过供应商进行的威胁模拟演习来验证他们的准备情况. 
• Conducting compromise 和/or 违反 readiness assessments外部IR团队可以评估您组织的环境和安全流程的当前状态, 和 identify any potential risks or gaps. 
• Providing immediate 违反 remediation: If you suspect you're being 违反ed 和 need immediate help, 托管服务提供商可以立即采取行动，帮助阻止进一步的损害. 
• Offering incident response retainers雇佣人员确保你的团队和供应商的团队按照一个计划保持一致，并且每个人都准备好在发生违规时离开. Many retainers will include several of the services named above, 他们通常会保证在响应时间上达成一定的服务水平协议. 

这可能听起来很重复，但最糟糕的准备时间是在入侵发生之后. Having a robust IR plan in place – 和 ensuring it's been communicated to all stakeholders – is the best way to prepare for a worst-case scenario. 

死后的 

在成功应对了一个事件之后，现在还不是休息的时候. 内部IR团队应进行事后分析，从经验中吸取教训，并调整应对准备.

What worked, what didn't work, 和 what could work better or faster? There's no better teacher than experience, 因此，从应对实际事件中吸取尽可能多的教训是很重要的.

Read More on 事件响应 

Prepare for Battle: Let's Build an 事件响应 Plan (Part 1)

Prepare for Battle: Let's Build an 事件响应 Plan (Part 2)

事件响应 New: Latest Rapid7 博客 Posts