NIST releases new Computer Security Incident Handling Guide

Computer security incident response has become an important component for the informaiton security professional, and the departments he or she runs. Security-related threats have become not only more numerous and diverse but also more damaging and disruptive. NIST has released a new paper published as Special Publication 800-61 which addresses computer security incident handling.

At over 148 pages its not a light read, but it is well worth it. Here is a quick glimpse as to what it covers:

1. Organizing a Computer Security Incident Response Capability
   
2. Handling an Incident
   
3. Handling Denial of Service Incidents
   
4. Handling Malicious Code Incidents
   
5. Handling Unauthorized Access Incidents
   
6. Handling Inappropriate Usage Incidents
   
7. Handling Multiple Component Incidents

The paper breaks the way to deal with incidents into distinct compoents:

• Preparation
  
• Detection and Analysis
  
• Containment, Eradication and Recovery
  
• Post-Incident Activity

I really enjoyed how the authors positions each action, and the practical expectations they describe in the document. This is a great find, and something you should take a look at when you have a chance, especially to measure up against your own Incident Response plan. You do have a plan don't you? Remember, it was one of the things you were to have as part of the Rule of Immediate and Proper Response.

Happy reading!

Posted by SilverStr at January 25, 2004 02:34 AM | TrackBack