Benjamin Franklin is quoted as saying by failing to prepare, you are preparing to fail. In many ways, this sentiment is quite accurate when it comes to organizations and the threat of cyber attacks. Preparing for a cyber attack is a critical function that must be taken as seriously as any other aspect of cyber security. Having a solid understanding of the Incident Response Process to build on with an incident response capability can provide organizations with a measure of preparation so that in the event of an incident, they can respond. Keep in mind as we move forward that the forensic techniques, threat intelligence, and reverse engineering are there to assist an organization to get to the end, that is, back up and running. This chapter explored some of the preparation that goes into building an incident response capability. Selecting a team, creating a plan and building the playbooks and the escalation procedures allows an CSIRT to effectively address an incident. The CSIRT and associated plans give structure to the digital forensic techniques to be discussed. This discussion begins with the next chapter where proper evidence handling and documentation is the critical first step in investigating an incident.
Digital Forensics and Incident Response
By :
Digital Forensics and Incident Response
By:
Overview of this book
Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom.
By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.
Related Content you might be interested in
Current Title:
Digital Forensics and Incident Response
No titles found
Table of Contents (18 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface
Free Chapter
Incident Response
Forensic Fundamentals
Network Evidence Collection
Acquiring Host-Based Evidence
Understanding Forensic Imaging
Network Evidence Analysis
Analyzing System Memory
Analyzing System Storage
Forensic Reporting
Malware Analysis
Customer Reviews