{"id":13646,"date":"2018-03-27T13:48:12","date_gmt":"2018-03-27T13:48:12","guid":{"rendered":"https:\/\/www.process.st\/templates\/it-security-incident-response-plan\/"},"modified":"2024-02-28T20:56:42","modified_gmt":"2024-02-28T20:56:42","slug":"it-security-incident-response-plan","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/it-security-incident-response-plan\/","title":{"rendered":"IT Security Incident Response Plan"},"content":{"rendered":"
\n

Introduction: <\/h2>\n
\n
\n <\/a>
\n <\/figure>\n<\/p><\/div>\n
\n

A massive 61%<\/a> of companies have experienced critical incidents in the last two years \u2014 that includes data breaches, unauthorized access, and denial of service attacks.<\/p>\n

Are you in this wide majority of organization?<\/p>\n

Do you have a formal incident response plan?<\/p>\n

Most organizations (91%) do not believe their incident response processes are very effective, which indicates a need for a standardized checklist that is built out and developed with help of the whole information security team.<\/p>\n

This checklist serves as a starting point, and will demonstrate the general procedures that should be taken into account.<\/p>\n

For a full explanation of how to set this checklist up, including handy conditional logic and features that you only get when you use this checklist in your Process Street account, make sure to refer to this checklist's blog post counterpart<\/a>.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

Diagnose: <\/h2>\n<\/section>\n
\n

Select source of incident <\/h2>\n
\n

Your diagnostic response will vary depending on the affected system. Use the form field below to indicate which systems are affected and highlight which of the next tasks need to be done.<\/p>\n<\/p><\/div>\n

\n
    \n
  • \n
    \n
    \n 1\n <\/div>\n<\/p><\/div>\n
    \n
    <\/div>\n<\/p><\/div>\n
    \n Linux\n <\/div>\n<\/li>\n
  • \n
    \n
    \n 2\n <\/div>\n<\/p><\/div>\n
    \n
    <\/div>\n<\/p><\/div>\n
    \n Windows\n <\/div>\n<\/li>\n
  • \n
    \n
    \n 3\n <\/div>\n<\/p><\/div>\n
    \n
    <\/div>\n<\/p><\/div>\n
    \n Network device\n <\/div>\n<\/li>\n
  • \n
    \n
    \n 4\n <\/div>\n<\/p><\/div>\n
    \n
    <\/div>\n<\/p><\/div>\n
    \n Web server\n <\/div>\n<\/li>\n<\/ul><\/div>\n<\/section>\n
    \n

    Review Linux logs <\/h2>\n
    \n

    Log location:<\/strong> \/var\/log<\/code><\/p>\n

    Indicators of suspicious activity may include:<\/p>\n

    Successful user login:<\/strong><\/p>\n

      \n
    • Accepted password<\/li>\n
    • Accepted publickey<\/li>\n
    • session opened<\/li>\n<\/ul>\n

      Failed user login:<\/strong><\/p>\n

        \n
      • authentication failure<\/li>\n
      • failed password<\/strong>
        <\/strong><\/li>\n<\/ul>\n

        User log-off:<\/strong><\/p>\n

          \n
        • session closed<\/li>\n<\/ul>\n

          User account change or deletion:<\/strong><\/p>\n

            \n
          • password changed<\/li>\n
          • new user<\/li>\n
          • delete user<\/li>\n<\/ul>\n

            Sudo actions:<\/strong><\/p>\n

              \n
            • sudo COMMAND=<\/li>\n
            • FAILED su<\/li>\n<\/ul>\n

              Service failure:<\/strong><\/p>\n

                \n
              • failed<\/li>\n
              • failure<\/li>\n<\/ul>\n
                \n<\/p><\/div>\n
                \n
                \n